Windows Analysis Report
INQUIRY#46789-MAY_24_PRODUCTS.exe

AV Detection

Source: C:\ProgramData\Vexplo\Vexploio.exe	ReversingLabs: Detection: 23%
Source: C:\ProgramData\Vexplo\Vexploio.exe	Virustotal: Detection: 29%			Perma Link
Source: C:\Users\user\AppData\Roaming\bloue\Geofaglig.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Roaming\bloue\Geofaglig.exe	Virustotal: Detection: 29%			Perma Link

Source: INQUIRY#46789-MAY_24_PRODUCTS.exe	Virustotal: Detection: 29%			Perma Link
Source: INQUIRY#46789-MAY_24_PRODUCTS.exe	ReversingLabs: Detection: 23%

Source: Yara match	File source: 7.2.Vexploio.exe.43a3d40.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.183085374541.000000000438B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.178268031071.0000000004322000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.183085374541.0000000004397000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INQUIRY#46789-MAY_24_PRODUCTS.exe PID: 7960, type: MEMORYSTR

Cryptography

Source: C:\ProgramData\Vexplo\Vexploio.exe

Code function: 11_2_00404423 GetProcAddress,FreeLibrary,CryptUnprotectData,

11_2_00404423

Compliance

Source: INQUIRY#46789-MAY_24_PRODUCTS.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: INQUIRY#46789-MAY_24_PRODUCTS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 3_2_00405768 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		3_2_00405768
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 3_2_004062A3 FindFirstFileA,FindClose,		3_2_004062A3
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 3_2_004026FE FindFirstFileA,		3_2_004026FE
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 5_2_00405768 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		5_2_00405768
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 5_2_004026FE FindFirstFileA,		5_2_004026FE
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 5_2_004062A3 FindFirstFileA,FindClose,		5_2_004062A3
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 7_2_351E10F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,		7_2_351E10F1
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 7_2_351E6580 FindFirstFileExA,		7_2_351E6580
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_00405768 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		10_2_00405768
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_004026FE FindFirstFileA,		10_2_004026FE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_004062A3 FindFirstFileA,FindClose,		10_2_004062A3
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0040AE51 FindFirstFileW,FindNextFileW,		11_2_0040AE51

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File opened: C:\Users\user			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File opened: C:\Users\user\AppData			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File opened: C:\Users\user\AppData\Roaming			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows			Jump to behavior

Networking

Source: global traffic

TCP traffic: 192.168.11.20:50596 -> 64.188.26.202:1604

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	HTTP traffic detected: GET /TBdmQwySFr136.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 66.63.169.15Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /TBdmQwySFr136.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 66.63.169.15Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.169.15

Source: global traffic	HTTP traffic detected: GET /TBdmQwySFr136.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 66.63.169.15Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /TBdmQwySFr136.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 66.63.169.15Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Vexploio.exe

String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)

Source: global traffic

DNS traffic detected: DNS query: geoplugin.net

Source: INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000005.00000002.178268031071.00000000042D7000.00000004.00000020.00020000.00000000.sdmp, INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000005.00000002.178269277902.0000000006150000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://66.63.169.15/TBdmQwySFr136.bin
Source: svchost.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000003.00000000.177982856555.000000000040A000.00000008.00000001.01000000.00000004.sdmp, INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000003.00000002.178256809392.000000000040A000.00000004.00000001.01000000.00000004.sdmp, INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000005.00000000.178114881333.000000000040A000.00000008.00000001.01000000.00000004.sdmp, Vexploio.exe, 00000006.00000002.178534922602.000000000040A000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Vexploio.exe	String found in binary or memory: http://www.nirsoft.net/
Source: Vexploio.exe	String found in binary or memory: https://login.yahoo.com/config/login
Source: Vexploio.exe	String found in binary or memory: https://www.google.com/accounts/servicelogin

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

Code function: 3_2_00405205 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

3_2_00405205

Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,		11_2_0040987A
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,		11_2_004098E2

E-Banking Fraud

Source: Yara match	File source: 7.2.Vexploio.exe.43a3d40.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.183085374541.000000000438B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.178268031071.0000000004322000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.183085374541.0000000004397000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INQUIRY#46789-MAY_24_PRODUCTS.exe PID: 7960, type: MEMORYSTR

System Summary

Source: C:\ProgramData\Vexplo\Vexploio.exe

Process Stats: CPU usage > 6%

Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,		11_2_0040DD85
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00401806 NtdllDefWindowProc_W,		11_2_00401806
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_004018C0 NtdllDefWindowProc_W,		11_2_004018C0

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 3_2_0040320C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_0040320C
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 5_2_0040320C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_0040320C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_0040320C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		10_2_0040320C

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 3_2_00404A44		3_2_00404A44
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 3_2_00406F54		3_2_00406F54
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 3_2_0040677D		3_2_0040677D
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 3_2_6E131A98		3_2_6E131A98
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 5_2_00404A44		5_2_00404A44
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 5_2_00406F54		5_2_00406F54
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 5_2_0040677D		5_2_0040677D
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 6_2_6F271A98		6_2_6F271A98
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 7_2_351F7194		7_2_351F7194
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 7_2_351EB5C1		7_2_351EB5C1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_00404A44		10_2_00404A44
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_00406F54		10_2_00406F54
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_0040677D		10_2_0040677D
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00406E8F		11_2_00406E8F
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0044B040		11_2_0044B040
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0043610D		11_2_0043610D
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00447310		11_2_00447310
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0044A490		11_2_0044A490
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0040755A		11_2_0040755A
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0043C560		11_2_0043C560
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0044B610		11_2_0044B610
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0044D6C0		11_2_0044D6C0
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_004476F0		11_2_004476F0
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0044B870		11_2_0044B870
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0044081D		11_2_0044081D
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00414957		11_2_00414957
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_004079EE		11_2_004079EE
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00407AEB		11_2_00407AEB
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0044AA80		11_2_0044AA80
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00412AA9		11_2_00412AA9
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00404B74		11_2_00404B74
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00404B03		11_2_00404B03
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0044BBD8		11_2_0044BBD8
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00404BE5		11_2_00404BE5
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00404C76		11_2_00404C76
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00415CFE		11_2_00415CFE
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00416D72		11_2_00416D72
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00446D30		11_2_00446D30
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00446D8B		11_2_00446D8B

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: String function: 00402ACB appears 48 times
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: String function: 004169A7 appears 87 times
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: String function: 0044DB70 appears 41 times
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: String function: 004165FF appears 35 times
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: String function: 00416760 appears 69 times

Source: INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000003.00000002.178257041859.0000000000441000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameskrumpeleverne.exeD vs INQUIRY#46789-MAY_24_PRODUCTS.exe
Source: INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000005.00000002.178258123409.0000000000441000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameskrumpeleverne.exeD vs INQUIRY#46789-MAY_24_PRODUCTS.exe

Source: INQUIRY#46789-MAY_24_PRODUCTS.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000003.00000002.178256809392.000000000043E000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\physostome.Sln
Source: INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000003.00000002.178256809392.000000000040A000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: Callers\user\AppData\Local\Temp\nsd31E2.tmp\System.dllr2x80, i 0)i.r8eywort\Superingenuity\Gravedo.Flaetake\thoroughwort.retC:\Users\user\AppData\Local\Temp\nsd31E2.tmp\System.dllu\Bemangle\parsleywort\Superingenuity\physostome.SlnkeC:\Users\user\AppData\Local\Temp\nsd31E2.tmps\prayful\galeon.lnkC:\Users\user\AppData\Local\Temp\nsd31E2.tmp\System.dllrasterside.ini8
Source: INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000003.00000002.178256809392.000000000042C000.00000004.00000001.01000000.00000004.sdmp, Vexploio.exe, 00000006.00000002.178534922602.000000000042C000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: enuity\physostome.Sln
Source: INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000003.00000002.178257283888.00000000006AD000.00000004.00000020.00020000.00000000.sdmp, Vexploio.exe, 00000006.00000002.178535391112.00000000006A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Superingenuity\physostome.Sln
Source: INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000003.00000002.178256809392.000000000043E000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: q1207ser32::EnumWindows(i r2 ,i 0)i 46108672,*i 0, i 0)i.r4.r2x80, i 0)i.r8C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\physostome.Sln892user32::EnumWindows(i r2 ,i 0)i 46108672,*i 0, i 0)i.r4.r2x80, i 0)i.r8
Source: Vexploio.exe, 00000006.00000002.178534922602.000000000040A000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: Callers\user\AppData\Local\Temp\nsv9D4E.tmp\System.dllr2x80, i 0)i.r8eywort\Superingenuity\Gravedo.Flaetake\thoroughwort.retC:\Users\user\AppData\Local\Temp\nsv9D4E.tmp\System.dllu\Bemangle\parsleywort\Superingenuity\physostome.SlnkeC:\Users\user\AppData\Local\Temp\nsv9D4E.tmps\prayful\galeon.lnkC:\Users\user\AppData\Local\Temp\nsv9D4E.tmp\System.dllrasterside.ini8
Source: INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000003.00000002.178256809392.000000000040A000.00000004.00000001.01000000.00000004.sdmp, Vexploio.exe, 00000006.00000002.178534922602.000000000040A000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: u\Bemangle\parsleywort\Superingenuity\physostome.Sln
Source: INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000003.00000002.178257283888.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, Vexploio.exe, 00000006.00000002.178535391112.00000000006A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: physostome.Sln... 100%
Source: Vexploio.exe, 00000006.00000002.178534922602.000000000042C000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: Callers\user\AppData\Local\Temp\nsv9D4E.tmp\System.dllu\psychesthetic\anatinacea.freenuity\physostome.Slnke
Source: INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000003.00000002.178256809392.000000000042C000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: Callers\user\AppData\Local\Temp\nsd31E2.tmp\System.dllu\psychesthetic\anatinacea.freenuity\physostome.Slnke

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@79/30@1/3

Source: C:\ProgramData\Vexplo\Vexploio.exe

Code function: 11_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,??3@YAXPAX@Z,

11_2_004182CE

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 3_2_0040320C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_0040320C
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 5_2_0040320C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_0040320C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_0040320C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		10_2_0040320C

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

Code function: 3_2_004044D1 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

3_2_004044D1

Source: C:\ProgramData\Vexplo\Vexploio.exe

Code function: 11_2_00413D4C CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,memset,GetModuleHandleW,GetProcAddress,CloseHandle,??3@YAXPAX@Z,Process32NextW,CloseHandle,

11_2_00413D4C

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

Code function: 3_2_004020D1 CoCreateInstance,MultiByteToWideChar,

3_2_004020D1

Source: C:\ProgramData\Vexplo\Vexploio.exe

Code function: 11_2_0040B58D GetModuleHandleW,FindResourceW,LoadResource,SizeofResource,LockResource,memcpy,

11_2_0040B58D

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle

Jump to behavior

Source: C:\ProgramData\Vexplo\Vexploio.exe

Mutant created: \Sessions\1\BaseNamedObjects\Rmc-RXKA3P

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

File created: C:\Users\user\AppData\Local\Temp\nsp2917.tmp

Jump to behavior

Source: INQUIRY#46789-MAY_24_PRODUCTS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\ProgramData\Vexplo\Vexploio.exe

System information queried: HandleInformation

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Vexploio.exe	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: Vexploio.exe	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: Vexploio.exe	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: Vexploio.exe	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: Vexploio.exe	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: Vexploio.exe	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: INQUIRY#46789-MAY_24_PRODUCTS.exe	Virustotal: Detection: 29%
Source: INQUIRY#46789-MAY_24_PRODUCTS.exe	ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

