Windows Analysis Report Proforma Invoice.exe

ID:	491978
Product:	CloudBasic
Start time:	08:38:14
Start date:	28.09.2021
Sample:	Proforma Invoice.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	05dea597f5e2fdaf7dd91dc2732eb54b
SHA1:	6067e82bf295eb76c415a5c4910ea578bae96933
SHA256:	6e6d502d455f4d1db45f465ff69d1d2f53a78afffbda8e6bc2b12c99ca012926
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Proforma Invoice.exe.log	ASCII text, with CRLF line terminators	FED34146BF2F2FA59DCF8702FCC8232E	B03BFEA175989D989850CF06FE5E7BBF56EAA00A	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C

AV Detection:

Multi AV Scanner detection for submitted file

Source: Proforma Invoice.exe	Virustotal: Detection: 19%			Perma Link
Source: Proforma Invoice.exe	ReversingLabs: Detection: 24%

Compliance:

Uses 32bit PE files

Source: Proforma Invoice.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Proforma Invoice.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 4x nop then jmp 05F01B4Eh		1_2_05F01B08
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 4x nop then jmp 05F01B4Eh		1_2_05F01BE4
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 4x nop then jmp 05F01B4Eh		1_2_05F01B65

Networking:

URLs found in memory or binary data

Source: Proforma Invoice.exe, 00000001.00000002.384252504.0000000002D84000.00000004.00000001.sdmp

String found in binary or memory: http://schemas.m

System Summary:

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Proforma Invoice.exe

.NET source code contains very large strings

Source: Proforma Invoice.exe, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: 1.0.Proforma Invoice.exe.990000.0.unpack, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: 1.2.Proforma Invoice.exe.990000.0.unpack, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: 4.2.Proforma Invoice.exe.130000.0.unpack, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: 5.2.Proforma Invoice.exe.80000.0.unpack, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: 5.0.Proforma Invoice.exe.80000.0.unpack, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776

Executable has a suspicious name (potential lure to open the executable)

Source: Proforma Invoice.exe

Static file information: Suspicious name

Uses 32bit PE files

Source: Proforma Invoice.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Sample file is different than original file name gathered from version info

Source: Proforma Invoice.exe	Binary or memory string: OriginalFilename vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000001.00000002.394557947.0000000003DA3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000001.00000002.383529720.0000000000992000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSearchResultHandl.exeJ vs Proforma Invoice.exe
Source: Proforma Invoice.exe	Binary or memory string: OriginalFilename vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000004.00000002.355667372.0000000000132000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSearchResultHandl.exeJ vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000004.00000002.355919793.0000000000595000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Proforma Invoice.exe
Source: Proforma Invoice.exe	Binary or memory string: OriginalFilename vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000005.00000002.356678194.0000000000082000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSearchResultHandl.exeJ vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000005.00000002.356866662.0000000000535000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Proforma Invoice.exe
Source: Proforma Invoice.exe	Binary or memory string: OriginalFilename vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000006.00000002.362518414.00000000009A2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSearchResultHandl.exeJ vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000006.00000002.362605907.0000000000E35000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Proforma Invoice.exe
Source: Proforma Invoice.exe	Binary or memory string: OriginalFilename vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000007.00000002.372325904.0000000000CB2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSearchResultHandl.exeJ vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000007.00000002.372402576.0000000001135000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Proforma Invoice.exe
Source: Proforma Invoice.exe	Binary or memory string: OriginalFilename vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000008.00000000.375243263.00000000002B2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSearchResultHandl.exeJ vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000008.00000002.383624530.0000000000735000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Proforma Invoice.exe
Source: Proforma Invoice.exe	Binary or memory string: OriginalFilenameSearchResultHandl.exeJ vs Proforma Invoice.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D90D38		1_2_05D90D38
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D9DE40		1_2_05D9DE40
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D911D0		1_2_05D911D0
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D9D1E8		1_2_05D9D1E8
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D911E0		1_2_05D911E0
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D93591		1_2_05D93591
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D90D28		1_2_05D90D28
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D972C0		1_2_05D972C0
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D972B2		1_2_05D972B2

Sample is known by Antivirus

Source: Proforma Invoice.exe	Virustotal: Detection: 19%
Source: Proforma Invoice.exe	ReversingLabs: Detection: 24%

PE file has an executable .text section and no other executable section

Source: Proforma Invoice.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\Proforma Invoice.exe 'C:\Users\user\Desktop\Proforma Invoice.exe'
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe			Jump to behavior

Creates files inside the user directory

Source: C:\Users\user\Desktop\Proforma Invoice.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Proforma Invoice.exe.log

Jump to behavior

Classification label

Source: classification engine

Classification label: mal76.evad.winEXE@11/1@0/0

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\Proforma Invoice.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE file contains a COM descriptor data directory

Source: Proforma Invoice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Proforma Invoice.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Source: Proforma Invoice.exe, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.Proforma Invoice.exe.990000.0.unpack, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.Proforma Invoice.exe.990000.0.unpack, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.Proforma Invoice.exe.130000.0.unpack, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.Proforma Invoice.exe.80000.0.unpack, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Proforma Invoice.exe.80000.0.unpack, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 1_2_05F03EFD push FFFFFF8Bh; iretd

1_2_05F03EFF

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Source: Yara match	File source: 1.2.Proforma Invoice.exe.2d8482c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.384252504.0000000002D84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice.exe PID: 6612, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Proforma Invoice.exe, 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: Proforma Invoice.exe, 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\Proforma Invoice.exe TID: 6616	Thread sleep time: -35345s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe TID: 6672	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Contains medium sleeps (>= 30s)

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Thread delayed: delay time: 35345			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Proforma Invoice.exe, 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Proforma Invoice.exe, 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Proforma Invoice.exe, 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: Proforma Invoice.exe, 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

Enables debug privileges

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Process token adjusted: Debug

Jump to behavior

Creates guard pages, often used to prevent reverse usering and debugging

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe			Jump to behavior

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Queries volume information: C:\Users\user\Desktop\Proforma Invoice.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior