Windows Analysis Report
PROFORMA FATURA.exe

Overview

General Information

Sample name: PROFORMA FATURA.exe
Analysis ID: 1525518
MD5: 49c53c3c0868699a9cbe2ef3d5bfcb8e
SHA1: 3113b54138af9199fd97f96a42542541b6a8fdb3
SHA256: 0ad205b2d883bca56250246f308228379c27f6114d8b740014deeef53b3412bb
Tags: exeuser-lowmal3
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE / OLE file has an invalid certificate
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Found malware configuration
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "zqamcx.com", "Username": "sender@zqamcx.com", "Password": "Methodman991"}
Multi AV Scanner detection for domain / URL
Source: zqamcx.com Virustotal: Detection: 9% Perma Link
Source: http://zqamcx.com Virustotal: Detection: 9% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Virustotal: Detection: 56% Perma Link
Multi AV Scanner detection for submitted file
Source: PROFORMA FATURA.exe ReversingLabs: Detection: 75%
Source: PROFORMA FATURA.exe Virustotal: Detection: 56% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: PROFORMA FATURA.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: PROFORMA FATURA.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: PROFORMA FATURA.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: ThhL.pdbSHA256g source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr
Source: Binary string: ThhL.pdb source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 4x nop then jmp 0747B7A6h 0_2_0747B899
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 4x nop then jmp 0721AA06h 11_2_0721AAF9
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:53953 -> 78.110.166.82:587
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 78.110.166.82 78.110.166.82
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UKSERVERS-ASUKDedicatedServersHostingandCo-Location UKSERVERS-ASUKDedicatedServersHostingandCo-Location
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.6:53953 -> 78.110.166.82:587
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: zqamcx.com
Source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: PROFORMA FATURA.exe, 00000009.00000002.4583291405.0000000006252000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000000F99000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000001016000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.00000000062F2000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r11.i.lencr.org/0#
Source: PROFORMA FATURA.exe, 00000009.00000002.4583291405.0000000006252000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000000F99000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000001016000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.00000000062F2000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r11.o.lencr.org0#
Source: PROFORMA FATURA.exe, 00000000.00000002.2170478140.00000000030F0000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000B.00000002.2216843841.0000000003260000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PROFORMA FATURA.exe, 00000009.00000002.4583291405.0000000006252000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.0000000006328000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000000F99000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000001016000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.00000000062F2000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: PROFORMA FATURA.exe, 00000009.00000002.4583291405.0000000006252000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.0000000006328000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000000F99000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000001016000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4583496379.00000000062F2000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: PROFORMA FATURA.exe, 00000009.00000002.4572408671.000000000297B000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://zqamcx.com
Source: PROFORMA FATURA.exe, 00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp, PROFORMA FATURA.exe, 00000009.00000002.4568852604.0000000000437000.00000040.00000400.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000B.00000002.2219115296.0000000004BEB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, O9KGcRw9bkp.cs .Net Code: KAZ
Source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack, O9KGcRw9bkp.cs .Net Code: KAZ
Installs a global keyboard hook
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\PROFORMA FATURA.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 0_2_02CAD5BC 0_2_02CAD5BC
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 0_2_053B6BE0 0_2_053B6BE0
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 0_2_053B0011 0_2_053B0011
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 0_2_053B0040 0_2_053B0040
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 0_2_053B6BD0 0_2_053B6BD0
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 0_2_07477728 0_2_07477728
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 0_2_074756C0 0_2_074756C0
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 0_2_074756D0 0_2_074756D0
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 0_2_07475298 0_2_07475298
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 0_2_07474E60 0_2_07474E60
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 0_2_07476D78 0_2_07476D78
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_00DA4A88 9_2_00DA4A88
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_00DA9B40 9_2_00DA9B40
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_00DACDC0 9_2_00DACDC0
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_00DA3E70 9_2_00DA3E70
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_00DA41B8 9_2_00DA41B8
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_00DAF4A8 9_2_00DAF4A8
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_0551C900 9_2_0551C900
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_05511010 9_2_05511010
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_055113D8 9_2_055113D8
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_0551F2D0 9_2_0551F2D0
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_05D6DD3D 9_2_05D6DD3D
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_05D68C0A 9_2_05D68C0A
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_05D65760 9_2_05D65760
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_05D62F08 9_2_05D62F08
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_05D63F38 9_2_05D63F38
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_05D60040 9_2_05D60040
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_05D6BD90 9_2_05D6BD90
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_05D63637 9_2_05D63637
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_05D649E8 9_2_05D649E8
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 9_2_05D65068 9_2_05D65068
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 11_2_0163D5BC 11_2_0163D5BC
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 11_2_05556BE0 11_2_05556BE0
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 11_2_05550040 11_2_05550040
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 11_2_05550006 11_2_05550006
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 11_2_05556BD0 11_2_05556BD0
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 11_2_07214E60 11_2_07214E60
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 11_2_07217728 11_2_07217728
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 11_2_072156C0 11_2_072156C0
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 11_2_072156D0 11_2_072156D0
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 11_2_07215298 11_2_07215298
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 11_2_07216D78 11_2_07216D78
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_010E41B8 14_2_010E41B8
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_010E9B40 14_2_010E9B40
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_010E4A88 14_2_010E4A88
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_010ECDC0 14_2_010ECDC0
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_010E3E70 14_2_010E3E70
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_010EF4B9 14_2_010EF4B9
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_05FCDD3D 14_2_05FCDD3D
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_05FC8C0B 14_2_05FC8C0B
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_05FC5760 14_2_05FC5760
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_05FC3F38 14_2_05FC3F38
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_05FC2F08 14_2_05FC2F08
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_05FC0040 14_2_05FC0040
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_05FCBD90 14_2_05FCBD90
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_05FC3637 14_2_05FC3637
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_05FC49E8 14_2_05FC49E8
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_05FC5068 14_2_05FC5068
PE / OLE file has an invalid certificate
Source: PROFORMA FATURA.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: PROFORMA FATURA.exe, 00000000.00000000.2115763119.0000000000B28000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThhL.exe@ vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe, 00000000.00000002.2169367415.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe, 00000000.00000002.2171035964.0000000004712000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe, 00000000.00000002.2170478140.00000000030F0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameb9cb78e8-c1d3-4ab9-8530-a3a5b5ca79e5.exe4 vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe, 00000000.00000002.2175247224.000000000A080000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe, 00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameb9cb78e8-c1d3-4ab9-8530-a3a5b5ca79e5.exe4 vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe, 00000009.00000002.4569368222.00000000007F9000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe, 00000009.00000002.4568852604.0000000000439000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenameb9cb78e8-c1d3-4ab9-8530-a3a5b5ca79e5.exe4 vs PROFORMA FATURA.exe
Source: PROFORMA FATURA.exe Binary or memory string: OriginalFilenameThhL.exe@ vs PROFORMA FATURA.exe
Uses 32bit PE files
Source: PROFORMA FATURA.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: PROFORMA FATURA.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: GvgUQlbRIXOe.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, CMa60k.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, CMa60k.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, CMa60k.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, CMa60k.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, EgTglEucnUn.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, EgTglEucnUn.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, MmVR.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, MmVR.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, EGW1In2sxEk72sqfx8.cs Security API names: _0020.SetAccessControl
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, EGW1In2sxEk72sqfx8.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, EGW1In2sxEk72sqfx8.cs Security API names: _0020.AddAccessRule
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, YytYwTXRVn7U81VOno.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, YytYwTXRVn7U81VOno.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, EGW1In2sxEk72sqfx8.cs Security API names: _0020.SetAccessControl
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, EGW1In2sxEk72sqfx8.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, EGW1In2sxEk72sqfx8.cs Security API names: _0020.AddAccessRule
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, EGW1In2sxEk72sqfx8.cs Security API names: _0020.SetAccessControl
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, EGW1In2sxEk72sqfx8.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, EGW1In2sxEk72sqfx8.cs Security API names: _0020.AddAccessRule
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, YytYwTXRVn7U81VOno.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@19/15@1/1
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe File created: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1096:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6068:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3172:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:948:120:WilError_03
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Mutant created: \Sessions\1\BaseNamedObjects\LUhAgCfBCnbQ
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe File created: C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp Jump to behavior
Source: PROFORMA FATURA.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: PROFORMA FATURA.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: PROFORMA FATURA.exe ReversingLabs: Detection: 75%
Source: PROFORMA FATURA.exe Virustotal: Detection: 56%
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe File read: C:\Users\user\Desktop\PROFORMA FATURA.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PROFORMA FATURA.exe "C:\Users\user\Desktop\PROFORMA FATURA.exe"