File read: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe "C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe"
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process created: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe "C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe"
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe "C:\ProgramData\Vexplo\Vexploio.exe"
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe "C:\ProgramData\Vexplo\Vexploio.exe"
Source: unknown	Process created: C:\ProgramData\Vexplo\Vexploio.exe "C:\ProgramData\Vexplo\Vexploio.exe"
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe /stext "C:\Users\user\AppData\Local\Temp\natcvvveorcxxyqjtvtsuftguqn"
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe /stext "C:\Users\user\AppData\Local\Temp\ycymwnogcaukzemncgolxsopvfffsfc"
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe /stext "C:\Users\user\AppData\Local\Temp\ixefxgzzpimpkkartranixjgdmpglqsibv"
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process created: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe "C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe"			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe "C:\ProgramData\Vexplo\Vexploio.exe"			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe "C:\ProgramData\Vexplo\Vexploio.exe"			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe /stext "C:\Users\user\AppData\Local\Temp\natcvvveorcxxyqjtvtsuftguqn"			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe /stext "C:\Users\user\AppData\Local\Temp\ycymwnogcaukzemncgolxsopvfffsfc"			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe /stext "C:\Users\user\AppData\Local\Temp\ixefxgzzpimpkkartranixjgdmpglqsibv"			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: oleacc.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: shfolder.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: riched20.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: usp10.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: msls31.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: textshaping.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: rstrtmgr.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: edputil.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: windows.staterepositoryps.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: appresolver.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: bcp47langs.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: slc.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: sppc.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: onecoreuapcommonproxystub.dll			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: oleacc.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: version.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: shfolder.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: riched20.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: usp10.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: msls31.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: textshaping.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: rstrtmgr.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: oleacc.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: version.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: shfolder.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: riched20.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: usp10.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: msls31.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: textshaping.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: version.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: edgegdi.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: pstorec.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: vaultcli.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: dpapi.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: edgegdi.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: pstorec.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: edgegdi.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oleacc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: shfolder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dwmapi.dll

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

File written: C:\Users\user\AppData\Local\Temp\tmc.ini

Jump to behavior

Source: C:\ProgramData\Vexplo\Vexploio.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK
Source: C:\Windows\SysWOW64\svchost.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\ProgramData\Vexplo\Vexploio.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

Source: INQUIRY#46789-MAY_24_PRODUCTS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: C:\ProgramData\Vexplo\Vexploio.exe	Unpacked PE file: 11.2.Vexploio.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\ProgramData\Vexplo\Vexploio.exe	Unpacked PE file: 12.2.Vexploio.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\ProgramData\Vexplo\Vexploio.exe	Unpacked PE file: 13.2.Vexploio.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Source: Yara match	File source: Process Memory Space: INQUIRY#46789-MAY_24_PRODUCTS.exe PID: 6064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Vexploio.exe PID: 548, type: MEMORYSTR
Source: Yara match	File source: 00000006.00000002.178537015512.0000000005239000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.178258681536.0000000005139000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

Code function: 3_2_6E131A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

3_2_6E131A98

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 3_2_6E132F20 push eax; ret		3_2_6E132F4E
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 6_2_6F272F20 push eax; ret		6_2_6F272F4E
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 7_2_351E2806 push ecx; ret		7_2_351E2819
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0044693D push ecx; ret		11_2_0044694D
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0044DB70 push eax; ret		11_2_0044DB84
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0044DB70 push eax; ret		11_2_0044DBAC
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_00451D54 push eax; ret		11_2_00451D61

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Local\Temp\nsd31E2.tmp\System.dll			Jump to dropped file
Source: C:\ProgramData\Vexplo\Vexploio.exe	File created: C:\Users\user\AppData\Local\Temp\nsv9D4E.tmp\System.dll			Jump to dropped file
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\ProgramData\Vexplo\Vexploio.exe			Jump to dropped file
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\bloue\Geofaglig.exe			Jump to dropped file

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

File created: C:\ProgramData\Vexplo\Vexploio.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-RXKA3P

Jump to behavior

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-RXKA3P			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce grewm			Jump to behavior

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\Gravedo.Fla			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\Krapyls172.syg			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\physostome.Sln			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\Mattias.nap			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\Sestertius.djv			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\Slidsomt.bra			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\afkontrollere.urb			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\miljankens			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\miljankens\afslres.ten			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\miljankens\discomposed.non			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\miljankens\dred.jpg			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\miljankens\gametophoric.txt			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\miljankens\isocola.sol			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\miljankens\malningerne.bog			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\miljankens\monodomous.kal			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\miljankens\ornery.cem			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\miljankens\podagrist.ref			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\miljankens\Betake			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\miljankens\Betake\soliloquium.bor			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Superingenuity\miljankens\Betake\thoroughwort.ret			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Spore			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Bemangle\parsleywort\Spore\torminal.wes			Jump to behavior

