Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 0DCB0CBEh |
0_2_0DCB0658 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 02F9F45Dh |
2_2_02F9F2C0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 02F9F45Dh |
2_2_02F9F4AC |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 02F9FC19h |
2_2_02F9F960 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D49280h |
2_2_05D48FB0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D47EB5h |
2_2_05D47B78 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D418A1h |
2_2_05D415F8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4C826h |
2_2_05D4C558 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D40FF1h |
2_2_05D40D48 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4E816h |
2_2_05D4E548 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D40741h |
2_2_05D40498 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D46733h |
2_2_05D46488 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D43709h |
2_2_05D43460 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4BF06h |
2_2_05D4BC38 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4DEF6h |
2_2_05D4DC28 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4DA66h |
2_2_05D4D798 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D45A29h |
2_2_05D45780 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4FA56h |
2_2_05D4F788 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4BA76h |
2_2_05D4B7A8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D42A01h |
2_2_05D42758 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D479C9h |
2_2_05D47720 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D45179h |
2_2_05D44ED0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D42151h |
2_2_05D41EA8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D47119h |
2_2_05D46E70 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4D146h |
2_2_05D4CE78 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4F136h |
2_2_05D4EE68 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D448C9h |
2_2_05D44620 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4ECA6h |
2_2_05D4E9D8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4CCB6h |
2_2_05D4C9E8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D41449h |
2_2_05D411A0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4C396h |
2_2_05D4C0C8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D40B99h |
2_2_05D408F0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then mov esp, ebp |
2_2_05D4B090 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then mov esp, ebp |
2_2_05D4B081 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4E386h |
2_2_05D4E0B8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D402E9h |
2_2_05D40040 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D432B1h |
2_2_05D43008 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D462D9h |
2_2_05D46030 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D45E81h |
2_2_05D45BD8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D42E59h |
2_2_05D42BB0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4B5E6h |
2_2_05D4B318 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D425A9h |
2_2_05D42300 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4D5D6h |
2_2_05D4D308 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D455D1h |
2_2_05D45328 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D47571h |
2_2_05D472C8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D4F5C6h |
2_2_05D4F2F8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D41CF9h |
2_2_05D41A50 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D44D21h |
2_2_05D44A78 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 4x nop then jmp 05D46CC1h |
2_2_05D46A18 |
Source: invoice.exe, 00000002.00000002.4135565493.00000000032EA000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://51.38.247.67:8081/_send_.php?L |
Source: invoice.exe, 00000000.00000002.1711700056.0000000004E83000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4132870602.0000000000402000.00000040.00000400.00020000.00000000.sdmp |
String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded |
Source: invoice.exe, 00000000.00000002.1711700056.0000000004E83000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4132870602.0000000000402000.00000040.00000400.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000031E1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://aborters.duckdns.org:8081 |
Source: invoice.exe, 00000000.00000002.1711700056.0000000004E83000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4132870602.0000000000402000.00000040.00000400.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000031E1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://anotherarmy.dns.army:8081 |
Source: invoice.exe, 00000002.00000002.4135565493.00000000031E1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://checkip.dyndns.org |
Source: invoice.exe, 00000002.00000002.4135565493.00000000031E1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://checkip.dyndns.org/ |
Source: invoice.exe, 00000000.00000002.1711700056.0000000004E83000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4132870602.0000000000402000.00000040.00000400.00020000.00000000.sdmp |
String found in binary or memory: http://checkip.dyndns.org/q |
Source: invoice.exe, 00000002.00000002.4135565493.00000000035E8000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000037E3000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003634000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006C23000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036CB000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006C14000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006B40000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003697000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003616000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003656000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003606000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003841000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003674000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006BF1000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4134943200.000000000171E000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036DA000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006BA6000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003625000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4134157736.0000000001666000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140665552.0000000006300000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04 |
