Loading ...

Play interactive tourEdit tour

Analysis Report 1g1NLI6i33.exe

Overview

General Information

Sample Name:1g1NLI6i33.exe
Analysis ID:404206
MD5:d0a8c2403c51ea96d820dcd443f1aaab
SHA1:825a057b9218a956a632bdd563056be37bfc0c10
SHA256:0c397ebc470f59440b6a317a88a2592c0b05057cea1ff2f31b9fdde549971aee
Tags:AgentTeslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
.NET source code contains very large array initializations
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Moves itself to temp directory
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • 1g1NLI6i33.exe (PID: 7020 cmdline: 'C:\Users\user\Desktop\1g1NLI6i33.exe' MD5: D0A8C2403C51EA96D820DCD443F1AAAB)
    • 1g1NLI6i33.exe (PID: 7060 cmdline: 'C:\Users\user\Desktop\1g1NLI6i33.exe' MD5: D0A8C2403C51EA96D820DCD443F1AAAB)
  • vsbqyetogexvl.exe (PID: 6712 cmdline: 'C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe' MD5: D0A8C2403C51EA96D820DCD443F1AAAB)
    • vsbqyetogexvl.exe (PID: 900 cmdline: 'C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe' MD5: D0A8C2403C51EA96D820DCD443F1AAAB)
  • vsbqyetogexvl.exe (PID: 6956 cmdline: 'C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe' MD5: D0A8C2403C51EA96D820DCD443F1AAAB)
    • vsbqyetogexvl.exe (PID: 6584 cmdline: 'C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe' MD5: D0A8C2403C51EA96D820DCD443F1AAAB)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "elliech@orlonimages.comchidiebere2419us2.smtp.mailhostbox.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.917550398.0000000004992000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000009.00000002.915225171.00000000034E1000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000007.00000002.703927470.00000000006CA000.00000004.00000020.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000007.00000002.704176469.0000000002531000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000007.00000002.704176469.0000000002531000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            Click to see the 27 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.1g1NLI6i33.exe.23d0000.4.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              1.2.1g1NLI6i33.exe.24f0000.3.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                7.2.vsbqyetogexvl.exe.6e6240.2.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  7.2.vsbqyetogexvl.exe.4970000.4.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                    7.2.vsbqyetogexvl.exe.415058.0.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 46 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 7.1.vsbqyetogexvl.exe.415058.1.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "elliech@orlonimages.comchidiebere2419us2.smtp.mailhostbox.com"}
                      Multi AV Scanner detection for dropped fileShow sources
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeReversingLabs: Detection: 42%
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: 1g1NLI6i33.exeVirustotal: Detection: 28%Perma Link
                      Machine Learning detection for dropped fileShow sources
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeJoe Sandbox ML: detected
                      Machine Learning detection for sampleShow sources
                      Source: 1g1NLI6i33.exeJoe Sandbox ML: detected
                      Source: 7.2.vsbqyetogexvl.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: 1.2.1g1NLI6i33.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 7.1.vsbqyetogexvl.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 7.2.vsbqyetogexvl.exe.49b0000.5.unpackAvira: Label: TR/Spy.Gen8
                      Source: 1.2.1g1NLI6i33.exe.4990000.5.unpackAvira: Label: TR/Spy.Gen8
                      Source: 9.2.vsbqyetogexvl.exe.4960000.6.unpackAvira: Label: TR/Spy.Gen8
                      Source: 9.1.vsbqyetogexvl.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 9.2.vsbqyetogexvl.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8

                      Compliance:

                      barindex
                      Detected unpacking (creates a PE file in dynamic memory)Show sources
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeUnpacked PE file: 1.2.1g1NLI6i33.exe.4990000.5.unpack
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeUnpacked PE file: 9.2.vsbqyetogexvl.exe.4960000.6.unpack
                      Detected unpacking (overwrites its own PE header)Show sources
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeUnpacked PE file: 1.2.1g1NLI6i33.exe.400000.0.unpack
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeUnpacked PE file: 7.2.vsbqyetogexvl.exe.400000.1.unpack
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeUnpacked PE file: 9.2.vsbqyetogexvl.exe.400000.1.unpack
                      Source: 1g1NLI6i33.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                      Source: 1g1NLI6i33.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: wntdll.pdbUGP source: 1g1NLI6i33.exe, 00000000.00000003.645643338.00000000033B0000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000006.00000003.682137775.0000000003240000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000008.00000003.695201365.0000000003200000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: 1g1NLI6i33.exe, 00000000.00000003.645643338.00000000033B0000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000006.00000003.682137775.0000000003240000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000008.00000003.695201365.0000000003200000.00000004.00000001.sdmp
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 0_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_004059F0
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 0_2_0040659C FindFirstFileA,FindClose,0_2_0040659C
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 0_2_004027A1 FindFirstFileA,0_2_004027A1
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_00404A29 FindFirstFileExW,1_2_00404A29
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 7_2_00404A29 FindFirstFileExW,7_2_00404A29
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 7_1_00404A29 FindFirstFileExW,7_1_00404A29
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_00404A29 FindFirstFileExW,9_2_00404A29
                      Source: global trafficTCP traffic: 192.168.2.4:49768 -> 208.91.199.224:587
                      Source: Joe Sandbox ViewIP Address: 208.91.199.224 208.91.199.224
                      Source: global trafficTCP traffic: 192.168.2.4:49768 -> 208.91.199.224:587
                      Source: unknownDNS traffic detected: queries for: us2.smtp.mailhostbox.com
                      Source: 1g1NLI6i33.exe, 00000001.00000002.914206758.0000000002551000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000007.00000002.704176469.0000000002531000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000009.00000002.913898804.00000000024E1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: vsbqyetogexvl.exe, 00000009.00000002.914620731.000000000280A000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000009.00000002.913898804.00000000024E1000.00000004.00000001.sdmpString found in binary or memory: http://1UVMV9Y76P8yRzwJn.net
                      Source: vsbqyetogexvl.exe, 00000009.00000002.913898804.00000000024E1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: 1g1NLI6i33.exe, 00000001.00000002.914864176.00000000028AD000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000009.00000002.918526939.0000000005A95000.00000004.00000001.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
                      Source: vsbqyetogexvl.exe, 00000009.00000002.913898804.00000000024E1000.00000004.00000001.sdmpString found in binary or memory: http://kVHmOE.com
                      Source: 1g1NLI6i33.exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
                      Source: 1g1NLI6i33.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
                      Source: 1g1NLI6i33.exe, 00000001.00000002.914864176.00000000028AD000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000009.00000002.918526939.0000000005A95000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.sectigo.com0A
                      Source: 1g1NLI6i33.exe, 00000001.00000002.914841865.00000000028A5000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000009.00000002.914664635.000000000283A000.00000004.00000001.sdmpString found in binary or memory: http://us2.smtp.mailhostbox.com
                      Source: 1g1NLI6i33.exe, 00000001.00000002.914864176.00000000028AD000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000009.00000002.918526939.0000000005A95000.00000004.00000001.sdmpString found in binary or memory: https://sectigo.com/CPS0
                      Source: vsbqyetogexvl.exeString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: 1g1NLI6i33.exe, 00000001.00000002.914206758.0000000002551000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000007.00000002.704176469.0000000002531000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000009.00000002.913898804.00000000024E1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 0_2_0040548D GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_0040548D