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Users\user\Desktop\PROFORMA FATURA.exe "C:\Users\user\Desktop\PROFORMA FATURA.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown Process created: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpBA20.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process created: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe"
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe" Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe" Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp" Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Users\user\Desktop\PROFORMA FATURA.exe "C:\Users\user\Desktop\PROFORMA FATURA.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpBA20.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process created: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe" Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: PROFORMA FATURA.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: PROFORMA FATURA.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: PROFORMA FATURA.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: ThhL.pdbSHA256g source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr
Source: Binary string: ThhL.pdb source: PROFORMA FATURA.exe, GvgUQlbRIXOe.exe.0.dr

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: PROFORMA FATURA.exe, Form1.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: GvgUQlbRIXOe.exe.0.dr, Form1.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 0.2.PROFORMA FATURA.exe.3efa190.3.raw.unpack, MainForm.cs .Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.PROFORMA FATURA.exe.59d0000.5.raw.unpack, MainForm.cs .Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, EGW1In2sxEk72sqfx8.cs .Net Code: yZlktfWd1o System.Reflection.Assembly.Load(byte[])
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, EGW1In2sxEk72sqfx8.cs .Net Code: yZlktfWd1o System.Reflection.Assembly.Load(byte[])
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, EGW1In2sxEk72sqfx8.cs .Net Code: yZlktfWd1o System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: PROFORMA FATURA.exe Static PE information: 0xDEBF553A [Thu Jun 3 06:05:46 2088 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Code function: 0_2_0747E7ED push FFFFFF8Bh; iretd 0_2_0747E7EF
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 11_2_0721DA4D push FFFFFF8Bh; iretd 11_2_0721DA4F
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Code function: 14_2_05FCF708 push F4057CCFh; iretd 14_2_05FCF711
Source: PROFORMA FATURA.exe Static PE information: section name: .text entropy: 7.502265215302294
Source: GvgUQlbRIXOe.exe.0.dr Static PE information: section name: .text entropy: 7.502265215302294
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, g4Qs8M5oWwROxbKec3.cs High entropy of concatenated method names: 'fGG6ov0mZ1', 'z9861YA9qS', 'O8W6tBllRO', 'RZf6Ev8JCW', 'c1q6JVyrhH', 'qFy6l03KBO', 'v4E60y3waN', 'XgV69ehsdG', 'FLQ6ZwkB9k', 'QcI6aJgQw9'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, zgxQIxz5lAukYUxvcV.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LYurI4lJjl', 'DZQre7PP7g', 'AetrDsDgK8', 'b1KrN59af1', 'SJmrOnkyC9', 'PAZrrXZ5KF', 'AFYr24Uy4L'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, JTnk9wqS5upEMWkVDI.cs High entropy of concatenated method names: 'GODHWatdyD3ai5D1mqb', 'wX7NoKtHR7EPQpZs1Cu', 'rl9HOgrwQ3', 'obXHrWJFf7', 'fOTH2E62eW', 'DNVxNAt0Ia2l0xdeW2U', 'g4ZJ6stceAIeDFVhj9b'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, SIM1vrU83M80n3ghnSU.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HHt27t0dj1', 'P6e25Aj47u', 'f822nRZ0KS', 'kry2gEkAIN', 'dFk2mY6FjV', 'hlY2RQK7k7', 'nn82crIklZ'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, a9Jf6RK6DvE2Wnfcjo.cs High entropy of concatenated method names: 'SgFOKOZ7jN', 'hdPO3nLxXA', 'IuCOpkPas1', 'nCWOSFBJaE', 'PrwOHREnrc', 'GqfO6MTlq0', 'xlFOd5LqVr', 'FcyOP1ioIq', 'bSVO8SuU9p', 'wNrOMyTk2S'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, KGrF0bFArvIPSaM0rx.cs High entropy of concatenated method names: 'j7R6KrOXAv', 'vlK6pleJPp', 'bDd6H6KmlL', 'pa4Hu9CPFO', 'Q6GHzydtKx', 'nTc64MpboE', 'C5f6X89O3m', 'FLo6LyareV', 'sdO6jnCGYy', 'uub6kiZVeu'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, EGW1In2sxEk72sqfx8.cs High entropy of concatenated method names: 'w8ijq3hQbi', 'RZjjKT3yWN', 'InBj3trNVt', 'frpjpLw6f9', 'GonjSyJEsT', 'nMojHN4oJc', 'a3rj6s71t0', 'BEPjdDGFqu', 'zfPjPpH7wZ', 'Fw3j85RExc'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, JGt8leideG3tEw3FFw.cs High entropy of concatenated method names: 'p8BX69Chcm', 'UdpXdAgx8X', 'pTdX8nRXOG', 'Y1DXM4BNDw', 'IPBXeP2W5U', 'V47XDb8nZZ', 'M7WVG0WMmBLAQT0Nk1', 'GrTuMf1AHyW0wtkhgm', 'kiVgIFkicWxHjSBOOQ', 'wITXXrC79k'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, qq8b56hyCVeqo4mhxD.cs High entropy of concatenated method names: 'L2VOWS122e', 'e0JOACvmn6', 'JH3OQf8KJ5', 'l0pOsWDL3b', 'HFCO7ep4Xh', 'VePOiTR8oR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, z5urZkslVeJkKSP9xS.cs High entropy of concatenated method names: 'l2EeT1qhRI', 'jYeebNyP8b', 'Cmle7GWpFr', 'OT6e54YlQW', 'lK0eAyVwwA', 'vv2eQSSfsl', 'nOfesef6a5', 'iCIeiMNFnj', 'lJdewQnU0s', 'q2HeCgVLQP'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, LpC6HlESRmbB0HCWjb.cs High entropy of concatenated method names: 'I1IrXvySP7', 'bPRrjLiKld', 'zIsrk9F5nP', 'GN0rKWEyxT', 'dO3r3vuvGE', 'kwvrSguksF', 'mHirH1VBOu', 'rwVOc3f1Eh', 'hFUOhxg0HP', 'quZOy4Json'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, FpLxU0USGQJ0hASUnF9.cs High entropy of concatenated method names: 'vyLrojyPsh', 'd6Wr1VCg7Y', 'twlrtyio0H', 'LMtrEGXROm', 'e4JrJ8F9g8', 'juxrlZSMbK', 'J8Hr0byZk5', 'iY4r946lWx', 'kTbrZnahfs', 'KErraLc6ld'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, EQSd2GR5QIKoQb3pwL.cs High entropy of concatenated method names: 'Dispose', 'FMbXyt4mVu', 'gB4LAHpEeU', 'XbiVVNu8KF', 'BaPXueQq8L', 'rdMXzu6F6m', 'ProcessDialogKey', 'hDoL4o7n0C', 'tI5LXTJfFI', 'mHSLLMvn5X'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, YytYwTXRVn7U81VOno.cs High entropy of concatenated method names: 'i0p37pHOV4', 'cqL35EtsJm', 'sDZ3noBtXj', 'Fpe3g5miCu', 'CEN3m3L8eX', 'sXF3RfPcUB', 'EZr3cbFn9p', 'mFo3hnHetx', 'QNh3y2YjO1', 'HYU3u0bxtc'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, VkYf5BPjdXsGlTY65o.cs High entropy of concatenated method names: 'SxIpEN6DTu', 'nckplmVpkn', 'SZIp9KW9iu', 'JffpZ40gCj', 'qohpeXV1ti', 'yvMpDKy4ev', 'LTppNWvUGU', 'ypOpOYiyNg', 'NI7pr08V0a', 'IFhp2ElSPx'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, MCfrSMWdlxWVY1IL1f.cs High entropy of concatenated method names: 'ID3I9I8why', 'sPsIZDLsUK', 'RjbIW0rOAZ', 'LHBIA7rIpf', 'q5pIsyM4ff', 'sC1IipnrZd', 'jwPICf1Uxx', 'QPwIGGvWyw', 'XaxITJdgdg', 'CRWIf1WYjN'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, boHndMrnP1k12e3lIF.cs High entropy of concatenated method names: 'a69Nh8xuT6', 'eHYNubMpPh', 'C37O4cOH0m', 'P1FOXmZ7Re', 'byHNfIywoB', 'oYUNbRyQaL', 'wUrNYDV574', 'q5XN7EYIHj', 'ICSN5RR8PQ', 'X5HNndBiEf'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, CFC8oSAR2QsHjWaGqv.cs High entropy of concatenated method names: 'gXXtV7N8f', 'VM9EyVCGl', 'gEDlu2red', 'MDQ0i5x24', 'FeqZNnCFY', 'pJGahV8rN', 'vLFOcvFxvkQxqmT7ZW', 'Mla4EfKO5pGeg00Eew', 'Br2OaRLQA', 'hay2g3TJH'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, J4ugg54wIbg5846ALq.cs High entropy of concatenated method names: 'la7Hq9VSxc', 'aOHH3yGFAY', 'ItIHS3DB6v', 'YJQH6lopwl', 'ErwHdj0tBY', 't9oSmkXEcX', 'MtPSRBLA0Y', 'kBpScqIPBb', 'XSUShWqoe0', 'WnNSyEt9bp'
Source: 0.2.PROFORMA FATURA.exe.491f340.2.raw.unpack, hIIN84dB4yLGgx3Xmo.cs High entropy of concatenated method names: 'KNFN8NcRIV', 'OvDNMdJccD', 'ToString', 'HSwNKchN9D', 'PYYN33RFbY', 'iYFNprc0lR', 'X0GNSISsMI', 'VpcNHWkyAr', 'yD1N6uIZ7j', 'SPfNdnynLO'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, g4Qs8M5oWwROxbKec3.cs High entropy of concatenated method names: 'fGG6ov0mZ1', 'z9861YA9qS', 'O8W6tBllRO', 'RZf6Ev8JCW', 'c1q6JVyrhH', 'qFy6l03KBO', 'v4E60y3waN', 'XgV69ehsdG', 'FLQ6ZwkB9k', 'QcI6aJgQw9'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, zgxQIxz5lAukYUxvcV.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LYurI4lJjl', 'DZQre7PP7g', 'AetrDsDgK8', 'b1KrN59af1', 'SJmrOnkyC9', 'PAZrrXZ5KF', 'AFYr24Uy4L'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, JTnk9wqS5upEMWkVDI.cs High entropy of concatenated method names: 'GODHWatdyD3ai5D1mqb', 'wX7NoKtHR7EPQpZs1Cu', 'rl9HOgrwQ3', 'obXHrWJFf7', 'fOTH2E62eW', 'DNVxNAt0Ia2l0xdeW2U', 'g4ZJ6stceAIeDFVhj9b'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, SIM1vrU83M80n3ghnSU.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HHt27t0dj1', 'P6e25Aj47u', 'f822nRZ0KS', 'kry2gEkAIN', 'dFk2mY6FjV', 'hlY2RQK7k7', 'nn82crIklZ'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, a9Jf6RK6DvE2Wnfcjo.cs High entropy of concatenated method names: 'SgFOKOZ7jN', 'hdPO3nLxXA', 'IuCOpkPas1', 'nCWOSFBJaE', 'PrwOHREnrc', 'GqfO6MTlq0', 'xlFOd5LqVr', 'FcyOP1ioIq', 'bSVO8SuU9p', 'wNrOMyTk2S'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, KGrF0bFArvIPSaM0rx.cs High entropy of concatenated method names: 'j7R6KrOXAv', 'vlK6pleJPp', 'bDd6H6KmlL', 'pa4Hu9CPFO', 'Q6GHzydtKx', 'nTc64MpboE', 'C5f6X89O3m', 'FLo6LyareV', 'sdO6jnCGYy', 'uub6kiZVeu'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, EGW1In2sxEk72sqfx8.cs High entropy of concatenated method names: 'w8ijq3hQbi', 'RZjjKT3yWN', 'InBj3trNVt', 'frpjpLw6f9', 'GonjSyJEsT', 'nMojHN4oJc', 'a3rj6s71t0', 'BEPjdDGFqu', 'zfPjPpH7wZ', 'Fw3j85RExc'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, JGt8leideG3tEw3FFw.cs High entropy of concatenated method names: 'p8BX69Chcm', 'UdpXdAgx8X', 'pTdX8nRXOG', 'Y1DXM4BNDw', 'IPBXeP2W5U', 'V47XDb8nZZ', 'M7WVG0WMmBLAQT0Nk1', 'GrTuMf1AHyW0wtkhgm', 'kiVgIFkicWxHjSBOOQ', 'wITXXrC79k'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, qq8b56hyCVeqo4mhxD.cs High entropy of concatenated method names: 'L2VOWS122e', 'e0JOACvmn6', 'JH3OQf8KJ5', 'l0pOsWDL3b', 'HFCO7ep4Xh', 'VePOiTR8oR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, z5urZkslVeJkKSP9xS.cs High entropy of concatenated method names: 'l2EeT1qhRI', 'jYeebNyP8b', 'Cmle7GWpFr', 'OT6e54YlQW', 'lK0eAyVwwA', 'vv2eQSSfsl', 'nOfesef6a5', 'iCIeiMNFnj', 'lJdewQnU0s', 'q2HeCgVLQP'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, LpC6HlESRmbB0HCWjb.cs High entropy of concatenated method names: 'I1IrXvySP7', 'bPRrjLiKld', 'zIsrk9F5nP', 'GN0rKWEyxT', 'dO3r3vuvGE', 'kwvrSguksF', 'mHirH1VBOu', 'rwVOc3f1Eh', 'hFUOhxg0HP', 'quZOy4Json'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, FpLxU0USGQJ0hASUnF9.cs High entropy of concatenated method names: 'vyLrojyPsh', 'd6Wr1VCg7Y', 'twlrtyio0H', 'LMtrEGXROm', 'e4JrJ8F9g8', 'juxrlZSMbK', 'J8Hr0byZk5', 'iY4r946lWx', 'kTbrZnahfs', 'KErraLc6ld'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, EQSd2GR5QIKoQb3pwL.cs High entropy of concatenated method names: 'Dispose', 'FMbXyt4mVu', 'gB4LAHpEeU', 'XbiVVNu8KF', 'BaPXueQq8L', 'rdMXzu6F6m', 'ProcessDialogKey', 'hDoL4o7n0C', 'tI5LXTJfFI', 'mHSLLMvn5X'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, YytYwTXRVn7U81VOno.cs High entropy of concatenated method names: 'i0p37pHOV4', 'cqL35EtsJm', 'sDZ3noBtXj', 'Fpe3g5miCu', 'CEN3m3L8eX', 'sXF3RfPcUB', 'EZr3cbFn9p', 'mFo3hnHetx', 'QNh3y2YjO1', 'HYU3u0bxtc'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, VkYf5BPjdXsGlTY65o.cs High entropy of concatenated method names: 'SxIpEN6DTu', 'nckplmVpkn', 'SZIp9KW9iu', 'JffpZ40gCj', 'qohpeXV1ti', 'yvMpDKy4ev', 'LTppNWvUGU', 'ypOpOYiyNg', 'NI7pr08V0a', 'IFhp2ElSPx'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, MCfrSMWdlxWVY1IL1f.cs High entropy of concatenated method names: 'ID3I9I8why', 'sPsIZDLsUK', 'RjbIW0rOAZ', 'LHBIA7rIpf', 'q5pIsyM4ff', 'sC1IipnrZd', 'jwPICf1Uxx', 'QPwIGGvWyw', 'XaxITJdgdg', 'CRWIf1WYjN'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, boHndMrnP1k12e3lIF.cs High entropy of concatenated method names: 'a69Nh8xuT6', 'eHYNubMpPh', 'C37O4cOH0m', 'P1FOXmZ7Re', 'byHNfIywoB', 'oYUNbRyQaL', 'wUrNYDV574', 'q5XN7EYIHj', 'ICSN5RR8PQ', 'X5HNndBiEf'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, CFC8oSAR2QsHjWaGqv.cs High entropy of concatenated method names: 'gXXtV7N8f', 'VM9EyVCGl', 'gEDlu2red', 'MDQ0i5x24', 'FeqZNnCFY', 'pJGahV8rN', 'vLFOcvFxvkQxqmT7ZW', 'Mla4EfKO5pGeg00Eew', 'Br2OaRLQA', 'hay2g3TJH'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, J4ugg54wIbg5846ALq.cs High entropy of concatenated method names: 'la7Hq9VSxc', 'aOHH3yGFAY', 'ItIHS3DB6v', 'YJQH6lopwl', 'ErwHdj0tBY', 't9oSmkXEcX', 'MtPSRBLA0Y', 'kBpScqIPBb', 'XSUShWqoe0', 'WnNSyEt9bp'
Source: 0.2.PROFORMA FATURA.exe.a080000.6.raw.unpack, hIIN84dB4yLGgx3Xmo.cs High entropy of concatenated method names: 'KNFN8NcRIV', 'OvDNMdJccD', 'ToString', 'HSwNKchN9D', 'PYYN33RFbY', 'iYFNprc0lR', 'X0GNSISsMI', 'VpcNHWkyAr', 'yD1N6uIZ7j', 'SPfNdnynLO'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, g4Qs8M5oWwROxbKec3.cs High entropy of concatenated method names: 'fGG6ov0mZ1', 'z9861YA9qS', 'O8W6tBllRO', 'RZf6Ev8JCW', 'c1q6JVyrhH', 'qFy6l03KBO', 'v4E60y3waN', 'XgV69ehsdG', 'FLQ6ZwkB9k', 'QcI6aJgQw9'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, zgxQIxz5lAukYUxvcV.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LYurI4lJjl', 'DZQre7PP7g', 'AetrDsDgK8', 'b1KrN59af1', 'SJmrOnkyC9', 'PAZrrXZ5KF', 'AFYr24Uy4L'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, JTnk9wqS5upEMWkVDI.cs High entropy of concatenated method names: 'GODHWatdyD3ai5D1mqb', 'wX7NoKtHR7EPQpZs1Cu', 'rl9HOgrwQ3', 'obXHrWJFf7', 'fOTH2E62eW', 'DNVxNAt0Ia2l0xdeW2U', 'g4ZJ6stceAIeDFVhj9b'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, SIM1vrU83M80n3ghnSU.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HHt27t0dj1', 'P6e25Aj47u', 'f822nRZ0KS', 'kry2gEkAIN', 'dFk2mY6FjV', 'hlY2RQK7k7', 'nn82crIklZ'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, a9Jf6RK6DvE2Wnfcjo.cs High entropy of concatenated method names: 'SgFOKOZ7jN', 'hdPO3nLxXA', 'IuCOpkPas1', 'nCWOSFBJaE', 'PrwOHREnrc', 'GqfO6MTlq0', 'xlFOd5LqVr', 'FcyOP1ioIq', 'bSVO8SuU9p', 'wNrOMyTk2S'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, KGrF0bFArvIPSaM0rx.cs High entropy of concatenated method names: 'j7R6KrOXAv', 'vlK6pleJPp', 'bDd6H6KmlL', 'pa4Hu9CPFO', 'Q6GHzydtKx', 'nTc64MpboE', 'C5f6X89O3m', 'FLo6LyareV', 'sdO6jnCGYy', 'uub6kiZVeu'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, EGW1In2sxEk72sqfx8.cs High entropy of concatenated method names: 'w8ijq3hQbi', 'RZjjKT3yWN', 'InBj3trNVt', 'frpjpLw6f9', 'GonjSyJEsT', 'nMojHN4oJc', 'a3rj6s71t0', 'BEPjdDGFqu', 'zfPjPpH7wZ', 'Fw3j85RExc'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, JGt8leideG3tEw3FFw.cs High entropy of concatenated method names: 'p8BX69Chcm', 'UdpXdAgx8X', 'pTdX8nRXOG', 'Y1DXM4BNDw', 'IPBXeP2W5U', 'V47XDb8nZZ', 'M7WVG0WMmBLAQT0Nk1', 'GrTuMf1AHyW0wtkhgm', 'kiVgIFkicWxHjSBOOQ', 'wITXXrC79k'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, qq8b56hyCVeqo4mhxD.cs High entropy of concatenated method names: 'L2VOWS122e', 'e0JOACvmn6', 'JH3OQf8KJ5', 'l0pOsWDL3b', 'HFCO7ep4Xh', 'VePOiTR8oR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, z5urZkslVeJkKSP9xS.cs High entropy of concatenated method names: 'l2EeT1qhRI', 'jYeebNyP8b', 'Cmle7GWpFr', 'OT6e54YlQW', 'lK0eAyVwwA', 'vv2eQSSfsl', 'nOfesef6a5', 'iCIeiMNFnj', 'lJdewQnU0s', 'q2HeCgVLQP'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, LpC6HlESRmbB0HCWjb.cs High entropy of concatenated method names: 'I1IrXvySP7', 'bPRrjLiKld', 'zIsrk9F5nP', 'GN0rKWEyxT', 'dO3r3vuvGE', 'kwvrSguksF', 'mHirH1VBOu', 'rwVOc3f1Eh', 'hFUOhxg0HP', 'quZOy4Json'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, FpLxU0USGQJ0hASUnF9.cs High entropy of concatenated method names: 'vyLrojyPsh', 'd6Wr1VCg7Y', 'twlrtyio0H', 'LMtrEGXROm', 'e4JrJ8F9g8', 'juxrlZSMbK', 'J8Hr0byZk5', 'iY4r946lWx', 'kTbrZnahfs', 'KErraLc6ld'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, EQSd2GR5QIKoQb3pwL.cs High entropy of concatenated method names: 'Dispose', 'FMbXyt4mVu', 'gB4LAHpEeU', 'XbiVVNu8KF', 'BaPXueQq8L', 'rdMXzu6F6m', 'ProcessDialogKey', 'hDoL4o7n0C', 'tI5LXTJfFI', 'mHSLLMvn5X'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, YytYwTXRVn7U81VOno.cs High entropy of concatenated method names: 'i0p37pHOV4', 'cqL35EtsJm', 'sDZ3noBtXj', 'Fpe3g5miCu', 'CEN3m3L8eX', 'sXF3RfPcUB', 'EZr3cbFn9p', 'mFo3hnHetx', 'QNh3y2YjO1', 'HYU3u0bxtc'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, VkYf5BPjdXsGlTY65o.cs High entropy of concatenated method names: 'SxIpEN6DTu', 'nckplmVpkn', 'SZIp9KW9iu', 'JffpZ40gCj', 'qohpeXV1ti', 'yvMpDKy4ev', 'LTppNWvUGU', 'ypOpOYiyNg', 'NI7pr08V0a', 'IFhp2ElSPx'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, MCfrSMWdlxWVY1IL1f.cs High entropy of concatenated method names: 'ID3I9I8why', 'sPsIZDLsUK', 'RjbIW0rOAZ', 'LHBIA7rIpf', 'q5pIsyM4ff', 'sC1IipnrZd', 'jwPICf1Uxx', 'QPwIGGvWyw', 'XaxITJdgdg', 'CRWIf1WYjN'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, boHndMrnP1k12e3lIF.cs High entropy of concatenated method names: 'a69Nh8xuT6', 'eHYNubMpPh', 'C37O4cOH0m', 'P1FOXmZ7Re', 'byHNfIywoB', 'oYUNbRyQaL', 'wUrNYDV574', 'q5XN7EYIHj', 'ICSN5RR8PQ', 'X5HNndBiEf'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, CFC8oSAR2QsHjWaGqv.cs High entropy of concatenated method names: 'gXXtV7N8f', 'VM9EyVCGl', 'gEDlu2red', 'MDQ0i5x24', 'FeqZNnCFY', 'pJGahV8rN', 'vLFOcvFxvkQxqmT7ZW', 'Mla4EfKO5pGeg00Eew', 'Br2OaRLQA', 'hay2g3TJH'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, J4ugg54wIbg5846ALq.cs High entropy of concatenated method names: 'la7Hq9VSxc', 'aOHH3yGFAY', 'ItIHS3DB6v', 'YJQH6lopwl', 'ErwHdj0tBY', 't9oSmkXEcX', 'MtPSRBLA0Y', 'kBpScqIPBb', 'XSUShWqoe0', 'WnNSyEt9bp'
Source: 0.2.PROFORMA FATURA.exe.499d360.0.raw.unpack, hIIN84dB4yLGgx3Xmo.cs High entropy of concatenated method names: 'KNFN8NcRIV', 'OvDNMdJccD', 'ToString', 'HSwNKchN9D', 'PYYN33RFbY', 'iYFNprc0lR', 'X0GNSISsMI', 'VpcNHWkyAr', 'yD1N6uIZ7j', 'SPfNdnynLO'
Drops PE files
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe File created: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp"

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: PROFORMA FATURA.exe PID: 2672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: GvgUQlbRIXOe.exe PID: 6412, type: MEMORYSTR
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory allocated: 2C40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory allocated: 2E90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory allocated: 2CC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory allocated: 7980000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory allocated: 8980000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory allocated: 8B20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory allocated: 9B20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory allocated: A100000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory allocated: B100000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory allocated: C100000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory allocated: DA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory allocated: 2880000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory allocated: 4880000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Memory allocated: 1630000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Memory allocated: 3000000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Memory allocated: 5000000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Memory allocated: 7A50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Memory allocated: 8A50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Memory allocated: 8BF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Memory allocated: 9BF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Memory allocated: 9F20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Memory allocated: AF20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Memory allocated: BF20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Memory allocated: 10E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Memory allocated: 2BD0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Memory allocated: 4BD0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6979 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7524 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1408 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Window / User API: threadDelayed 5378 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Window / User API: threadDelayed 4439 Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Window / User API: threadDelayed 6586
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Window / User API: threadDelayed 3269
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 3108 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4892 Thread sleep count: 6979 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4892 Thread sleep count: 240 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7028 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 404 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6268 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2016 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep count: 36 > 30 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -33204139332677172s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -200000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99874s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 4236 Thread sleep count: 5378 > 30 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 4236 Thread sleep count: 4439 > 30 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99654s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99531s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99421s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99312s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99203s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99093s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -98980s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -98859s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -98749s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -98640s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -98531s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -98403s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -98296s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -98186s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -98010s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -97895s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -97777s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -97671s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -97559s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -97452s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -97343s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -97234s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -97124s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -97015s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -96906s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -96796s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -96687s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -96577s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -96468s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -96359s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -96249s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -96140s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -96017s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -95906s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -95796s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -95678s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -95562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -95446s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99890s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99672s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99328s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99218s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe TID: 6204 Thread sleep time: -99000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 7100 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -31359464925306218s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99890s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 2848 Thread sleep count: 6586 > 30
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 2848 Thread sleep count: 3269 > 30
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99780s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99671s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99561s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99453s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99343s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99220s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99094s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -98984s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -98874s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -98714s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -98216s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -98109s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -97998s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -97888s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -97779s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -97671s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -97562s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -97450s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -97343s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -97234s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -97124s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -97015s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -96906s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -96797s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -96687s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -96578s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -96468s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -96359s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -96250s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -96140s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -96031s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -95921s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99984s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99765s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99547s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99437s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99218s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99109s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -99000s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -98890s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -98781s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -98672s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -98562s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -98453s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -98343s >= -30000s
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe TID: 5208 Thread sleep time: -98234s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99874 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99765 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99654 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99531 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99421 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99312 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99203 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99093 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 98980 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 98859 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 98749 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 98640 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 98531 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 98403 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 98296 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 98186 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 98010 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 97895 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 97777 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 97671 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 97559 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 97452 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 97343 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 97234 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 97124 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 97015 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 96906 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 96796 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 96687 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 96577 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 96468 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 96359 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 96249 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 96140 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 96017 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 95906 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 95796 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 95678 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 95562 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 95446 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99890 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99781 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99672 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99547 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99437 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99328 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99218 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99109 Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Thread delayed: delay time: 99000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99890
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99780
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99671
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99561
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99453
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99343
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99220
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99094
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 98984
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 98874
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 98714
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 98216
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 98109
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 97998
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 97888
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 97779
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 97671
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 97562
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 97450
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 97343
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 97234
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 97124
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 97015
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 96906
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 96797
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 96687
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 96578
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 96468
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 96359
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 96250
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 96140
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 96031
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 95921
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99984
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99875
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99765
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99547
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99437
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99328
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99218
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99109
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 99000
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 98890
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 98781
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 98672
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 98562
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 98453
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 98343
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Thread delayed: delay time: 98234
Source: PROFORMA FATURA.exe, 00000009.00000002.4569708487.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, GvgUQlbRIXOe.exe, 0000000E.00000002.4569767009.0000000001016000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe"
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe"
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe" Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Memory written: C:\Users\user\Desktop\PROFORMA FATURA.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Memory written: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PROFORMA FATURA.exe" Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe" Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpAB7A.tmp" Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Process created: C:\Users\user\Desktop\PROFORMA FATURA.exe "C:\Users\user\Desktop\PROFORMA FATURA.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\user\AppData\Local\Temp\tmpBA20.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Process created: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe "C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Queries volume information: C:\Users\user\Desktop\PROFORMA FATURA.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Queries volume information: C:\Users\user\Desktop\PROFORMA FATURA.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Queries volume information: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Queries volume information: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PROFORMA FATURA.exe.4ab7388.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.4572147923.0000000002C48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4572408671.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.4572147923.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2219115296.0000000004BEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4572408671.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PROFORMA FATURA.exe PID: 2672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PROFORMA FATURA.exe PID: 5396, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: GvgUQlbRIXOe.exe PID: 6412, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: GvgUQlbRIXOe.exe PID: 6112, type: MEMORYSTR
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe File opened: C:\FTP Navigator\Ftplist.txt
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA FATURA.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\GvgUQlbRIXOe.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Yara detected Credential Stealer
Source: Yara match File source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PROFORMA FATURA.exe.4ab7388.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.4572147923.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2219115296.0000000004BEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4572408671.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PROFORMA FATURA.exe PID: 2672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PROFORMA FATURA.exe PID: 5396, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: GvgUQlbRIXOe.exe PID: 6412, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: GvgUQlbRIXOe.exe PID: 6112, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PROFORMA FATURA.exe.4ab7388.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PROFORMA FATURA.exe.4ab7388.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.GvgUQlbRIXOe.exe.4c27f00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PROFORMA FATURA.exe.4a7ab68.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.GvgUQlbRIXOe.exe.4beb6e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.4572147923.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.4572147923.0000000002C48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4572408671.00000000028CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4572408671.00000000028F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.4572147923.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2219115296.0000000004BEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4572408671.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2171035964.0000000004A7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PROFORMA FATURA.exe PID: 2672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PROFORMA FATURA.exe PID: 5396, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: GvgUQlbRIXOe.exe PID: 6412, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: GvgUQlbRIXOe.exe PID: 6112, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1525518 Sample: PROFORMA FATURA.exe Startdate: 04/10/2024 Architecture: WINDOWS Score: 100 46 zqamcx.com 2->46 50 Multi AV Scanner detection for domain / URL 2->50 52 Found malware configuration 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 12 other signatures 2->56 8 PROFORMA FATURA.exe 7 2->8         started        12 GvgUQlbRIXOe.exe 5 2->12         started        signatures3 process4 file5 38 C:\Users\user\AppData\...behaviorgraphvgUQlbRIXOe.exe, PE32 8->38 dropped 40 C:\Users\...behaviorgraphvgUQlbRIXOe.exe:Zone.Identifier, ASCII 8->40 dropped 42 C:\Users\user\AppData\Local\...\tmpAB7A.tmp, XML 8->42 dropped 44 C:\Users\user\...\PROFORMA FATURA.exe.log, ASCII 8->44 dropped 58 Adds a directory exclusion to Windows Defender 8->58 60 Injects a PE file into a foreign processes 8->60 14 PROFORMA FATURA.exe 2 8->14         started        18 powershell.exe 21 8->18         started        20 powershell.exe 23 8->20         started        22 schtasks.exe 1 8->22         started        62 Multi AV Scanner detection for dropped file 12->62 64 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->64 66 Machine Learning detection for dropped file 12->66 24 GvgUQlbRIXOe.exe 12->24         started        26 schtasks.exe 12->26         started        signatures6 process7 dnsIp8 48 zqamcx.com 78.110.166.82, 53953, 53956, 53958 UKSERVERS-ASUKDedicatedServersHostingandCo-Location United Kingdom 14->48 68 Installs a global keyboard hook 14->68 70 Loading BitLocker PowerShell Module 18->70 28 WmiPrvSE.exe 18->28         started        30 conhost.exe 18->30         started        32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        72 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 24->72 74 Tries to steal Mail credentials (via file / registry access) 24->74 76 Tries to harvest and steal ftp login credentials 24->76 78 Tries to harvest and steal browser information (history, passwords, etc) 24->78 36 conhost.exe 26->36         started        signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
78.110.166.82
 zqamcx.com United Kingdom
42831 UKSERVERS-ASUKDedicatedServersHostingandCo-Location true

Contacted Domains

Name IP Active
zqamcx.com 78.110.166.82 true