Source: invoice.exe, 00000002.00000002.4140805213.0000000006B40000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06 |
Source: invoice.exe |
String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q |
Source: invoice.exe |
String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t |
Source: invoice.exe, 00000002.00000002.4140805213.0000000006BF1000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006BA6000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.use |
Source: invoice.exe, 00000002.00000002.4140805213.0000000006BA6000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.use(?RE |
Source: invoice.exe, 00000002.00000002.4140805213.0000000006BF1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.useM |
Source: invoice.exe, 00000002.00000002.4135565493.00000000035E8000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000037E3000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003634000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006C23000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036CB000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006B40000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003697000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003616000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003656000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003606000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003841000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003674000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006BF1000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4134943200.000000000171E000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036DA000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006BA6000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003625000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4134157736.0000000001666000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140665552.0000000006300000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0# |
Source: invoice.exe, 00000002.00000002.4135565493.00000000035E8000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000037E3000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003634000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036CB000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003697000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003616000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003656000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003606000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003841000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003674000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036DA000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003625000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000035C9000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000037C4000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003831000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.000000000363D000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003680000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000037D3000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://foxwagon-equipment.com |
Source: invoice.exe |
String found in binary or memory: http://ocsp.comodoca.com0 |
Source: invoice.exe, 00000002.00000002.4135565493.00000000035E8000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000037E3000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003634000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006C23000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036CB000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006B40000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003697000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003616000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003656000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003606000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003841000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003674000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006BF1000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4134943200.000000000171E000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036DA000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006BA6000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003625000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4134157736.0000000001666000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140665552.0000000006300000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://ocsp.sectigo.com0= |
Source: invoice.exe, 00000002.00000002.4135565493.00000000031E1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: invoice.exe, 00000000.00000002.1711700056.0000000004E83000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4132870602.0000000000402000.00000040.00000400.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000031E1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://varders.kozow.com:8081 |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0 |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.carterandcone.coml |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers/? |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers8 |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers? |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designersG |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fonts.com |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.founder.com.cn/cn |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.founder.com.cn/cn/bThe |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.founder.com.cn/cn/cThe |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.galapagosdesign.com/DPlease |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.goodfont.co.kr |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.jiyu-kobo.co.jp/ |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.sajatypeworks.com |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.sakkal.com |
Source: invoice.exe, 00000000.00000002.1713739091.0000000005BC0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.sakkal.com. |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.sandoll.co.kr |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.tiro.com |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.typography.netD |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.urwpp.deDPlease |
Source: invoice.exe, 00000000.00000002.1713868426.0000000007442000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.zhongyicts.com.cn |
Source: invoice.exe, 00000002.00000002.4135565493.00000000032C8000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org |
Source: invoice.exe, 00000000.00000002.1711700056.0000000004E83000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4132870602.0000000000402000.00000040.00000400.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000032C8000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot |
Source: invoice.exe, 00000002.00000002.4135565493.00000000032C8000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text= |
Source: invoice.exe, 00000002.00000002.4135565493.00000000032C8000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20a |
Source: invoice.exe, 00000002.00000002.4135565493.00000000032EA000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://chrome.google.com/webstore?hl=en |
Source: invoice.exe, 00000002.00000002.4135565493.0000000003231000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000032C8000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://reallyfreegeoip.org |
Source: invoice.exe, 00000000.00000002.1711700056.0000000004E83000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003231000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4132870602.0000000000402000.00000040.00000400.00020000.00000000.sdmp |
String found in binary or memory: https://reallyfreegeoip.org/xml/ |
Source: invoice.exe, 00000002.00000002.4135565493.00000000032C8000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33 |
Source: invoice.exe, 00000002.00000002.4135565493.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.000000000325C000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000032C8000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$ |
Source: invoice.exe, 00000002.00000002.4135565493.00000000035E8000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000037E3000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003634000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006C23000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036CB000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006B40000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003697000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003616000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003656000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003606000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003841000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003674000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006BF1000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4134943200.000000000171E000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000036DA000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140805213.0000000006BA6000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.0000000003625000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4134157736.0000000001666000.00000004.00000020.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4140665552.0000000006300000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://sectigo.com/CPS0 |
Source: invoice.exe, 00000002.00000002.4138430220.000000000430F000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.0000000004337000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.00000000042C2000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.0000000004589000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.00000000044B4000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.0000000004466000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016 |
Source: invoice.exe, 00000002.00000002.4138430220.0000000004312000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.0000000004564000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.00000000042C8000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.0000000004441000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.000000000446C000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.000000000429D000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples |
Source: invoice.exe, 00000002.00000002.4138430220.000000000430F000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4135565493.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.0000000004337000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.00000000042C2000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.0000000004589000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.00000000044B4000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.0000000004466000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17 |
Source: invoice.exe, 00000002.00000002.4138430220.0000000004312000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.0000000004564000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.00000000042C8000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.0000000004441000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.000000000446C000.00000004.00000800.00020000.00000000.sdmp, invoice.exe, 00000002.00000002.4138430220.000000000429D000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install |
Source: invoice.exe |
String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0 |
Source: invoice.exe, 00000002.00000002.4135565493.00000000032EA000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://www.office.com/ |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_016FE42C |
0_2_016FE42C |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_057DED40 |
0_2_057DED40 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_057DDB70 |
0_2_057DDB70 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_057DED30 |
0_2_057DED30 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_057DCB68 |
0_2_057DCB68 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_057DDB60 |
0_2_057DDB60 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_057DCB59 |
0_2_057DCB59 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_057DBBB0 |
0_2_057DBBB0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_057DBBAB |
0_2_057DBBAB |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_057DE2D8 |
0_2_057DE2D8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_057DE2CB |
0_2_057DE2CB |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF27E8 |