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 1.2.1g1NLI6i33.exe.4990000.5.unpack, u003cPrivateImplementationDetailsu003eu007bC17428B6u002dFFF5u002d4075u002dA591u002d98F8482E88C5u007d/B3460D8Fu002d441Du002d4B0Du002d9716u002d48CAFB425886.csLarge array initialization: .cctor: array initializer size 11945
                      Source: 9.2.vsbqyetogexvl.exe.4960000.6.unpack, u003cPrivateImplementationDetailsu003eu007bC17428B6u002dFFF5u002d4075u002dA591u002d98F8482E88C5u007d/B3460D8Fu002d441Du002d4B0Du002d9716u002d48CAFB425886.csLarge array initialization: .cctor: array initializer size 11945
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_00403461
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 0_2_004069250_2_00406925
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_0040A2A51_2_0040A2A5
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_0069B9681_2_0069B968
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_0069311E1_2_0069311E
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_006926181_2_00692618
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_00695B201_2_00695B20
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_00691FE01_2_00691FE0
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_006980BE1_2_006980BE
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_00697D671_2_00697D67
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_00697DAF1_2_00697DAF
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_0069FA581_2_0069FA58
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_00697E111_2_00697E11
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_009F58011_2_009F5801
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_009FA4481_2_009FA448
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_009F00401_2_009F0040
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_009F43301_2_009F4330
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_009F20201_2_009F2020
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_009FED6B1_2_009FED6B
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_009FAB911_2_009FAB91
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 7_2_0040A2A57_2_0040A2A5
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 7_2_00AD46A07_2_00AD46A0
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 7_2_00AD3CF67_2_00AD3CF6
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 7_2_00AD46907_2_00AD4690
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 7_1_0040A2A57_1_0040A2A5
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_0040A2A59_2_0040A2A5
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_004808889_2_00480888
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_004868909_2_00486890
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_0048D1409_2_0048D140
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_0048AA409_2_0048AA40
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_00484B389_2_00484B38
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_004823E09_2_004823E0
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_004880989_2_00488098
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_004855C89_2_004855C8
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_0048AA8A9_2_0048AA8A
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_004A26189_2_004A2618
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_004A1FE09_2_004A1FE0
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_004AB9189_2_004AB918
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_004AFA089_2_004AFA08
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_008800409_2_00880040
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_008820209_2_00882020
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_0088A4489_2_0088A448
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_0088B97A9_2_0088B97A
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_008842E09_2_008842E0
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_0088ABA09_2_0088ABA0
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_00B146A09_2_00B146A0
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_00B145B09_2_00B145B0
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: String function: 00401ED0 appears 69 times
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: String function: 0040569E appears 54 times
                      Source: 1g1NLI6i33.exe, 00000000.00000003.650068345.0000000003386000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 1g1NLI6i33.exe
                      Source: 1g1NLI6i33.exeBinary or memory string: OriginalFilename vs 1g1NLI6i33.exe
                      Source: 1g1NLI6i33.exe, 00000001.00000002.917550398.0000000004992000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamesaxoJzjHMNvhkvKVXjRlZ.exe4 vs 1g1NLI6i33.exe
                      Source: 1g1NLI6i33.exe, 00000001.00000002.918245692.00000000051F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs 1g1NLI6i33.exe
                      Source: 1g1NLI6i33.exe, 00000001.00000002.918814474.0000000005800000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs 1g1NLI6i33.exe
                      Source: 1g1NLI6i33.exe, 00000001.00000002.911420720.0000000000199000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs 1g1NLI6i33.exe
                      Source: 1g1NLI6i33.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                      Source: 1.2.1g1NLI6i33.exe.4990000.5.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 1.2.1g1NLI6i33.exe.4990000.5.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 9.2.vsbqyetogexvl.exe.4960000.6.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 9.2.vsbqyetogexvl.exe.4960000.6.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@9/13@2/1
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_00403461
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 0_2_0040473E GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,0_2_0040473E
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 0_2_0040216B CoCreateInstance,MultiByteToWideChar,0_2_0040216B
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_00401489 GetModuleHandleW,GetModuleHandleW,FindResourceW,GetModuleHandleW,LoadResource,LockResource,GetModuleHandleW,SizeofResource,FreeResource,ExitProcess,1_2_00401489
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeFile created: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtnJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeFile created: C:\Users\user\AppData\Local\Temp\nsg55C0.tmpJump to behavior
                      Source: 1g1NLI6i33.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeFile read: C:\Users\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: 1g1NLI6i33.exeVirustotal: Detection: 28%
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeFile read: C:\Users\user\Desktop\1g1NLI6i33.exeJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\1g1NLI6i33.exe 'C:\Users\user\Desktop\1g1NLI6i33.exe'
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess created: C:\Users\user\Desktop\1g1NLI6i33.exe 'C:\Users\user\Desktop\1g1NLI6i33.exe'
                      Source: unknownProcess created: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe 'C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe'
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess created: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe 'C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe'
                      Source: unknownProcess created: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe 'C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe'
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess created: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe 'C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe'
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess created: C:\Users\user\Desktop\1g1NLI6i33.exe 'C:\Users\user\Desktop\1g1NLI6i33.exe' Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess created: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe 'C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe' Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess created: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe 'C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exe' Jump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: 1g1NLI6i33.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: wntdll.pdbUGP source: 1g1NLI6i33.exe, 00000000.00000003.645643338.00000000033B0000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000006.00000003.682137775.0000000003240000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000008.00000003.695201365.0000000003200000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: 1g1NLI6i33.exe, 00000000.00000003.645643338.00000000033B0000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000006.00000003.682137775.0000000003240000.00000004.00000001.sdmp, vsbqyetogexvl.exe, 00000008.00000003.695201365.0000000003200000.00000004.00000001.sdmp

                      Data Obfuscation:

                      barindex
                      Detected unpacking (changes PE section rights)Show sources
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeUnpacked PE file: 1.2.1g1NLI6i33.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.gfids:R;.rsrc:R;.reloc:R;
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeUnpacked PE file: 7.2.vsbqyetogexvl.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.gfids:R;.rsrc:R;.reloc:R;
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeUnpacked PE file: 9.2.vsbqyetogexvl.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.gfids:R;.rsrc:R;.reloc:R;
                      Detected unpacking (creates a PE file in dynamic memory)Show sources
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeUnpacked PE file: 1.2.1g1NLI6i33.exe.4990000.5.unpack
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeUnpacked PE file: 9.2.vsbqyetogexvl.exe.4960000.6.unpack
                      Detected unpacking (overwrites its own PE header)Show sources
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeUnpacked PE file: 1.2.1g1NLI6i33.exe.400000.0.unpack
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeUnpacked PE file: 7.2.vsbqyetogexvl.exe.400000.1.unpack
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeUnpacked PE file: 9.2.vsbqyetogexvl.exe.400000.1.unpack
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA85AB push esp; ret 1_3_05AA85B1
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA8D8B push esp; ret 1_3_05AA8D91
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA899B push esp; ret 1_3_05AA89A1
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA917B push esp; ret 1_3_05AA9181
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA9033 push esp; ret 1_3_05AA9039
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA8463 push esp; ret 1_3_05AA8469
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA8C43 push esp; ret 1_3_05AA8C49
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA8853 push esp; ret 1_3_05AA8859
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA87A3 push esp; ret 1_3_05AA87A9
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA83B3 push esp; ret 1_3_05AA83B9
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA8F83 push esp; ret 1_3_05AA8F89
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA8B93 push esp; ret 1_3_05AA8B99
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AAE35F push edx; iretd 1_3_05AAE360
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AAEEDB push edi; retf 1_3_05AAEEDD
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA922B push esp; ret 1_3_05AA9231
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA8E3B push esp; ret 1_3_05AA8E41
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA8A4B push esp; ret 1_3_05AA8A51
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_3_05AA865B push esp; ret 1_3_05AA8661
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeCode function: 1_2_00401F16 push ecx; ret 1_2_00401F29
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 7_2_00401F16 push ecx; ret 7_2_00401F29
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 7_1_00401F16 push ecx; ret 7_1_00401F29
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_00401F16 push ecx; ret 9_2_00401F29
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeCode function: 9_2_004A7E3F push edi; retn 0000h9_2_004A7E41
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeFile created: C:\Users\user\AppData\Local\Temp\nsu90B8.tmp\jupf00qz2dn.dllJump to dropped file
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeFile created: C:\Users\user\AppData\Local\Temp\nsb55F1.tmp\jupf00qz2dn.dllJump to dropped file
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeFile created: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeJump to dropped file
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeFile created: C:\Users\user\AppData\Local\Temp\nsqAEDE.tmp\jupf00qz2dn.dllJump to dropped file
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run yhtskiwswufgckJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run yhtskiwswufgckJump to behavior

                      Hooking and other Techniques for Hiding and Protection:

                      barindex
                      Moves itself to temp directoryShow sources
                      Source: c:\users\user\desktop\1g1nli6i33.exeFile moved: C:\Users\user\AppData\Local\Temp\tmpG607.tmpJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\1g1NLI6i33.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\wsvjsxxwtyqtn\vsbqyetogexvl.exeProcess information se