Windows Analysis Report
Payment Slip.exe

Overview

General Information

Sample Name: Payment Slip.exe
Analysis ID: 635144
MD5: 29b03eb0f987f638b99ef23c8e3681ad
SHA1: 174069ad27d00891343e794167abf298cb5f3e5b
SHA256: e799a969eca8b72287a0b6a1b7015d6a47fa07e30d960b1a33b2e8178efd80a8
Tags: exe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Yara detected AntiVM3
Multi AV Scanner detection for dropped file
Tries to steal Mail credentials (via file / registry access)
Initial sample is a PE file and has a suspicious name
Writes to foreign memory regions
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Modifies the hosts file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Dropped file seen in connection with other malware
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Found malware configuration
Source: 1.2.Payment Slip.exe.3ce94b0.8.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "edna@subnet-group.com", "Password": "cr0cksh1t", "Host": "mail.subnet-group.com"}
Multi AV Scanner detection for submitted file
Source: Payment Slip.exe ReversingLabs: Detection: 20%
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\aXqntX.exe ReversingLabs: Detection: 20%
Antivirus or Machine Learning detection for unpacked file
Source: 10.0.RegSvcs.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 10.0.RegSvcs.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 10.0.RegSvcs.exe.400000.2.unpack Avira: Label: TR/Spy.Gen8
Source: 10.2.RegSvcs.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 10.0.RegSvcs.exe.400000.1.unpack Avira: Label: TR/Spy.Gen8
Source: 10.0.RegSvcs.exe.400000.3.unpack Avira: Label: TR/Spy.Gen8
Uses 32bit PE files
Source: Payment Slip.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: Payment Slip.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\qCeVrdCgfI\src\obj\x86\Debug\CustomAttributeExtensi.pdb source: Payment Slip.exe, aXqntX.exe.1.dr
Source: Binary string: RegSvcs.pdb, source: Tnpak.exe, 0000000F.00000000.453847960.0000000000082000.00000002.00000001.01000000.00000009.sdmp, Tnpak.exe, 00000011.00000002.477073808.0000000000FF2000.00000002.00000001.01000000.00000009.sdmp, Tnpak.exe.10.dr
Source: Binary string: RegSvcs.pdb source: Tnpak.exe, Tnpak.exe, 00000011.00000002.477073808.0000000000FF2000.00000002.00000001.01000000.00000009.sdmp, Tnpak.exe.10.dr
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 206.189.39.129 206.189.39.129
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.7:49777 -> 206.189.39.129:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.7:49777 -> 206.189.39.129:587
Source: RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://OVQvJM.com
Source: RegSvcs.exe, 0000000A.00000003.445840024.0000000005CCD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000003.461371858.0000000005CF3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.microsoft.co6
Source: Payment Slip.exe, 00000001.00000003.369266021.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.369235997.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.369286109.00000000059BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://en.w
Source: Payment Slip.exe, 00000001.00000003.368946624.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.368798069.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: RegSvcs.exe, 0000000A.00000002.636625632.0000000002B52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.subnet-group.com
Source: Payment Slip.exe, 00000001.00000002.425049862.0000000002961000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 0000000A.00000002.636625632.0000000002B52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://subnet-group.com
Source: Payment Slip.exe, 00000001.00000003.387874415.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.388096585.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.388216287.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.agfamonotype.
Source: Payment Slip.exe, 00000001.00000003.372228924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.htmlub
Source: Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com
Source: Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com(
Source: Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com.
Source: Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comCJ
Source: Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comCs
Source: Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373838060.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comTC
Source: Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comTCC
Source: Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comTCJ
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373838060.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comn-u
Source: Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.como.
