Loading ...

Play interactive tourEdit tour

Analysis Report 0g5RHXhRrBanMN3.exe

Overview

General Information

Sample Name:0g5RHXhRrBanMN3.exe
Analysis ID:286344
MD5:2a167a298508c41128e0fb4207bfcc36
SHA1:b696ed9086431631b0186e240181b607d7278bfc
SHA256:a6871feb491e3c89b11f1ff949f92548a6a1e74a498c41a025a478f51b55c42b
Tags:exe

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
Yara detected AntiVM_3
Contains functionality to register a low level keyboard hook
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • 0g5RHXhRrBanMN3.exe (PID: 6856 cmdline: 'C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe' MD5: 2A167A298508C41128E0FB4207BFCC36)
    • schtasks.exe (PID: 6928 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\aKLYmkhoIRn' /XML 'C:\Users\user\AppData\Local\Temp\tmpA935.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 6936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • 0g5RHXhRrBanMN3.exe (PID: 6968 cmdline: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe MD5: 2A167A298508C41128E0FB4207BFCC36)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "4VGxUnBgqbFY", "URL: ": "http://jKnv0qEzhMbmL9w.com", "To: ": "mailfilter247@yandex.com", "ByHost: ": "mail.thanhphet.asia:587", "Password: ": "y7bDEmbW", "From: ": "sales@thanhphet.asia"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.480209574.0000000003046000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000003.00000002.480209574.0000000003046000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      00000000.00000002.222588239.0000000003D21000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000000.00000002.222312874.0000000002D76000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
          00000000.00000002.222274203.0000000002D38000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
            Click to see the 6 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            3.2.0g5RHXhRrBanMN3.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview

              System Summary:

              barindex
              Sigma detected: Scheduled temp file as task from temp locationShow sources
              Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\aKLYmkhoIRn' /XML 'C:\Users\user\AppData\Local\Temp\tmpA935.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\aKLYmkhoIRn' /XML 'C:\Users\user\AppData\Local\Temp\tmpA935.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe' , ParentImage: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe, ParentProcessId: 6856, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\aKLYmkhoIRn' /XML 'C:\Users\user\AppData\Local\Temp\tmpA935.tmp', ProcessId: 6928

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Found malware configurationShow sources
              Source: 0g5RHXhRrBanMN3.exe.6968.3.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "4VGxUnBgqbFY", "URL: ": "http://jKnv0qEzhMbmL9w.com", "To: ": "mailfilter247@yandex.com", "ByHost: ": "mail.thanhphet.asia:587", "Password: ": "y7bDEmbW", "From: ": "sales@thanhphet.asia"}
              Multi AV Scanner detection for dropped fileShow sources
              Source: C:\Users\user\AppData\Roaming\aKLYmkhoIRn.exeVirustotal: Detection: 27%Perma Link
              Source: C:\Users\user\AppData\Roaming\aKLYmkhoIRn.exeReversingLabs: Detection: 33%
              Multi AV Scanner detection for submitted fileShow sources
              Source: 0g5RHXhRrBanMN3.exeVirustotal: Detection: 27%Perma Link
              Source: 0g5RHXhRrBanMN3.exeReversingLabs: Detection: 33%
              Machine Learning detection for dropped fileShow sources
              Source: C:\Users\user\AppData\Roaming\aKLYmkhoIRn.exeJoe Sandbox ML: detected
              Machine Learning detection for sampleShow sources
              Source: 0g5RHXhRrBanMN3.exeJoe Sandbox ML: detected
              Source: 3.2.0g5RHXhRrBanMN3.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8

              Networking:

              barindex
              May check the online IP address of the machineShow sources
              Source: unknownDNS query: name: api.ipify.org
              Source: unknownDNS query: name: api.ipify.org
              Source: unknownDNS query: name: api.ipify.org
              Source: unknownDNS query: name: api.ipify.org
              Source: unknownDNS query: name: api.ipify.org
              Source: unknownDNS query: name: api.ipify.org
              Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
              Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
              Source: unknownDNS traffic detected: queries for: api.ipify.org
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.480075810.0000000002FF1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.480075810.0000000002FF1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.480075810.0000000002FF1000.00000004.00000001.sdmpString found in binary or memory: http://VnXQXX.com
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.482523994.000000000327D000.00000004.00000001.sdmpString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.482523994.000000000327D000.00000004.00000001.sdmpString found in binary or memory: http://cert.int-x3.letsencrypt.org/0
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.482523994.000000000327D000.00000004.00000001.sdmpString found in binary or memory: http://cps.letsencrypt.org0
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.482523994.000000000327D000.00000004.00000001.sdmpString found in binary or memory: http://cps.root-x1.letsencrypt.org0
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.487086186.0000000006970000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.487086186.0000000006970000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl0
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.482523994.000000000327D000.00000004.00000001.sdmpString found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.482523994.000000000327D000.00000004.00000001.sdmpString found in binary or memory: http://isrg.trustid.ocsp.identrust.com0;
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.480209574.0000000003046000.00000004.00000001.sdmpString found in binary or memory: http://jKnv0qEzhMbmL9w.com
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.482471795.0000000003273000.00000004.00000001.sdmpString found in binary or memory: http://mail.thanhphet.asia
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.487086186.0000000006970000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.comodoca.com0
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.482523994.000000000327D000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.int-x3.letsencrypt.org0/
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.222274203.0000000002D38000.00000004.00000001.sdmp, 0g5RHXhRrBanMN3.exe, 00000003.00000002.480075810.0000000002FF1000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.480075810.0000000002FF1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.480075810.0000000002FF1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org/
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.480075810.0000000002FF1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.orgGETMozilla/5.0
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.222588239.0000000003D21000.00000004.00000001.sdmp, 0g5RHXhRrBanMN3.exe, 00000003.00000002.476637743.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.480075810.0000000002FF1000.00000004.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.487086186.0000000006970000.00000004.00000001.sdmpString found in binary or memory: https://secure.comodo.com/CPS0
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.222588239.0000000003D21000.00000004.00000001.sdmp, 0g5RHXhRrBanMN3.exe, 00000003.00000002.476637743.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.480075810.0000000002FF1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
              Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747

              Key, Mouse, Clipboard, Microphone and Screen Capturing:

              barindex
              Contains functionality to register a low level keyboard hookShow sources
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_05BCD9DC SetWindowsHookExW 0000000D,00000000,?,?3_2_05BCD9DC
              Installs a global keyboard hookShow sources
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

              System Summary:

              barindex
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_00853E400_2_00853E40
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_012809260_2_01280926
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_012851300_2_01285130
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_012899500_2_01289950
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_012819800_2_01281980
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_01281CA80_2_01281CA8
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_012804D80_2_012804D8
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_01288E500_2_01288E50
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_0128A0000_2_0128A000
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_0128C3A90_2_0128C3A9
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_0128C3B80_2_0128C3B8
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_01281A210_2_01281A21
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_0128ADE00_2_0128ADE0
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_0128B5C00_2_0128B5C0
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_0128B5D00_2_0128B5D0
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_055CAF100_2_055CAF10
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_055CA1680_2_055CA168
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_055C00400_2_055C0040
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_055C00060_2_055C0006
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_00D03E403_2_00D03E40
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_02E546A03_2_02E546A0
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_02E535C43_2_02E535C4
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_02E546903_2_02E54690
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_02E545F03_2_02E545F0
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_02E545D03_2_02E545D0
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_02E553913_2_02E55391
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_05BC75403_2_05BC7540
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_05BC94F83_2_05BC94F8
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_05BC6C703_2_05BC6C70
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_05BC69283_2_05BC6928
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_06B0E2783_2_06B0E278
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_06B05B403_2_06B05B40
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_06B068B03_2_06B068B0
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_06B079883_2_06B07988
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_06B061783_2_06B06178
              Source: 0g5RHXhRrBanMN3.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: aKLYmkhoIRn.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.222801605.0000000003DFC000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameButterFly.dll< vs 0g5RHXhRrBanMN3.exe
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.222312874.0000000002D76000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameEminem.dll< vs 0g5RHXhRrBanMN3.exe
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.222588239.0000000003D21000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameTBIDwuekGIKBBlQcpWbVf.exe4 vs 0g5RHXhRrBanMN3.exe
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.221341263.00000000008C8000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameIaTB.exe, vs 0g5RHXhRrBanMN3.exe
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.222187210.0000000002C90000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs 0g5RHXhRrBanMN3.exe
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.226188820.0000000006770000.00000002.00000001.sdmpBinary or memory string: originalfilename vs 0g5RHXhRrBanMN3.exe
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.226188820.0000000006770000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs 0g5RHXhRrBanMN3.exe
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.226092210.0000000006670000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs 0g5RHXhRrBanMN3.exe
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.477130986.0000000000D78000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameIaTB.exe, vs 0g5RHXhRrBanMN3.exe
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.476637743.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameTBIDwuekGIKBBlQcpWbVf.exe4 vs 0g5RHXhRrBanMN3.exe
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.477236947.0000000001138000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs 0g5RHXhRrBanMN3.exe
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.487465657.0000000006DB0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs 0g5RHXhRrBanMN3.exe
              Source: 0g5RHXhRrBanMN3.exeBinary or memory string: OriginalFilenameIaTB.exe, vs 0g5RHXhRrBanMN3.exe
              Source: 0g5RHXhRrBanMN3.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: aKLYmkhoIRn.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: 0g5RHXhRrBanMN3.exe, u0003u2001.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: aKLYmkhoIRn.exe.0.dr, u0003u2001.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: 0.2.0g5RHXhRrBanMN3.exe.850000.0.unpack, u0003u2001.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: 0.0.0g5RHXhRrBanMN3.exe.850000.0.unpack, u0003u2001.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: 3.2.0g5RHXhRrBanMN3.exe.d00000.1.unpack, u0003u2001.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: 3.0.0g5RHXhRrBanMN3.exe.d00000.0.unpack, u0003u2001.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@6/4@3/2
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeFile created: C:\Users\user\AppData\Roaming\aKLYmkhoIRn.exeJump to behavior
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6936:120:WilError_01
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeMutant created: \Sessions\1\BaseNamedObjects\buWfRpNOBk
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeFile created: C:\Users\user\AppData\Local\Temp\tmpA935.tmpJump to behavior
              Source: 0g5RHXhRrBanMN3.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: 0g5RHXhRrBanMN3.exeVirustotal: Detection: 27%
              Source: 0g5RHXhRrBanMN3.exeReversingLabs: Detection: 33%
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeFile read: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe 'C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe'
              Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\aKLYmkhoIRn' /XML 'C:\Users\user\AppData\Local\Temp\tmpA935.tmp'
              Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\aKLYmkhoIRn' /XML 'C:\Users\user\AppData\Local\Temp\tmpA935.tmp'Jump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess created: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: 0g5RHXhRrBanMN3.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: 0g5RHXhRrBanMN3.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 0_2_008566F7 push ecx; iretd 0_2_008566FD
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_00D066F7 push ecx; iretd 3_2_00D066FD
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_02E5DD39 push FFFFFF8Bh; iretd 3_2_02E5DD3B
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_06B0D6A9 push es; ret 3_2_06B0D6F4
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_06B09E83 push es; ret 3_2_06B09E84
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_06B09ECF push es; ret 3_2_06B09ED0
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_06B0D632 push es; ret 3_2_06B0D6A8
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeCode function: 3_2_06B09E37 push es; ret 3_2_06B09E38
              Source: initial sampleStatic PE information: section name: .text entropy: 7.96597693429
              Source: initial sampleStatic PE information: section name: .text entropy: 7.96597693429
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeFile created: C:\Users\user\AppData\Roaming\aKLYmkhoIRn.exeJump to dropped file