0_2_07EF27E8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF3720 |
0_2_07EF3720 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF0040 |
0_2_07EF0040 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF3F68 |
0_2_07EF3F68 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF27E3 |
0_2_07EF27E3 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF3713 |
0_2_07EF3713 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EFB620 |
0_2_07EFB620 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EFB613 |
0_2_07EFB613 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF25CB |
0_2_07EF25CB |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF25D8 |
0_2_07EF25D8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF44A8 |
0_2_07EF44A8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF4498 |
0_2_07EF4498 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF2368 |
0_2_07EF2368 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF2378 |
0_2_07EF2378 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EFD258 |
0_2_07EFD258 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EFB1E8 |
0_2_07EFB1E8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF21CB |
0_2_07EF21CB |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF21D8 |
0_2_07EF21D8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF0006 |
0_2_07EF0006 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF3013 |
0_2_07EF3013 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF2F68 |
0_2_07EF2F68 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF0F68 |
0_2_07EF0F68 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF0F63 |
0_2_07EF0F63 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF2F5B |
0_2_07EF2F5B |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF3F59 |
0_2_07EF3F59 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EFCE20 |
0_2_07EFCE20 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EFADB0 |
0_2_07EFADB0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF0D68 |
0_2_07EF0D68 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF0D58 |
0_2_07EF0D58 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF1B28 |
0_2_07EF1B28 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF1B38 |
0_2_07EF1B38 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF1AA8 |
0_2_07EF1AA8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EFEAA3 |
0_2_07EFEAA3 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF2A40 |
0_2_07EF2A40 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 0_2_07EF2A33 |
0_2_07EF2A33 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F9D278 |
2_2_02F9D278 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F95362 |
2_2_02F95362 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F9A088 |
2_2_02F9A088 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F97118 |
2_2_02F97118 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F9C738 |
2_2_02F9C738 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F9C46C |
2_2_02F9C46C |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F9CA08 |
2_2_02F9CA08 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F969A0 |
2_2_02F969A0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F9E988 |
2_2_02F9E988 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F93E09 |
2_2_02F93E09 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F9CFAB |
2_2_02F9CFAB |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F9CCD8 |
2_2_02F9CCD8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F9C19F |
2_2_02F9C19F |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F929E0 |
2_2_02F929E0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F9E97B |
2_2_02F9E97B |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_02F9F960 |
2_2_02F9F960 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D48FB0 |
2_2_05D48FB0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D481D0 |
2_2_05D481D0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D47B78 |
2_2_05D47B78 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D415F8 |
2_2_05D415F8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D415E8 |
2_2_05D415E8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4C558 |
2_2_05D4C558 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D40D48 |
2_2_05D40D48 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4E548 |
2_2_05D4E548 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4C548 |
2_2_05D4C548 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4E538 |
2_2_05D4E538 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D40D39 |
2_2_05D40D39 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D40498 |
2_2_05D40498 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D46488 |
2_2_05D46488 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D40489 |
2_2_05D40489 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D43450 |
2_2_05D43450 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D46478 |
2_2_05D46478 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D43460 |
2_2_05D43460 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4FC18 |
2_2_05D4FC18 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4DC19 |
2_2_05D4DC19 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4BC38 |
2_2_05D4BC38 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4DC28 |
2_2_05D4DC28 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4BC29 |
2_2_05D4BC29 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D42FF9 |
2_2_05D42FF9 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4D798 |
2_2_05D4D798 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4B798 |
2_2_05D4B798 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4D787 |
2_2_05D4D787 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D45780 |
2_2_05D45780 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4F788 |
2_2_05D4F788 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D48FA1 |
2_2_05D48FA1 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4B7A8 |
2_2_05D4B7A8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D42758 |
2_2_05D42758 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D42748 |
2_2_05D42748 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D45770 |
2_2_05D45770 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4F778 |
2_2_05D4F778 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D47710 |
2_2_05D47710 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D47720 |
2_2_05D47720 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D44ED0 |