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce grewm			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce grewm			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce grewm			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce grewm			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-RXKA3P			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-RXKA3P			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-RXKA3P			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-RXKA3P			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\ProgramData\Vexplo\Vexploio.exe

Code function: 11_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,

11_2_0040DD85

Source: C:\ProgramData\Vexplo\Vexploio.exe	Window / User API: threadDelayed 4770			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Window / User API: threadDelayed 1371			Jump to behavior

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd31E2.tmp\System.dll			Jump to dropped file
Source: C:\ProgramData\Vexplo\Vexploio.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv9D4E.tmp\System.dll			Jump to dropped file

Source: C:\ProgramData\Vexplo\Vexploio.exe	API coverage: 5.3 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 9.0 %

Source: C:\ProgramData\Vexplo\Vexploio.exe TID: 7388	Thread sleep count: 99 > 30			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe TID: 7388	Thread sleep time: -297000s >= -30000s			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe TID: 8040	Thread sleep count: 50 > 30			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe TID: 8040	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe TID: 8040	Thread sleep count: 4770 > 30			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe TID: 8040	Thread sleep time: -14310000s >= -30000s			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe TID: 7388	Thread sleep count: 1371 > 30			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe TID: 7388	Thread sleep time: -4113000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 3_2_00405768 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		3_2_00405768
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 3_2_004062A3 FindFirstFileA,FindClose,		3_2_004062A3
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 3_2_004026FE FindFirstFileA,		3_2_004026FE
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 5_2_00405768 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		5_2_00405768
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 5_2_004026FE FindFirstFileA,		5_2_004026FE
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Code function: 5_2_004062A3 FindFirstFileA,FindClose,		5_2_004062A3
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 7_2_351E10F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,		7_2_351E10F1
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 7_2_351E6580 FindFirstFileExA,		7_2_351E6580
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_00405768 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		10_2_00405768
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_004026FE FindFirstFileA,		10_2_004026FE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_004062A3 FindFirstFileA,FindClose,		10_2_004062A3
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 11_2_0040AE51 FindFirstFileW,FindNextFileW,		11_2_0040AE51

Source: C:\ProgramData\Vexplo\Vexploio.exe

Code function: 11_2_00418981 memset,GetSystemInfo,

11_2_00418981

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File opened: C:\Users\user			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File opened: C:\Users\user\AppData			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File opened: C:\Users\user\AppData\Roaming			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows			Jump to behavior

Source: INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000005.00000002.178268031071.000000000430B000.00000004.00000020.00020000.00000000.sdmp, INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000005.00000002.178268031071.0000000004337000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: INQUIRY#46789-MAY_24_PRODUCTS.exe, 00000005.00000002.178268031071.0000000004337000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node

Source: C:\ProgramData\Vexplo\Vexploio.exe

Process information queried: ProcessInformation

Anti Debugging

Source: C:\ProgramData\Vexplo\Vexploio.exe

Code function: 7_2_351E60E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_351E60E2

Source: C:\ProgramData\Vexplo\Vexploio.exe

Code function: 11_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,

11_2_0040DD85

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

Code function: 3_2_6E131A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

3_2_6E131A98

Source: C:\ProgramData\Vexplo\Vexploio.exe

Code function: 7_2_351E4AB4 mov eax, dword ptr fs:[00000030h]

7_2_351E4AB4

Source: C:\ProgramData\Vexplo\Vexploio.exe

Code function: 7_2_351E724E GetProcessHeap,

7_2_351E724E

Source: C:\ProgramData\Vexplo\Vexploio.exe

Process token adjusted: Debug

Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 7_2_351E60E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		7_2_351E60E2
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 7_2_351E2B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		7_2_351E2B1C
Source: C:\ProgramData\Vexplo\Vexploio.exe	Code function: 7_2_351E2639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		7_2_351E2639

HIPS / PFW / Operating System Protection Evasion

Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\ProgramData\Vexplo\Vexploio.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\ProgramData\Vexplo\Vexploio.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\ProgramData\Vexplo\Vexploio.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: unknown protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: unknown protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: unknown protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: unknown protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: unknown protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: unknown protection: execute and read and write			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section loaded: NULL target: unknown protection: execute and read and write			Jump to behavior

Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: unknown base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: unknown base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: unknown base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: unknown base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: unknown base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: unknown base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: unknown base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: unknown base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: unknown base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: unknown base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: unknown base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: unknown base address: 400000			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Section unmapped: unknown base address: 400000			Jump to behavior

Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2ED9008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 673008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2B53008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3089008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 225008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2F0E008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2B02008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2DF3008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2EBC008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2C1008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3193008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2AD2008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2E4C008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2B8C008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 31A3008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 31C1008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2A38008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 660008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2E93008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2C1F008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2FA5008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2AC3008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 36B008			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2CDF008			Jump to behavior

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process created: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe "C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe"			Jump to behavior
Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe "C:\ProgramData\Vexplo\Vexploio.exe"			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe "C:\ProgramData\Vexplo\Vexploio.exe"			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe /stext "C:\Users\user\AppData\Local\Temp\natcvvveorcxxyqjtvtsuftguqn"			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe /stext "C:\Users\user\AppData\Local\Temp\ycymwnogcaukzemncgolxsopvfffsfc"			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe /stext "C:\Users\user\AppData\Local\Temp\ixefxgzzpimpkkartranixjgdmpglqsibv"			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Process created: unknown unknown			Jump to behavior

Language, Device and Operating System Detection

Source: C:\ProgramData\Vexplo\Vexploio.exe

Code function: 7_2_351E2933 cpuid

7_2_351E2933

Source: C:\ProgramData\Vexplo\Vexploio.exe

Queries volume information: C:\ VolumeInformation

Source: C:\ProgramData\Vexplo\Vexploio.exe

Code function: 7_2_351E2264 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

7_2_351E2264

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe

Code function: 3_2_0040320C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

3_2_0040320C

Source: C:\ProgramData\Vexplo\Vexploio.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 7.2.Vexploio.exe.43a3d40.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.183085374541.000000000438B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.178268031071.0000000004322000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.183085374541.0000000004397000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INQUIRY#46789-MAY_24_PRODUCTS.exe PID: 7960, type: MEMORYSTR

Source: C:\ProgramData\Vexplo\Vexploio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\places.sqlite
Source: C:\ProgramData\Vexplo\Vexploio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\key4.db
Source: C:\ProgramData\Vexplo\Vexploio.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\ProgramData\Vexplo\Vexploio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\ProgramData\Vexplo\Vexploio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\ProgramData\Vexplo\Vexploio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Source: C:\ProgramData\Vexplo\Vexploio.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\ProgramData\Vexplo\Vexploio.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt
Source: C:\ProgramData\Vexplo\Vexploio.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt
Source: C:\ProgramData\Vexplo\Vexploio.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\ProgramData\Vexplo\Vexploio.exe	Key opened: HKEY_CURRENT_USER\Software\Paltalk

Source: C:\ProgramData\Vexplo\Vexploio.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\ProgramData\Vexplo\Vexploio.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\ProgramData\Vexplo\Vexploio.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\ProgramData\Vexplo\Vexploio.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail

Remote Access Functionality

Source: C:\Users\user\Desktop\INQUIRY#46789-MAY_24_PRODUCTS.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-RXKA3P			Jump to behavior
Source: C:\ProgramData\Vexplo\Vexploio.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-RXKA3P			Jump to behavior

Source: Yara match	File source: 7.2.Vexploio.exe.43a3d40.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.183085374541.000000000438B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.178268031071.0000000004322000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.183085374541.0000000004397000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INQUIRY#46789-MAY_24_PRODUCTS.exe PID: 7960, type: MEMORYSTR