              Boot Survival:

              barindex
              Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
              Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\aKLYmkhoIRn' /XML 'C:\Users\user\AppData\Local\Temp\tmpA935.tmp'
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Yara detected AntiVM_3Show sources
              Source: Yara matchFile source: 00000000.00000002.222312874.0000000002D76000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.222274203.0000000002D38000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: 0g5RHXhRrBanMN3.exe PID: 6856, type: MEMORY
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.222312874.0000000002D76000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.222312874.0000000002D76000.00000004.00000001.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeWindow / User API: threadDelayed 600Jump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 6860Thread sleep time: -55781s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 6876Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 2448Thread sleep count: 293 > 30Jump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 2448Thread sleep count: 600 > 30Jump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -52188s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -40376s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -52032s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -60000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -59688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -59282s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -87282s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -57782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -57094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -56876s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -56000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -55688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -55500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -55282s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -54782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -54500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -53000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -52782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -78891s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -52376s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -52094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -51876s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -77532s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -51500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -50594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -50376s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -50188s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -49500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -73641s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -73314s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -48188s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -72000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -71673s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -46876s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -70032s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -69750s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -46000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -45782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -68391s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -68064s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -67032s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -66750s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -44282s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -44000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -43782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -65391s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -65064s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -43188s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -42688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -63750s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -63423s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -42094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -41876s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -41594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -41376s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -61782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -40782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -40500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -40282s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -40094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -39876s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -39688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -39500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -38782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -38594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -38376s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -37688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -37500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -37282s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -37000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -36594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -36376s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -36188s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -36000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -35500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -35282s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -35094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -34188s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -34000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -33782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -33094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -32688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -48750s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -32000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -31782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -31594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -31376s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -30500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -30282s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -43500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -58376s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -54000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -50000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -49782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -48688s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -48500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -47594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -34500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -33594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -33376s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -32282s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -31188s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -31000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe TID: 3896Thread sleep time: -30094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeLast function: Thread delayed
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.222312874.0000000002D76000.00000004.00000001.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.222312874.0000000002D76000.00000004.00000001.sdmpBinary or memory string: vmware
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.222312874.0000000002D76000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
              Source: 0g5RHXhRrBanMN3.exe, 00000000.00000002.222312874.0000000002D76000.00000004.00000001.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeMemory allocated: page read and write | page guardJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\aKLYmkhoIRn' /XML 'C:\Users\user\AppData\Local\Temp\tmpA935.tmp'Jump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeProcess created: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeJump to behavior
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.479775918.0000000001A30000.00000002.00000001.sdmpBinary or memory string: Program Manager
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.479775918.0000000001A30000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.479775918.0000000001A30000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: 0g5RHXhRrBanMN3.exe, 00000003.00000002.479775918.0000000001A30000.00000002.00000001.sdmpBinary or memory string: Progmanlock
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeQueries volume information: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeQueries volume information: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\0g5RHXhRrBanMN3.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information:

              bar