2_2_05D44ED0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D44EC0 |
2_2_05D44EC0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D41E98 |
2_2_05D41E98 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D41EA8 |
2_2_05D41EA8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4EE57 |
2_2_05D4EE57 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D46E70 |
2_2_05D46E70 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4CE78 |
2_2_05D4CE78 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4CE67 |
2_2_05D4CE67 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D46E62 |
2_2_05D46E62 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4EE68 |
2_2_05D4EE68 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D44610 |
2_2_05D44610 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D44620 |
2_2_05D44620 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4E9D8 |
2_2_05D4E9D8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4C9D8 |
2_2_05D4C9D8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4E9C8 |
2_2_05D4E9C8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4C9E8 |
2_2_05D4C9E8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D41190 |
2_2_05D41190 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D411A0 |
2_2_05D411A0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4A938 |
2_2_05D4A938 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4A928 |
2_2_05D4A928 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4C0C8 |
2_2_05D4C0C8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D408F0 |
2_2_05D408F0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D408E0 |
2_2_05D408E0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4C0B7 |
2_2_05D4C0B7 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D438B8 |
2_2_05D438B8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4E0B8 |
2_2_05D4E0B8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4E0A7 |
2_2_05D4E0A7 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D40040 |
2_2_05D40040 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D40006 |
2_2_05D40006 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D43008 |
2_2_05D43008 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D46030 |
2_2_05D46030 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D46021 |
2_2_05D46021 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D45BD8 |
2_2_05D45BD8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D45BC9 |
2_2_05D45BC9 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D42BB0 |
2_2_05D42BB0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D42BA0 |
2_2_05D42BA0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D47B69 |
2_2_05D47B69 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4B318 |
2_2_05D4B318 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4531A |
2_2_05D4531A |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4B307 |
2_2_05D4B307 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D42300 |
2_2_05D42300 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4D308 |
2_2_05D4D308 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D45328 |
2_2_05D45328 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D472C8 |
2_2_05D472C8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4D2F7 |
2_2_05D4D2F7 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D422F0 |
2_2_05D422F0 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4F2F8 |
2_2_05D4F2F8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D4F2E7 |
2_2_05D4F2E7 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D472B8 |
2_2_05D472B8 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D41A50 |
2_2_05D41A50 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D41A41 |
2_2_05D41A41 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D44A78 |
2_2_05D44A78 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D44A68 |
2_2_05D44A68 |
Source: C:\Users\user\Desktop\invoice.exe |
Code function: 2_2_05D46A18 |
2_2_05D46A18 |
Source: 2.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 2.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 2.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: 0.2.invoice.exe.4ec7078.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 0.2.invoice.exe.4ec7078.0.unpack, type: UNPACKEDPE |
Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 0.2.invoice.exe.4ec7078.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: 0.2.invoice.exe.4e83658.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 0.2.invoice.exe.4e83658.1.unpack, type: UNPACKEDPE |
Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 0.2.invoice.exe.4e83658.1.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: 0.2.invoice.exe.4e83658.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 0.2.invoice.exe.4e83658.1.raw.unpack, type: UNPACKEDPE |
Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 0.2.invoice.exe.4e83658.1.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: 0.2.invoice.exe.4ec7078.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 0.2.invoice.exe.4ec7078.0.raw.unpack, type: UNPACKEDPE |
Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 0.2.invoice.exe.4ec7078.0.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: 00000002.00000002.4132870602.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 00000000.00000002.1711700056.0000000004E83000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: Process Memory Space: invoice.exe PID: 7496, type: MEMORYSTR |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: Process Memory Space: invoice.exe PID: 7644, type: MEMORYSTR |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: dwrite.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: windowscodecs.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: rasapi32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: rasman.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: rtutils.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: dhcpcsvc6.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: dhcpcsvc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: secur32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, OWrAqTU8cKq0ljpQE6w.cs |
High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'AEkl7HhOtt', 'xIelPkxNCN', 'NsolomKrta', 'ePrlk74ska', 'semlCYOuvp', 'N9OlnrVoRb', 'AIOlYW8kfM' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, WOqrwBu3NKsXnk9m8R.cs |