Source: Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.como.4
Source: Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comof
Source: Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comsof
Source: Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comt-b
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.378483975.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Payment Slip.exe, 00000001.00000003.378928308.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Payment Slip.exe, 00000001.00000003.378483975.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/
Source: Payment Slip.exe, 00000001.00000003.378483975.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/$
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Payment Slip.exe, 00000001.00000003.379498168.00000000059C3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379592614.00000000059C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html$
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Payment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersX
Source: Payment Slip.exe, 00000001.00000003.392002293.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersa
Source: Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersn
Source: Payment Slip.exe, 00000001.00000003.378613313.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersp
Source: Payment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.391559224.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.392002293.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380260943.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380316955.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379742924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379899373.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379986432.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379805969.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380111560.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380045205.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comF
Source: Payment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379362960.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380260943.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379167828.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379742924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379106889.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380697612.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379899373.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380903153.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.378867231.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379285162.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380650039.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379032096.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comFk
Source: Payment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379362960.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379167828.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379106889.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379285162.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379032096.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381467642.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalsFv
Source: Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381467642.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalsd
Source: Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380697612.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380903153.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380362004.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380650039.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380790636.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.378928308.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comd
Source: Payment Slip.exe, 00000001.00000003.379742924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379899373.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379986432.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379805969.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380045205.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comd7
Source: Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380697612.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380903153.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380650039.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380504300.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380790636.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.come.com
Source: Payment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comessed
Source: Payment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379362960.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379167828.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379106889.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.378867231.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379285162.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379032096.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.378928308.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comessedD
Source: Payment Slip.exe, 00000001.00000003.391559224.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.392002293.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.395061880.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.393674920.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.399655463.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.395710909.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.393427428.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comionm7
Source: Payment Slip.exe, 00000001.00000003.378613313.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comk
Source: Payment Slip.exe, 00000001.00000003.392002293.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.395061880.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.393674920.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.399655463.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.395710909.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.393427428.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comldom
Source: Payment Slip.exe, 00000001.00000003.392002293.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.395061880.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.393674920.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.399655463.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.395710909.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430104837.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.393427428.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comm
Source: Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381467642.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.como
Source: Payment Slip.exe, 00000001.00000003.378928308.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comoituO
Source: Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380697612.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380903153.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380362004.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380650039.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380504300.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380790636.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380450430.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comsief7
Source: Payment Slip.exe, 00000001.00000003.378483975.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comtalik
Source: Payment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379362960.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379167828.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379742924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379106889.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379285162.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379032096.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comueTFv
Source: Payment Slip.exe, 00000001.00000003.382244412.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381558452.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380697612.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380903153.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380650039.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381734558.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381649588.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.382377807.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381467642.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381962443.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381880102.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.382159289.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380790636.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comueed
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: Payment Slip.exe, 00000001.00000003.371357816.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372056930.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371868655.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373838060.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372228924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371843623.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371775143.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371537770.00000000059B2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371621848.00000000059B2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372291562.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Payment Slip.exe, 00000001.00000003.371285758.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371173544.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn%
Source: Payment Slip.exe, 00000001.00000003.370802075.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370663697.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371537770.00000000059B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Payment Slip.exe, 00000001.00000003.371285758.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371173544.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnC
Source: Payment Slip.exe, 00000001.00000003.371357816.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnicr
Source: Payment Slip.exe, 00000001.00000003.383166950.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/
Source: Payment Slip.exe, 00000001.00000003.383166950.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/(
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Payment Slip.exe, 00000001.00000003.383423314.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383166950.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383306809.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Payment Slip.exe, 00000001.00000003.384323219.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383423314.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383166950.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383736199.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.384539089.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383306809.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383858390.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.384219354.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.384019197.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383560903.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm3
Source: Payment Slip.exe, 00000001.00000003.383423314.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383166950.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383736199.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383306809.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383560903.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/y
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Payment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr-e
Source: Payment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.krde
Source: Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377104955.00000000059B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375768530.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376169988.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376962351.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376596653.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377028013.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376909789.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376730482.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376807157.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/(
Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375768530.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376169988.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/D
Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/O
Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375768530.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376169988.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376962351.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376596653.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377028013.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376909789.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376730482.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377226807.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377358985.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376807157.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377104955.00000000059B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/
Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375768530.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376169988.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0MS
Source: Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/es-e
Source: Payment Slip.exe, 00000001.00000003.374468136.00000000059AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/es-eO
Source: Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376596653.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377463854.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377028013.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376909789.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376730482.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377226807.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377358985.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374468136.00000000059AC000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376807157.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377104955.00000000059B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/k
Source: Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/v
Source: Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/k
Source: Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/s-c
Source: Payment Slip.exe, 00000001.00000003.374468136.00000000059AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/slnt
Source: Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/staD
Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/y
Source: Payment Slip.exe, 00000001.00000003.367520517.0000000005992000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Payment Slip.exe, 00000001.00000003.367520517.0000000005992000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.comE
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: Payment Slip.exe, 00000001.00000003.370475864.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370663697.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Payment Slip.exe, 00000001.00000003.370475864.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kra-es
Source: Payment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.krcomde
Source: Payment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.krm
Source: Payment Slip.exe, 00000001.00000003.370475864.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.krs-cv
Source: Payment Slip.exe, 00000001.00000003.370802075.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370663697.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.krw
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371843623.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372291562.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Payment Slip.exe, 00000001.00000003.372291562.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cncr
Source: Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372291562.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cno.k
Source: Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372291562.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cnue
Source: RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.636673141.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.636591981.0000000002B4C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://4fzYgv0VsnfOwxj3KTsx.org
Source: RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%
Source: RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%appdata
Source: Payment Slip.exe String found in binary or memory: https://github.com
Source: Payment Slip.exe, aXqntX.exe.1.dr String found in binary or memory: https://github.com/dcoetzee/plants-vs-zombies-user-file-editor
Source: RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: unknown DNS traffic detected: queries for: mail.subnet-group.com

Spam, unwanted Advertisements and Ransom Demands
barindex
Modifies the hosts file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.Payment Slip.exe.3cb4c90.7.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.Payment Slip.exe.3ce94b0.8.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.Payment Slip.exe.7210000.11.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 10.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.Payment Slip.exe.3c23e70.9.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 1.2.Payment Slip.exe.3cb4c90.7.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.Payment Slip.exe.7210000.11.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 10.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 10.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 10.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.Payment Slip.exe.3ce94b0.8.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.Payment Slip.exe.3c23e70.9.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.Payment Slip.exe.3c23e70.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000001.00000002.431474395.0000000007210000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects zgRAT Author: ditekSHen
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Payment Slip.exe
.NET source code contains very large array initializations
Source: 10.0.RegSvcs.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b1C6855DFu002d3108u002d446Bu002dB03Bu002d1D343D8CCF1Eu007d/ACA7B636u002dC42Au002d4E15u002dB560u002d069D33A6C34B.cs Large array initialization: .cctor: array initializer size 11631
Source: 10.0.RegSvcs.exe.400000.2.unpack, u003cPrivateImplementationDetailsu003eu007b1C6855DFu002d3108u002d446Bu002dB03Bu002d1D343D8CCF1Eu007d/ACA7B636u002dC42Au002d4E15u002dB560u002d069D33A6C34B.cs Large array initialization: .cctor: array initializer size 11631
Source: 10.2.RegSvcs.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b1C6855DFu002d3108u002d446Bu002dB03Bu002d1D343D8CCF1Eu007d/ACA7B636u002dC42Au002d4E15u002dB560u002d069D33A6C34B.cs Large array initialization: .cctor: array initializer size 11631
Uses 32bit PE files
Source: Payment Slip.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.Payment Slip.exe.3cb4c90.7.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.Payment Slip.exe.3ce94b0.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.Payment Slip.exe.7210000.11.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 10.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.Payment Slip.exe.3c23e70.9.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 1.2.Payment Slip.exe.3cb4c90.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.Payment Slip.exe.7210000.11.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 10.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 10.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 10.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.Payment Slip.exe.3ce94b0.8.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.Payment Slip.exe.3c23e70.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.Payment Slip.exe.3c23e70.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000001.00000002.431474395.0000000007210000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Detected potential crypto function
Source: C:\Users\user\Desktop\Payment Slip.exe Code function: 1_2_00534714 1_2_00534714
Source: C:\Users\user\Desktop\Payment Slip.exe Code function: 1_2_00F3F080 1_2_00F3F080
Source: C:\Users\user\Desktop\Payment Slip.exe Code function: 1_2_00F3F071 1_2_00F3F071
Source: C:\Users\user\Desktop\Payment Slip.exe Code function: 1_2_00F3D65C 1_2_00F3D65C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_0268F3C8 10_2_0268F3C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_0268F080 10_2_0268F080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_02686120 10_2_02686120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_05A4CCF8 10_2_05A4CCF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_05A4BF98 10_2_05A4BF98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_05A41FF8 10_2_05A41FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_05A40040 10_2_05A40040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_0618CF88 10_2_0618CF88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_061880C8 10_2_061880C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_0618F1B8 10_2_0618F1B8
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 05A45A58 appears 54 times
Sample file is different than original file name gathered from version info
Source: Payment Slip.exe, 00000001.00000002.424262731.00000000005E8000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameCustomAttributeExtensi.exe" vs Payment Slip.exe
Source: Payment Slip.exe, 00000001.00000002.425049862.0000000002961000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVoVjyvuUaggxOaRzqXrnnJEHfRZJ.exe4 vs Payment Slip.exe
Source: Payment Slip.exe, 00000001.00000002.431474395.0000000007210000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameIVectorView.dllN vs Payment Slip.exe
Source: Payment Slip.exe, 00000001.00000002.428332559.0000000003BE3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameIVectorView.dllN vs Payment Slip.exe
Source: Payment Slip.exe, 00000001.00000002.428332559.0000000003BE3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVoVjyvuUaggxOaRzqXrnnJEHfRZJ.exe4 vs Payment Slip.exe
Source: Payment Slip.exe Binary or memory string: OriginalFilenameCustomAttributeExtensi.exe" vs Payment Slip.exe
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe 43026DCFF238F20CFF0419924486DEE45178119CFDD0D366B79D67D950A9BF50
Source: Payment Slip.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: aXqntX.exe.1.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Payment Slip.exe ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\Payment Slip.exe File read: C:\Users\user\Desktop\Payment Slip.exe Jump to behavior
Source: Payment Slip.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Payment Slip.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Payment Slip.exe "C:\Users\user\Desktop\Payment Slip.exe"
Source: C:\Users\user\Desktop\Payment Slip.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aXqntX.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment Slip.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aXqntX" /XML "C:\Users\user\AppData\Local\Temp\tmp62DF.tmp
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment Slip.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe "C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe"
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe "C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe"
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment Slip.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aXqntX.exe Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aXqntX" /XML "C:\Users\user\AppData\Local\Temp\tmp62DF.tmp Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Slip.exe File created: C:\Users\user\AppData\Roaming\aXqntX.exe Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe File created: C:\Users\user\AppData\Local\Temp\tmp62DF.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.adwa.spyw.evad.winEXE@13/13@2/1
Source: C:\Users\user\Desktop\Payment Slip.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: Payment Slip.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\Payment Slip.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6016:120:WilError_01
Source: C:\Users\user\Desktop\Payment Slip.exe Mutant created: \Sessions\1\BaseNamedObjects\fFxRWwRDYxYpTygVcOwbtihq
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6572:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4956:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6424:120:WilError_01
Source: 10.0.RegSvcs.exe.400000.4.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 10.0.RegSvcs.exe.400000.4.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 10.0.RegSvcs.exe.400000.2.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 10.0.RegSvcs.exe.400000.2.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 10.2.RegSvcs.exe.400000.0.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 10.2.RegSvcs.exe.400000.0.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Payment Slip.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: Payment Slip.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Payment Slip.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Payment Slip.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\qCeVrdCgfI\src\obj\x86\Debug\CustomAttributeExtensi.pdb source: Payment Slip.exe, aXqntX.exe.1.dr
Source: Binary string: RegSvcs.pdb, source: Tnpak.exe, 0000000F.00000000.453847960.0000000000082000.00000002.00000001.01000000.00000009.sdmp, Tnpak.exe, 00000011.00000002.477073808.0000000000FF2000.00000002.00000001.01000000.00000009.sdmp, Tnpak.exe.10.dr
Source: Binary string: RegSvcs.pdb source: Tnpak.exe, Tnpak.exe, 00000011.00000002.477073808.0000000000FF2000.00000002.00000001.01000000.00000009.sdmp, Tnpak.exe.10.dr
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_0618165F push es; ret 10_2_061818C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_0618166B push es; ret 10_2_061818C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_06181663 push es; ret 10_2_061818C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_0618169B push es; ret 10_2_061818C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_0618169F push es; ret 10_2_061818C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_061816B7 push es; ret 10_2_061818C4
Source: initial sample Static PE information: section name: .text entropy: 7.7554882987
Source: initial sample Static PE information: section name: .text entropy: 7.7554882987
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File created: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Jump to dropped file
Source: C:\Users\user\Desktop\Payment Slip.exe File created: C:\Users\user\AppData\Roaming\aXqntX.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\Payment Slip.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aXqntX" /XML "C:\Users\user\AppData\Local\Temp\tmp62DF.tmp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Tnpak Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Tnpak Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.425049862.0000000002961000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Payment Slip.exe PID: 3736, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Payment Slip.exe, 00000001.00000002.425049862.0000000002961000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: Payment Slip.exe, 00000001.00000002.425049862.0000000002961000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Payment Slip.exe TID: 1968 Thread sleep time: -43731s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe TID: 5664 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6772 Thread sleep time: -11990383647911201s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe TID: 6344 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe TID: 6824 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Payment Slip.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7729 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 840 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Window / User API: threadDelayed 3152 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Window / User API: threadDelayed 5699 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Payment Slip.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Thread delayed: delay time: 43731 Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Thread delayed: delay time: 922337203685477
Source: Payment Slip.exe, 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Payment Slip.exe, 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: Payment Slip.exe, 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: RegSvcs.exe, 0000000A.00000002.634398252.0000000000C09000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Payment Slip.exe, 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Enables debug privileges
Source: C:\Users\user\Desktop\Payment Slip.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 10_2_0618CF88 LdrInitializeThunk, 10_2_0618CF88
Source: C:\Users\user\Desktop\Payment Slip.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Payment Slip.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000 Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 436000 Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 438000 Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 782008 Jump to behavior
Modifies the hosts file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Payment Slip.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A Jump to behavior
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\Payment Slip.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aXqntX.exe
Source: C:\Users\user\Desktop\Payment Slip.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aXqntX.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Payment Slip.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aXqntX.exe Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aXqntX" /XML "C:\Users\user\AppData\Local\Temp\tmp62DF.tmp Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Users\user\Desktop\Payment Slip.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Slip.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Queries volume information: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Queries volume information: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\Desktop\Payment Slip.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Modifies the hosts file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Payment Slip.exe.3cb4c90.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Payment Slip.exe.3ce94b0.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Payment Slip.exe.3cb4c90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Payment Slip.exe.3ce94b0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Payment Slip.exe.3c23e70.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000000.422706976.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.633233938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.423015971.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.422359021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.421937006.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.428332559.0000000003BE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Payment Slip.exe PID: 3736, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 6004, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 6004, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Payment Slip.exe.3cb4c90.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Payment Slip.exe.3ce94b0.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Payment Slip.exe.3cb4c90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Payment Slip.exe.3ce94b0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Payment Slip.exe.3c23e70.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000000.422706976.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.633233938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.423015971.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.422359021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.421937006.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.428332559.0000000003BE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Payment Slip.exe PID: 3736, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 6004, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 635144 Sample: Payment Slip.exe Startdate: 27/05/2022 Architecture: WINDOWS Score: 100 54 Found malware configuration 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Multi AV Scanner detection for dropped file 2->58 60 8 other signatures 2->60 7 Payment Slip.exe 7 2->7         started        11 Tnpak.exe 2->11         started        13 Tnpak.exe 2->13         started        process3 file4 36 C:\Users\user\AppData\Roaming\aXqntX.exe, PE32 7->36 dropped 38 C:\Users\user\AppData\Local\...\tmp62DF.tmp, XML 7->38 dropped 40 C:\Users\user\...\Payment Slip.exe.log, ASCII 7->40 dropped 62 Writes to foreign memory regions 7->62 64 Adds a directory exclusion to Windows Defender 7->64 66 Injects a PE file into a foreign processes 7->66 15 RegSvcs.exe 2 4 7->15         started        20 powershell.exe 25 7->20         started        22 schtasks.exe 1 7->22         started        24 conhost.exe 11->24         started        26 conhost.exe 13->26         started        signatures5 process6 dnsIp7 42 subnet-group.com 206.189.39.129, 49777, 587 DIGITALOCEAN-ASNUS United States 15->42 44 mail.subnet-group.com 15->44 32 C:\Users\user\AppData\Roaming\...\Tnpak.exe, PE32 15->32 dropped 34 C:\Windows\System32\drivers\etc\hosts, ASCII 15->34 dropped 46 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->46 48 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->48 50 Tries to steal Mail credentials (via file / registry access) 15->50 52 5 other signatures 15->52 28 conhost.exe 20->28         started        30 conhost.exe 22->30         started        file8 signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
206.189.39.129
 subnet-group.com United States
14061 DIGITALOCEAN-ASNUS false

Contacted Domains

Name IP Active
subnet-group.com 206.189.39.129 true
mail.subnet-group.com unknown unknown