High entropy of concatenated method names: 'FgW8vDuJof', 'jdg8HJrgMW', 'J1R8TDcP1W', 'y2N8IeyU8B', 'nVK8DPgpom', 'xWQ8E0T7Ln', 'Txv8jeh9uq', 'IT88umqaLw', 'VVr80JiYJZ', 'POE8pJe1nb' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, tpYOOYNRDTYNmZQy3D.cs |
High entropy of concatenated method names: 'SUSD46GNLb', 'zFLDF1DVkf', 'RCUIcY3KLY', 'Wb2IMuknr6', 'nLyItXXdv3', 'XtGI9QckMs', 'UQAIKaFikU', 'CHgI13N8Jq', 'M9JILBBlQ1', 'M8KIS2NB9A' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, z37a55I7tnxP8UJgRY.cs |
High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'W4JBfTNKcj', 'PgHByvPvgL', 'IelBzdNEFT', 'wT98Ry2cZ2', 'oOE8UlfCLR', 'mag8BhGaVK', 'FsE88viEnw', 'hIbauhOrNtJQkxqQItS' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, xooFBNJNioHs7l2I7V.cs |
High entropy of concatenated method names: 'JGET7xs11b', 'TFiTP2vFag', 'QNaTo6H1Da', 'igDTkTJHHu', 'OA8TCchnsE', 'HrDTnUs7oI', 'PCtTYa94UC', 'PdPTiDIppS', 'rGyTfsZpFW', 'PdoTyFoesX' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, q50EuwB1ZswLOLyd3Y.cs |
High entropy of concatenated method names: 'LntWE1PLa', 'WX3xCC6B3', 'Y83mVa7RI', 'hGhFtcnnv', 'M0nh0ssGZ', 'CcaNBFwwy', 'DU6Ulk3kOpUjfrr4kn', 'DoETtlFuWjvvQXdwmp', 'QNCexpDwA', 'kHSlPbcr8' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, UCumTKzeXP2qsxMTCl.cs |
High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'TEvwdw5KIs', 'DvRwrbVs9y', 'RQpwZq0laf', 'PeGwq2MBVQ', 'adXwef905Y', 'edawwTMwd9', 'JBewlUlVGV' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, yD67UMi68PjKIgMv2e.cs |
High entropy of concatenated method names: 'vZpeHnvJSw', 'OAbeTKCh3V', 'KRPeILGu8Q', 'mh6eDQvdt0', 'f3heEHC6D2', 'EhNejQhdFR', 'cvPeu1tOJX', 'de9e0su3mg', 'xKrepVb5Eh', 'Vjye5M1KUj' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, YoIqUynN03x5GW76LY.cs |
High entropy of concatenated method names: 'LpmqiMcLvx', 'bTyqyaB0rh', 'IqkeR00tMp', 'Y4XeU45vME', 'PbGqXe26cM', 'e3LqGVs502', 'CqOq37EjW3', 'fBLq7ChPTg', 'tvhqP0hf8p', 'H6YqoXJOj0' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, XJXZeAURR8bNbkVL9Qa.cs |
High entropy of concatenated method names: 'YMPwVCHDMB', 'PaiwOW4tDT', 'PEFwWxqjNG', 'KKgwx5ZMxK', 'Qoww4WulSS', 'DhDwm83AvU', 'HjuwFwiilH', 'T2FwJyh2QP', 'Aw1whtEJoP', 'm4LwNXwwJ4' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, DLDyoth3cA9OPF4BBW.cs |
High entropy of concatenated method names: 'LQXIxswrwg', 'mJsImlkAnF', 'O67IJ5GyRA', 'tEXIhvQ0jZ', 'OT8IrBOayM', 'zAeIZ01AAI', 'aX5Iqwo3L8', 'pJkIeiaSgh', 'jg2IwvTGpm', 'cnuIltFfyD' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, Q8Savn2EEKDvGGk4tD.cs |
High entropy of concatenated method names: 'e0UEvaUSPP', 'OVdEThHjWd', 'GipEDoHGKb', 'BdlEjh1FjP', 'bvmEuwQpAf', 'xC4DC3JeSj', 'p8DDnwJ9Xt', 'jfPDY72uEe', 'b49Div8DLI', 'ukKDfOoQM4' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, qxMMnGkCuky0jlW00b.cs |
High entropy of concatenated method names: 'pVKqpMcprJ', 'mIFq5BxTZN', 'ToString', 'v4kqHel3qY', 'Re2qT96IcX', 'O42qI44w3P', 'vCFqD2lKef', 'L7cqEUXLkk', 'mPmqjF6Qv3', 'EoJquijxcx' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, DlUn9GLvZFJucIvH6U.cs |
High entropy of concatenated method names: 'iHYjVVeMXu', 'DnLjOcf2kk', 'rHpjWs8smY', 'M84jxudiRR', 'DtSj4LooI0', 'qfIjm51v21', 'S2jjFZqI7j', 'OyijJMYFHh', 'rhVjhSLmiQ', 'YXijNWwMEF' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, rSm8epM8LZPO3wujOF.cs |
High entropy of concatenated method names: 'UpRE6ARatT', 'dvkEVWiQC4', 'YQtEWD8IOP', 'N37ExX55tF', 'yoMEmHl9AA', 'jxZEFEq2qP', 'SfmEhfxqYy', 'LBPENrvxad', 'UDvLsM0DFhROnAvIIJf', 'qWYgri0kjOY6B13ISVt' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, DRVodCTgBbwhV3HwKW.cs |
High entropy of concatenated method names: 'Dispose', 'xCWUfkllNU', 'du0Bb79u1h', 'rHlvvFCObC', 'fODUy67UM6', 'cPjUzKIgMv', 'ProcessDialogKey', 'Ge2BRrgFwg', 'sEDBUvN79E', 'tBdBBSFgYO' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, GrgFwgflEDvN79EABd.cs |
High entropy of concatenated method names: 'CGpe2L0QDc', 'ITieb5wXmT', 'tVcecMVIlu', 'nWSeMyKkdY', 'EDse7MrHea', 'j5retp6tMf', 'Next', 'Next', 'Next', 'NextBytes' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, jbxWpuaAKyXyeIInMy.cs |
High entropy of concatenated method names: 'tb6UjooFBN', 'FioUuHs7l2', 'J3cUpA9OPF', 'ABBU5WApYO', 'pQyUr3D38S', 'dvnUZEEKDv', 'crhETH5Fmw6mmxUepw', 'lOhtT0MX3KLxIEQ9RE', 'en3UUn08v8', 'LI1U8iDEIL' |
Source: 0.2.invoice.exe.4d15c30.3.raw.unpack, qcRFcU3V7gP2X0g1AO.cs |
High entropy of concatenated method names: 'bgqdJOvb1S', 'nvSdhaICw2', 'yy2d2cscCA', 'tn9dbpBV1W', 'K3JdMNpJrv', 'ee5dtsb6dW', 'uAEdK4qHHK', 'Db1d1j6nil', 'RnudSGQRjk', 'GiTdXh0tEe' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, OWrAqTU8cKq0ljpQE6w.cs |
High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'AEkl7HhOtt', 'xIelPkxNCN', 'NsolomKrta', 'ePrlk74ska', 'semlCYOuvp', 'N9OlnrVoRb', 'AIOlYW8kfM' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, WOqrwBu3NKsXnk9m8R.cs |
High entropy of concatenated method names: 'FgW8vDuJof', 'jdg8HJrgMW', 'J1R8TDcP1W', 'y2N8IeyU8B', 'nVK8DPgpom', 'xWQ8E0T7Ln', 'Txv8jeh9uq', 'IT88umqaLw', 'VVr80JiYJZ', 'POE8pJe1nb' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, tpYOOYNRDTYNmZQy3D.cs |
High entropy of concatenated method names: 'SUSD46GNLb', 'zFLDF1DVkf', 'RCUIcY3KLY', 'Wb2IMuknr6', 'nLyItXXdv3', 'XtGI9QckMs', 'UQAIKaFikU', 'CHgI13N8Jq', 'M9JILBBlQ1', 'M8KIS2NB9A' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, z37a55I7tnxP8UJgRY.cs |
High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'W4JBfTNKcj', 'PgHByvPvgL', 'IelBzdNEFT', 'wT98Ry2cZ2', 'oOE8UlfCLR', 'mag8BhGaVK', 'FsE88viEnw', 'hIbauhOrNtJQkxqQItS' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, xooFBNJNioHs7l2I7V.cs |
High entropy of concatenated method names: 'JGET7xs11b', 'TFiTP2vFag', 'QNaTo6H1Da', 'igDTkTJHHu', 'OA8TCchnsE', 'HrDTnUs7oI', 'PCtTYa94UC', 'PdPTiDIppS', 'rGyTfsZpFW', 'PdoTyFoesX' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, q50EuwB1ZswLOLyd3Y.cs |
High entropy of concatenated method names: 'LntWE1PLa', 'WX3xCC6B3', 'Y83mVa7RI', 'hGhFtcnnv', 'M0nh0ssGZ', 'CcaNBFwwy', 'DU6Ulk3kOpUjfrr4kn', 'DoETtlFuWjvvQXdwmp', 'QNCexpDwA', 'kHSlPbcr8' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, UCumTKzeXP2qsxMTCl.cs |
High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'TEvwdw5KIs', 'DvRwrbVs9y', 'RQpwZq0laf', 'PeGwq2MBVQ', 'adXwef905Y', 'edawwTMwd9', 'JBewlUlVGV' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, yD67UMi68PjKIgMv2e.cs |
High entropy of concatenated method names: 'vZpeHnvJSw', 'OAbeTKCh3V', 'KRPeILGu8Q', 'mh6eDQvdt0', 'f3heEHC6D2', 'EhNejQhdFR', 'cvPeu1tOJX', 'de9e0su3mg', 'xKrepVb5Eh', 'Vjye5M1KUj' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, YoIqUynN03x5GW76LY.cs |
High entropy of concatenated method names: 'LpmqiMcLvx', 'bTyqyaB0rh', 'IqkeR00tMp', 'Y4XeU45vME', 'PbGqXe26cM', 'e3LqGVs502', 'CqOq37EjW3', 'fBLq7ChPTg', 'tvhqP0hf8p', 'H6YqoXJOj0' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, XJXZeAURR8bNbkVL9Qa.cs |
High entropy of concatenated method names: 'YMPwVCHDMB', 'PaiwOW4tDT', 'PEFwWxqjNG', 'KKgwx5ZMxK', 'Qoww4WulSS', 'DhDwm83AvU', 'HjuwFwiilH', 'T2FwJyh2QP', 'Aw1whtEJoP', 'm4LwNXwwJ4' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, DLDyoth3cA9OPF4BBW.cs |
High entropy of concatenated method names: 'LQXIxswrwg', 'mJsImlkAnF', 'O67IJ5GyRA', 'tEXIhvQ0jZ', 'OT8IrBOayM', 'zAeIZ01AAI', 'aX5Iqwo3L8', 'pJkIeiaSgh', 'jg2IwvTGpm', 'cnuIltFfyD' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, Q8Savn2EEKDvGGk4tD.cs |
High entropy of concatenated method names: 'e0UEvaUSPP', 'OVdEThHjWd', 'GipEDoHGKb', 'BdlEjh1FjP', 'bvmEuwQpAf', 'xC4DC3JeSj', 'p8DDnwJ9Xt', 'jfPDY72uEe', 'b49Div8DLI', 'ukKDfOoQM4' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, qxMMnGkCuky0jlW00b.cs |
High entropy of concatenated method names: 'pVKqpMcprJ', 'mIFq5BxTZN', 'ToString', 'v4kqHel3qY', 'Re2qT96IcX', 'O42qI44w3P', 'vCFqD2lKef', 'L7cqEUXLkk', 'mPmqjF6Qv3', 'EoJquijxcx' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, DlUn9GLvZFJucIvH6U.cs |
High entropy of concatenated method names: 'iHYjVVeMXu', 'DnLjOcf2kk', 'rHpjWs8smY', 'M84jxudiRR', 'DtSj4LooI0', 'qfIjm51v21', 'S2jjFZqI7j', 'OyijJMYFHh', 'rhVjhSLmiQ', 'YXijNWwMEF' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, rSm8epM8LZPO3wujOF.cs |
High entropy of concatenated method names: 'UpRE6ARatT', 'dvkEVWiQC4', 'YQtEWD8IOP', 'N37ExX55tF', 'yoMEmHl9AA', 'jxZEFEq2qP', 'SfmEhfxqYy', 'LBPENrvxad', 'UDvLsM0DFhROnAvIIJf', 'qWYgri0kjOY6B13ISVt' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, DRVodCTgBbwhV3HwKW.cs |
High entropy of concatenated method names: 'Dispose', 'xCWUfkllNU', 'du0Bb79u1h', 'rHlvvFCObC', 'fODUy67UM6', 'cPjUzKIgMv', 'ProcessDialogKey', 'Ge2BRrgFwg', 'sEDBUvN79E', 'tBdBBSFgYO' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, GrgFwgflEDvN79EABd.cs |
High entropy of concatenated method names: 'CGpe2L0QDc', 'ITieb5wXmT', 'tVcecMVIlu', 'nWSeMyKkdY', 'EDse7MrHea', 'j5retp6tMf', 'Next', 'Next', 'Next', 'NextBytes' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, jbxWpuaAKyXyeIInMy.cs |
High entropy of concatenated method names: 'tb6UjooFBN', 'FioUuHs7l2', 'J3cUpA9OPF', 'ABBU5WApYO', 'pQyUr3D38S', 'dvnUZEEKDv', 'crhETH5Fmw6mmxUepw', 'lOhtT0MX3KLxIEQ9RE', 'en3UUn08v8', 'LI1U8iDEIL' |
Source: 0.2.invoice.exe.7b90000.6.raw.unpack, qcRFcU3V7gP2X0g1AO.cs |
High entropy of concatenated method names: 'bgqdJOvb1S', 'nvSdhaICw2', 'yy2d2cscCA', 'tn9dbpBV1W', 'K3JdMNpJrv', 'ee5dtsb6dW', 'uAEdK4qHHK', 'Db1d1j6nil', 'RnudSGQRjk', 'GiTdXh0tEe' |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 600000 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 599891 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 599766 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 599641 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 599355 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 599235 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 599110 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598985 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598860 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598735 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598610 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598485 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598360 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598235 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598110 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597985 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597860 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597735 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597610 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597485 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597360 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597235 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597110 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596952 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596842 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596734 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596625 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596516 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596407 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596282 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596157 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596047 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595938 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595813 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595688 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595563 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595438 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595329 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595204 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595078 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594969 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594860 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594735 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594610 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594485 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594360 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594235 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594110 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 593985 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 593860 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 593735 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7516 |
Thread sleep time: -922337203685477s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep count: 34 > 30 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -31359464925306218s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -600000s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7744 |
Thread sleep count: 1948 > 30 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -599891s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7744 |
Thread sleep count: 7859 > 30 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep count: 34 > 30 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -599766s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -599641s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -599355s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -599235s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -599110s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -598985s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -598860s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -598735s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -598610s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -598485s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -598360s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -598235s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -598110s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -597985s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -597860s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -597735s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -597610s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -597485s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -597360s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -597235s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -597110s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -596952s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -596842s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -596734s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -596625s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -596516s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -596407s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -596282s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -596157s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -596047s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -595938s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -595813s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -595688s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -595563s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -595438s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -595329s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -595204s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -595078s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -594969s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -594860s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -594735s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -594610s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -594485s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -594360s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -594235s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -594110s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -593985s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -593860s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe TID: 7740 |
Thread sleep time: -593735s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 600000 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 599891 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 599766 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 599641 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 599355 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 599235 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 599110 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598985 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598860 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598735 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598610 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598485 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598360 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598235 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 598110 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597985 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597860 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597735 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597610 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597485 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597360 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597235 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 597110 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596952 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596842 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596734 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596625 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596516 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596407 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596282 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596157 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 596047 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595938 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595813 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595688 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595563 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595438 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595329 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595204 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 595078 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594969 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594860 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594735 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594610 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594485 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594360 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594235 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 594110 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 593985 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 593860 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Thread delayed: delay time: 593735 |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Users\user\Desktop\invoice.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Users\user\Desktop\invoice.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\invoice.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |