Windows Analysis Report
MT103-7543324334.exe

AI detected suspicious sample

Source: Yara match	File source: 23.2.QQ.exe.3c31ae8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3f41930.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MT103-7543324334.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3e30ab8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.QQ.exe.42c3d90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3d5a1b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3bb8ec8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MT103-7543324334.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3ec8d10.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3e112b0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3c31ae8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3f41930.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3e30ab8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.QQ.exe.42c3d90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3db7e98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3d5a1b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3e112b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3db7e98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3ec8d10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3bb8ec8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.1548659538.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3700500743.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1465639102.0000000001478000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1580860250.0000000003D5A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1274790008.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1385310551.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1301342473.0000000003EC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1496790759.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3707534940.0000000002B0F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1254234461.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1418482659.00000000042BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1580860250.0000000003E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MT103-7543324334.exe PID: 3696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MT103-7543324334.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 2404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 5628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 7880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 8064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 8128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 6048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 4640, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: MT103-7543324334.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

4_2_00433837

Source: MT103-7543324334.exe, 00000001.00000002.1274790008.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_2e38b30b-9

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 23.2.QQ.exe.3c31ae8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3f41930.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MT103-7543324334.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3e30ab8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.QQ.exe.42c3d90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3d5a1b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3bb8ec8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MT103-7543324334.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3ec8d10.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3e112b0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3c31ae8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3f41930.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3e30ab8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.QQ.exe.42c3d90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3db7e98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3d5a1b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3e112b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3db7e98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3ec8d10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3bb8ec8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1580860250.0000000003D5A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1274790008.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1301342473.0000000003EC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1496790759.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1418482659.00000000042BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1580860250.0000000003E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MT103-7543324334.exe PID: 3696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MT103-7543324334.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 2404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 8064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 6048, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_004074FD _wcslen,CoGetObject,

4_2_004074FD

Source: MT103-7543324334.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: MT103-7543324334.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409253
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	4_2_0041C291
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	4_2_0040C34D
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409665
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0044E879 FindFirstFileExA,	4_2_0044E879
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	4_2_0040880C
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0040783C FindFirstFileW,FindNextFileW,	4_2_0040783C
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	4_2_00419AF5
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	4_2_0040BB30
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	4_2_0040BD37

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

4_2_00407C97

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4x nop then jmp 07121F22h	1_2_07122070
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4x nop then jmp 07121F22h	1_2_0712232C
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 4x nop then jmp 07951F22h	6_2_07952070
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 4x nop then jmp 07951F22h	6_2_0795232C
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 4x nop then jmp 079A17AAh	20_2_079A18F8
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 4x nop then jmp 079A17AAh	20_2_079A1BB4
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 4x nop then jmp 06EA17AAh	23_2_06EA18F8
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 4x nop then jmp 06EA17AAh	23_2_06EA1BB4
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 4x nop then jmp 073F17AAh	25_2_073F18F8
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 4x nop then jmp 073F17AAh	25_2_073F1BB4

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: ollar23.duckdns.org

Uses dynamic DNS services

Source: unknown	DNS query: name: milliondollar23.duckdns.org
Source: unknown	DNS query: name: milliondollar23backup.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.7:49703 -> 138.201.150.244:3984

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

4_2_0041B380

Source: global traffic	DNS traffic detected: DNS query: milliondollar23.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: milliondollar23backup.duckdns.org

Source: MT103-7543324334.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: MT103-7543324334.exe, 00000001.00000002.1274790008.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, MT103-7543324334.exe, 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, QQ.exe, 00000006.00000002.1301342473.0000000003EC8000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000014.00000002.1418482659.00000000042BA000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000017.00000002.1496790759.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000019.00000002.1580860250.0000000003D5A000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000019.00000002.1580860250.0000000003E11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: MT103-7543324334.exe, 00000001.00000002.1271398062.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000006.00000002.1296460638.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000014.00000002.1408801876.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000017.00000002.1488168688.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000019.00000002.1569302206.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MT103-7543324334.exe, QQ.exe.4.dr	String found in binary or memory: http://tempuri.org/AukcionDBDataSet.xsd

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000

4_2_0040A2B8

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\QQ\QQ.exe

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

4_2_0040B70E

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_004168C1

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

4_2_0040B70E

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

4_2_0040A3E0

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 23.2.QQ.exe.3c31ae8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3f41930.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MT103-7543324334.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3e30ab8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.QQ.exe.42c3d90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3d5a1b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3bb8ec8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MT103-7543324334.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3ec8d10.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3e112b0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3c31ae8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3f41930.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3e30ab8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.QQ.exe.42c3d90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3db7e98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3d5a1b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3e112b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3db7e98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3ec8d10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3bb8ec8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.1548659538.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3700500743.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1465639102.0000000001478000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1580860250.0000000003D5A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1274790008.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1385310551.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1301342473.0000000003EC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1496790759.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3707534940.0000000002B0F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1254234461.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1418482659.00000000042BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1580860250.0000000003E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MT103-7543324334.exe PID: 3696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MT103-7543324334.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 2404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 5628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 7880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 8064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 8128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 6048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 4640, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_0041C9E2 SystemParametersInfoW,

4_2_0041C9E2

System Summary

Malicious sample detected (through community Yara rule)

Source: 23.2.QQ.exe.3c31ae8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 23.2.QQ.exe.3c31ae8.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 23.2.QQ.exe.3c31ae8.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.QQ.exe.3f41930.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.QQ.exe.3f41930.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.2.QQ.exe.3f41930.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.MT103-7543324334.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.MT103-7543324334.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.MT103-7543324334.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.MT103-7543324334.exe.3e30ab8.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.MT103-7543324334.exe.3e30ab8.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.2.MT103-7543324334.exe.3e30ab8.4.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 20.2.QQ.exe.42c3d90.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 20.2.QQ.exe.42c3d90.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 20.2.QQ.exe.42c3d90.4.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 25.2.QQ.exe.3d5a1b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.2.QQ.exe.3d5a1b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 23.2.QQ.exe.3bb8ec8.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 23.2.QQ.exe.3bb8ec8.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 23.2.QQ.exe.3bb8ec8.4.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.MT103-7543324334.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.MT103-7543324334.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.MT103-7543324334.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.QQ.exe.3ec8d10.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.QQ.exe.3ec8d10.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.2.QQ.exe.3e112b0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.QQ.exe.3ec8d10.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 25.2.QQ.exe.3e112b0.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.2.QQ.exe.3e112b0.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 23.2.QQ.exe.3c31ae8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 23.2.QQ.exe.3c31ae8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.QQ.exe.3f41930.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.QQ.exe.3f41930.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.MT103-7543324334.exe.3e30ab8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.MT103-7543324334.exe.3e30ab8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 20.2.QQ.exe.42c3d90.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 20.2.QQ.exe.42c3d90.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.MT103-7543324334.exe.3db7e98.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.MT103-7543324334.exe.3db7e98.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.2.MT103-7543324334.exe.3db7e98.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 25.2.QQ.exe.3d5a1b0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.2.QQ.exe.3d5a1b0.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.2.QQ.exe.3d5a1b0.4.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 25.2.QQ.exe.3e112b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.2.QQ.exe.3e112b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.MT103-7543324334.exe.3db7e98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.MT103-7543324334.exe.3db7e98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.QQ.exe.3ec8d10.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.QQ.exe.3ec8d10.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 23.2.QQ.exe.3bb8ec8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 23.2.QQ.exe.3bb8ec8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000019.00000002.1580860250.0000000003D5A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000001.00000002.1274790008.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000017.00000002.1496790759.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000006.00000002.1301342473.0000000003EC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000014.00000002.1418482659.00000000042BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000019.00000002.1580860250.0000000003E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: MT103-7543324334.exe PID: 3696, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: MT103-7543324334.exe PID: 6768, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: QQ.exe PID: 2404, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: QQ.exe PID: 7812, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: QQ.exe PID: 8064, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: QQ.exe PID: 6048, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

.NET source code contains very large array initializations

Source: MT103-7543324334.exe, TableAdapter.cs

Large array initialization: : array initializer size 864054

Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

4_2_004167B4

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_0140E634	1_2_0140E634
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_07123488	1_2_07123488
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_07121D19	1_2_07121D19
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_071257E8	1_2_071257E8
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_07121D19	1_2_07121D19
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_07C7E768	1_2_07C7E768
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_07C7F2B0	1_2_07C7F2B0
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_07C77B67	1_2_07C77B67
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_07C77B78	1_2_07C77B78
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_07C7DA78	1_2_07C7DA78
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_07C7E9D8	1_2_07C7E9D8
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_08FABE21	1_2_08FABE21
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_08FA0040	1_2_08FA0040
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_08FAE9D1	1_2_08FAE9D1
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_08FAEE38	1_2_08FAEE38
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_08FAEE28	1_2_08FAEE28
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_08FAF270	1_2_08FAF270
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_08FAF260	1_2_08FAF260
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0043E0CC	4_2_0043E0CC
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0041F0FA	4_2_0041F0FA
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00454159	4_2_00454159
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00438168	4_2_00438168
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_004461F0	4_2_004461F0
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0043E2FB	4_2_0043E2FB
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0045332B	4_2_0045332B
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0042739D	4_2_0042739D
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_004374E6	4_2_004374E6
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0043E558	4_2_0043E558
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00438770	4_2_00438770
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_004378FE	4_2_004378FE
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00433946	4_2_00433946
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0044D9C9	4_2_0044D9C9
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00427A46	4_2_00427A46
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0041DB62	4_2_0041DB62
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00427BAF	4_2_00427BAF
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00437D33	4_2_00437D33
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00435E5E	4_2_00435E5E
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00426E0E	4_2_00426E0E
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0043DE9D	4_2_0043DE9D
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00413FCA	4_2_00413FCA
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00436FEA	4_2_00436FEA
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_0137E634	6_2_0137E634
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_0788E768	6_2_0788E768
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_0788F2B0	6_2_0788F2B0
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_07887B67	6_2_07887B67
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_07887B78	6_2_07887B78
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_0788DA78	6_2_0788DA78
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_0788E9D8	6_2_0788E9D8
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_07951D19	6_2_07951D19
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_07951490	6_2_07951490
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_079557E8	6_2_079557E8
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_07951D19	6_2_07951D19
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_090BBE21	6_2_090BBE21
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_090B0040	6_2_090B0040
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_090BE9D1	6_2_090BE9D1
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_090BEE28	6_2_090BEE28
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_090BEE38	6_2_090BEE38
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_090BF260	6_2_090BF260
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_090BF270	6_2_090BF270
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_0316E634	20_2_0316E634
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_078EE768	20_2_078EE768
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_078EF2B0	20_2_078EF2B0
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_078E7B67	20_2_078E7B67
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_078E7B78	20_2_078E7B78
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_078EDA78	20_2_078EDA78
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_078EE9D8	20_2_078EE9D8
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079A15A9	20_2_079A15A9
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079A3110	20_2_079A3110
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079A15A9	20_2_079A15A9
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079A5470	20_2_079A5470
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079B0040	20_2_079B0040
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079BBE21	20_2_079BBE21
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079BF270	20_2_079BF270
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079BF260	20_2_079BF260
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079BEE38	20_2_079BEE38
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079BEE28	20_2_079BEE28
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079BE9C0	20_2_079BE9C0
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_00E7E634	23_2_00E7E634
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_06EA15A9	23_2_06EA15A9
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_06EA3110	23_2_06EA3110
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_06EA5470	23_2_06EA5470
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_06EA15A9	23_2_06EA15A9
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_06EB0040	23_2_06EB0040
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_06EBBE21	23_2_06EBBE21
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_06EBF260	23_2_06EBF260
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_06EBF270	23_2_06EBF270
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_06EBEE28	23_2_06EBEE28
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_06EBEE38	23_2_06EBEE38
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_07ACE768	23_2_07ACE768
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_07ACF2B0	23_2_07ACF2B0
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_07AC7B67	23_2_07AC7B67
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_07AC7B78	23_2_07AC7B78
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_07ACDA78	23_2_07ACDA78
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 23_2_07ACE9D8	23_2_07ACE9D8
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_010EE634	25_2_010EE634
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_05240690	25_2_05240690
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_05240681	25_2_05240681
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_0733E768	25_2_0733E768
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_0733F2B0	25_2_0733F2B0
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_07337B78	25_2_07337B78
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_07337B67	25_2_07337B67
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_0733DA78	25_2_0733DA78
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_0733E9D8	25_2_0733E9D8
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_073F27B8	25_2_073F27B8
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_073F15A9	25_2_073F15A9
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_073F15A9	25_2_073F15A9
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_073F5530	25_2_073F5530
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_07400040	25_2_07400040
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_0740BE21	25_2_0740BE21
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_0740F260	25_2_0740F260
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_0740F270	25_2_0740F270
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_0740EE28	25_2_0740EE28
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_0740EE38	25_2_0740EE38
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 25_2_0740E9C0	25_2_0740E9C0

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: String function: 00434E10 appears 54 times
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: String function: 00434770 appears 41 times
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: String function: 00401E65 appears 34 times

Source: MT103-7543324334.exe, 00000001.00000002.1271398062.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs MT103-7543324334.exe
Source: MT103-7543324334.exe, 00000001.00000000.1231934460.0000000000A68000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesizf.exe" vs MT103-7543324334.exe
Source: MT103-7543324334.exe, 00000001.00000002.1289869609.0000000008FB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs MT103-7543324334.exe
Source: MT103-7543324334.exe, 00000001.00000002.1289681837.0000000008F00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs MT103-7543324334.exe
Source: MT103-7543324334.exe, 00000001.00000002.1269594813.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs MT103-7543324334.exe
Source: MT103-7543324334.exe, 00000004.00000002.1254234461.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesizf.exe" vs MT103-7543324334.exe
Source: MT103-7543324334.exe	Binary or memory string: OriginalFilenamesizf.exe" vs MT103-7543324334.exe

Source: MT103-7543324334.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 23.2.QQ.exe.3c31ae8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 23.2.QQ.exe.3c31ae8.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 23.2.QQ.exe.3c31ae8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.QQ.exe.3f41930.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.QQ.exe.3f41930.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.2.QQ.exe.3f41930.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.MT103-7543324334.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.MT103-7543324334.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.MT103-7543324334.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.MT103-7543324334.exe.3e30ab8.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.MT103-7543324334.exe.3e30ab8.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.MT103-7543324334.exe.3e30ab8.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 20.2.QQ.exe.42c3d90.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 20.2.QQ.exe.42c3d90.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 20.2.QQ.exe.42c3d90.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 25.2.QQ.exe.3d5a1b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.2.QQ.exe.3d5a1b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 23.2.QQ.exe.3bb8ec8.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 23.2.QQ.exe.3bb8ec8.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 23.2.QQ.exe.3bb8ec8.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.MT103-7543324334.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.MT103-7543324334.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.MT103-7543324334.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.QQ.exe.3ec8d10.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.QQ.exe.3ec8d10.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.2.QQ.exe.3e112b0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.QQ.exe.3ec8d10.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 25.2.QQ.exe.3e112b0.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.2.QQ.exe.3e112b0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 23.2.QQ.exe.3c31ae8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 23.2.QQ.exe.3c31ae8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.QQ.exe.3f41930.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.QQ.exe.3f41930.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.MT103-7543324334.exe.3e30ab8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.MT103-7543324334.exe.3e30ab8.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 20.2.QQ.exe.42c3d90.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 20.2.QQ.exe.42c3d90.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.MT103-7543324334.exe.3db7e98.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.MT103-7543324334.exe.3db7e98.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.MT103-7543324334.exe.3db7e98.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 25.2.QQ.exe.3d5a1b0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.2.QQ.exe.3d5a1b0.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.2.QQ.exe.3d5a1b0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 25.2.QQ.exe.3e112b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.2.QQ.exe.3e112b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.MT103-7543324334.exe.3db7e98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.MT103-7543324334.exe.3db7e98.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.QQ.exe.3ec8d10.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.QQ.exe.3ec8d10.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 23.2.QQ.exe.3bb8ec8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 23.2.QQ.exe.3bb8ec8.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000019.00000002.1580860250.0000000003D5A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000001.00000002.1274790008.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000017.00000002.1496790759.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000006.00000002.1301342473.0000000003EC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000014.00000002.1418482659.00000000042BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000019.00000002.1580860250.0000000003E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: MT103-7543324334.exe PID: 3696, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: MT103-7543324334.exe PID: 6768, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: QQ.exe PID: 2404, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: QQ.exe PID: 7812, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: QQ.exe PID: 8064, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: QQ.exe PID: 6048, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	Security API names: _0020.SetAccessControl
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	Security API names: _0020.AddAccessRule
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	Security API names: _0020.SetAccessControl
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	Security API names: _0020.AddAccessRule
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	Security API names: _0020.SetAccessControl
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	Security API names: _0020.AddAccessRule
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, qTt1jD6uLAiQcCaLfX.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, qTt1jD6uLAiQcCaLfX.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, qTt1jD6uLAiQcCaLfX.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@25/14@27/1

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

4_2_00417952

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

4_2_0040F474

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

4_2_0041B4A8

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

4_2_0041AA4A

Source: C:\Users\user\Desktop\MT103-7543324334.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MT103-7543324334.exe.log

Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Mutant created: \Sessions\1\BaseNamedObjects\RIgZWhx
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-R6CJUW
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5064:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hgiwqtjo.usc.ps1

Source: MT103-7543324334.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: MT103-7543324334.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\MT103-7543324334.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: MT103-7543324334.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\MT103-7543324334.exe

File read: C:\Users\user\Desktop\MT103-7543324334.exe

Source: unknown	Process created: C:\Users\user\Desktop\MT103-7543324334.exe "C:\Users\user\Desktop\MT103-7543324334.exe"
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MT103-7543324334.exe"
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process created: C:\Users\user\Desktop\MT103-7543324334.exe "C:\Users\user\Desktop\MT103-7543324334.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MT103-7543324334.exe"	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process created: C:\Users\user\Desktop\MT103-7543324334.exe "C:\Users\user\Desktop\MT103-7543324334.exe"	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\QQ\QQ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\MT103-7543324334.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Source: MT103-7543324334.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: MT103-7543324334.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: MT103-7543324334.exe

Static file information: File size 1601536 > 1048576

Source: MT103-7543324334.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x185200

Source: MT103-7543324334.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	.Net Code: VMJ7OpDTZf System.Reflection.Assembly.Load(byte[])
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	.Net Code: VMJ7OpDTZf System.Reflection.Assembly.Load(byte[])
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	.Net Code: VMJ7OpDTZf System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

4_2_0041CB50

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_079247BC push 8B03D598h; iretd	1_2_079247C1
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_0792530B push 8B03D597h; iretd	1_2_07925310
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_07925B51 push 8B03D597h; iretd	1_2_07925B56
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_0792450B push 8B03D597h; iretd	1_2_07924510
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_079260EA push 8B03D597h; iretd	1_2_079260EF
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 1_2_08FA429B push ebx; ret	1_2_08FA42DA
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00457106 push ecx; ret	4_2_00457119
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0045B11A push esp; ret	4_2_0045B141
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0045E54D push esi; ret	4_2_0045E556
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00457A28 push eax; ret	4_2_00457A46
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00434E56 push ecx; ret	4_2_00434E69
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_075347BC push 8B03E698h; iretd	6_2_075347C1
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_0753450B push 8B03E697h; iretd	6_2_07534510
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_0753530B push 8B03E697h; iretd	6_2_07535310
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_075360EA push 8B03E697h; iretd	6_2_075360EF
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_07535B51 push 8B03E697h; iretd	6_2_07535B56
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 6_2_090B420D push ebx; ret	6_2_090B42DA
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_0589A370 push esp; ret	20_2_0589A371
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_0589B9D8 push eax; mov dword ptr [esp], ecx	20_2_0589B9DC
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_075847BC push 8B041E98h; iretd	20_2_075847C1
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_0758450B push 8B041E97h; iretd	20_2_07584510
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_07585B51 push 8B041E97h; iretd	20_2_07585B56
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_0758530B push 8B041E97h; iretd	20_2_07585310
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_075860EA push 8B041E97h; iretd	20_2_075860EF
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079A2E12 push 0000005Dh; ret	20_2_079A2E41
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079B7485 push edi; iretd	20_2_079B7486
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079B74D6 push edi; iretd	20_2_079B74D8
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079BAA30 push ds; iretd	20_2_079BAA31
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079BA993 push ds; iretd	20_2_079BA999
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079BA97C push ds; iretd	20_2_079BA982
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Code function: 20_2_079BA968 push ds; iretd	20_2_079BA96E

Source: MT103-7543324334.exe

Static PE information: section name: .text entropy: 7.374820869707466

Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, KiPOYpdaIIK4pENo3x.cs	High entropy of concatenated method names: 'd9T9BtR4XS', 'cWK9yXaDLw', 'B4m9E1JUZX', 'a7lEQHlqqp', 'dLFEzpr4MV', 'lJy9ZKpE18', 'jqh92LVRS9', 'Gut9ILMmNi', 'fKr9gJES5F', 'G8n97lo0Mb'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, NEwbaxH4bE424CAeU6.cs	High entropy of concatenated method names: 'yT3Enqbmsj', 'qKmE07JSYX', 'QXTEv0v6WI', 'ofnE95R9hp', 'AnaE88T4mA', 'GECvix0qmC', 'atVvhrUngt', 'nYavUjO7f5', 'Crfv4PeAC1', 'KnKvPfvWPx'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, ni5L2byy9tC0iqpQ7q.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'zyWIPbWQay', 'u3wIQ79aQA', 'pjyIzIcvSk', 'CVKgZWXZhK', 'xfOg21C4Fd', 'wbygIZJRiO', 'LUIggPdqJ7', 'g9Au7TzWaEG2csZ5aH'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, AKRqW57fOOyNUQDal0.cs	High entropy of concatenated method names: 'XBV29Tt1jD', 'ELA28iQcCa', 'PCE2ToagwN', 'Y4V2kSiEOi', 'pUh2ar5YEw', 'Aax2G4bE42', 'PFD9WpYnr3FuIZPbLb', 'uoeSkrxjyL0bdns3Qi', 'p3e22GdcYy', 'WMZ2gOhhqZ'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	High entropy of concatenated method names: 'JaKgnBvNv6', 'QsFgBGPleq', 'Kr8g0iXiDp', 'HeYgyJPPcK', 'VTXgv5yOUV', 'HG7gEDgKgl', 'Seeg9LhBFG', 'nc0g8cMZv5', 'KGjgAKXobi', 'SAEgTr857v'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, ptmZsD0c5ki7aUr4IH.cs	High entropy of concatenated method names: 'Dispose', 'zpw2Ph0NeX', 'sq9IfGlS7R', 'IpvnngaIxp', 'J4b2QdAKjV', 'iMB2z4yui9', 'ProcessDialogKey', 'pPtIZdvmek', 'maeI2EmR64', 'tGdIInTZ1V'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, JpXWks56wHO9kFhpni.cs	High entropy of concatenated method names: 'p9Vq6Kixcf', 'DfMquAepHB', 'yeTqHuN8q0', 'ps9qfd9cbT', 'e0SqwbRpXu', 'heSqRh3rNn', 'WpMqd0PeHI', 'AN8qmdCWFy', 'eFGqYxci7Z', 'mw4qN1EtVc'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, FtjdyUz7cvYIQV6IoY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FntFqkOcPH', 'hK6FatyNKK', 'jXxFGSsGR9', 'Sk1Fe5iGYX', 'YYYFVA7dPD', 'G6kFFWlrKr', 'E99FStqUWp'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, xEXANMIj5vpvyqnQ0E.cs	High entropy of concatenated method names: 'C1FOeMxvl', 'ifAojYH9e', 'm0mXYw9YU', 'OnVCkjhTv', 'rZAudxu90', 'UcWpC7XTO', 'fjiUyb6oa9w23wdmsd', 'CS7TOsNPOrKjk7h3E9', 'BBaVNFVXR', 'nUESqkjcb'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, gbAZR1haQsmIomgqNg.cs	High entropy of concatenated method names: 'KFve4EcOOP', 'KWXeQlq80s', 'mgiVZPKU1w', 'Fk8V27a9N8', 'VyCeNpB9mY', 'KpReMvMIkv', 'IJTe5QEaae', 'BJcesgoge3', 'Iu5ecH03Dw', 'tlDejgecTH'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, MnGi3hsDga2OlVgbWv.cs	High entropy of concatenated method names: 'wuRaYIGuQ8', 'MGXaMH3VGD', 'Qp9aseKIKt', 'vd5acknXho', 'FI1afyHrLI', 'BfHatO6ag5', 'DQEawcDtCA', 't5LaRufyAS', 'UMra167pbn', 'VYtadsNxqb'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, dSVgjZ2gRcPFXjQx5GS.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'b4DSstfftH', 'wOKSc5NWpi', 'OaVSjnnwvo', 'I3ySWyt9gi', 'pR5SibpaTf', 'p2wShkUUd9', 'kNySUT1Q8b'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, qTt1jD6uLAiQcCaLfX.cs	High entropy of concatenated method names: 'koK0sQ1STw', 'hN20cF2YFd', 'rbs0jhcQpH', 'jJi0WxO4Sd', 'G9V0iRvC5U', 'VYl0hKCDQk', 'lA70UwOAp6', 'MJp0401pbs', 'BJc0POiXIZ', 'XoM0QyZLjK'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, WbdAKj4VEMB4yui9GP.cs	High entropy of concatenated method names: 'y3VVBAa7tJ', 'Px4V0ppOYd', 'V7aVyRe87y', 'y4YVvCrYjI', 'tCkVEErYKQ', 'CwBV9uT7Uq', 'p5WV8y6Axe', 'YOhVAXgZl4', 'K3eVT3oRE8', 'fkUVkWZbAQ'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, TkWgOMuCEoagwNQ4VS.cs	High entropy of concatenated method names: 'QpRyoLn8SQ', 'CQByX1uQVJ', 'Epuy6hWs0h', 'HBfyuTrfES', 'Bs7yacesKW', 'CmDyGYMSoP', 'bDEyeVQwAh', 'WGNyVwRHIH', 'KymyF0noch', 'p6PySa53NZ'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, z21JwtjvTtu9KXPZuG.cs	High entropy of concatenated method names: 'ToString', 'JJyGNa5LXK', 'bQAGfCLYQN', 'iHFGt4XnTZ', 'DbqGwl384F', 'gs2GReFWsn', 'XeRG1Qe5Zt', 'CmEGdYjNCh', 'x3UGmsN9HX', 'QFcGKbGEEo'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, HdvmekPkaeEmR64SGd.cs	High entropy of concatenated method names: 'Bn5VHWxxCE', 'vFOVftMoH7', 'qvSVtS7iWO', 'ty8Vw299TX', 'Nr9Vs8rrCa', 'ErNVRuExhX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, IqwdBWcr38ouV1FXyq.cs	High entropy of concatenated method names: 'RWDaUbFLwl', 'zoOa4P7LWC', 'yyDaPQMxxp', 'irjaQTw7s2', 'SJSHDdcCT1G78EApZ82', 'e0mrgXcP1M4OYcbryID', 'kqVp52ckVH6VVc6ElXd'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, UpmDKJ1ZWtji5WUrhh.cs	High entropy of concatenated method names: 'AAmEjIaK2D', 'uItEWrpWcG', 'zIaEi6mtBb', 'ToString', 'PLFEhREG95', 'qe7EULwctr', 'Hs720aGOxqA92O4NYMY', 'BNdkjNGovZYSIYTYP3i', 'BXOK68GSIZsd6YQlOhf'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, TlqPA1K8kwXgfAsvBM.cs	High entropy of concatenated method names: 'Wcu9DwKA5Q', 'eji9riVMCc', 'Sc19Ogt7Cw', 'YYO9o8s3IE', 'vGR9bsbXQd', 'w2m9XXP99r', 'MVs9C9492v', 'Um496PUrNr', 'xrh9u9W3D2', 'yd59pP9UmP'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, pS1VxMWZJHL4v5mmTQ.cs	High entropy of concatenated method names: 't0beTS80xo', 'OyFekoQ77W', 'ToString', 'To3eBiY3m8', 'Ww7e0iI4dv', 'ziUeyPGqKK', 'Dmfev0PKuM', 'hHaeEoDUR7', 'eTDe9tEKNG', 'LWTe8USfsr'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, kNprGw2ZiZwM3sepa2o.cs	High entropy of concatenated method names: 'Ow0FDOTJ1w', 'MEtFrUqxVC', 'OsWFObgaf8', 'tSbFoajkrR', 'zHXFbqrQo8', 'kxWFX4KlEB', 'jAfFCWArIr', 'yx4F6S0V2P', 'gFMFuZIAEP', 'RVsFpVw5MM'
Source: 1.2.MT103-7543324334.exe.4226410.1.raw.unpack, eTZ1V5QYHFhQyLXdL9.cs	High entropy of concatenated method names: 'FD6F2qoxOV', 'yqiFglMbu8', 'EZGF7j1DDu', 'IvwFB1lg9j', 'lIKF0ntmZh', 'ikFFvTy4jt', 'a6iFEbxUho', 'O60VUgQ8op', 'wVmV4i6nM7', 'wCdVP8YW8a'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, KiPOYpdaIIK4pENo3x.cs	High entropy of concatenated method names: 'd9T9BtR4XS', 'cWK9yXaDLw', 'B4m9E1JUZX', 'a7lEQHlqqp', 'dLFEzpr4MV', 'lJy9ZKpE18', 'jqh92LVRS9', 'Gut9ILMmNi', 'fKr9gJES5F', 'G8n97lo0Mb'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, NEwbaxH4bE424CAeU6.cs	High entropy of concatenated method names: 'yT3Enqbmsj', 'qKmE07JSYX', 'QXTEv0v6WI', 'ofnE95R9hp', 'AnaE88T4mA', 'GECvix0qmC', 'atVvhrUngt', 'nYavUjO7f5', 'Crfv4PeAC1', 'KnKvPfvWPx'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, ni5L2byy9tC0iqpQ7q.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'zyWIPbWQay', 'u3wIQ79aQA', 'pjyIzIcvSk', 'CVKgZWXZhK', 'xfOg21C4Fd', 'wbygIZJRiO', 'LUIggPdqJ7', 'g9Au7TzWaEG2csZ5aH'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, AKRqW57fOOyNUQDal0.cs	High entropy of concatenated method names: 'XBV29Tt1jD', 'ELA28iQcCa', 'PCE2ToagwN', 'Y4V2kSiEOi', 'pUh2ar5YEw', 'Aax2G4bE42', 'PFD9WpYnr3FuIZPbLb', 'uoeSkrxjyL0bdns3Qi', 'p3e22GdcYy', 'WMZ2gOhhqZ'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	High entropy of concatenated method names: 'JaKgnBvNv6', 'QsFgBGPleq', 'Kr8g0iXiDp', 'HeYgyJPPcK', 'VTXgv5yOUV', 'HG7gEDgKgl', 'Seeg9LhBFG', 'nc0g8cMZv5', 'KGjgAKXobi', 'SAEgTr857v'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, ptmZsD0c5ki7aUr4IH.cs	High entropy of concatenated method names: 'Dispose', 'zpw2Ph0NeX', 'sq9IfGlS7R', 'IpvnngaIxp', 'J4b2QdAKjV', 'iMB2z4yui9', 'ProcessDialogKey', 'pPtIZdvmek', 'maeI2EmR64', 'tGdIInTZ1V'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, JpXWks56wHO9kFhpni.cs	High entropy of concatenated method names: 'p9Vq6Kixcf', 'DfMquAepHB', 'yeTqHuN8q0', 'ps9qfd9cbT', 'e0SqwbRpXu', 'heSqRh3rNn', 'WpMqd0PeHI', 'AN8qmdCWFy', 'eFGqYxci7Z', 'mw4qN1EtVc'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, FtjdyUz7cvYIQV6IoY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FntFqkOcPH', 'hK6FatyNKK', 'jXxFGSsGR9', 'Sk1Fe5iGYX', 'YYYFVA7dPD', 'G6kFFWlrKr', 'E99FStqUWp'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, xEXANMIj5vpvyqnQ0E.cs	High entropy of concatenated method names: 'C1FOeMxvl', 'ifAojYH9e', 'm0mXYw9YU', 'OnVCkjhTv', 'rZAudxu90', 'UcWpC7XTO', 'fjiUyb6oa9w23wdmsd', 'CS7TOsNPOrKjk7h3E9', 'BBaVNFVXR', 'nUESqkjcb'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, gbAZR1haQsmIomgqNg.cs	High entropy of concatenated method names: 'KFve4EcOOP', 'KWXeQlq80s', 'mgiVZPKU1w', 'Fk8V27a9N8', 'VyCeNpB9mY', 'KpReMvMIkv', 'IJTe5QEaae', 'BJcesgoge3', 'Iu5ecH03Dw', 'tlDejgecTH'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, MnGi3hsDga2OlVgbWv.cs	High entropy of concatenated method names: 'wuRaYIGuQ8', 'MGXaMH3VGD', 'Qp9aseKIKt', 'vd5acknXho', 'FI1afyHrLI', 'BfHatO6ag5', 'DQEawcDtCA', 't5LaRufyAS', 'UMra167pbn', 'VYtadsNxqb'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, dSVgjZ2gRcPFXjQx5GS.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'b4DSstfftH', 'wOKSc5NWpi', 'OaVSjnnwvo', 'I3ySWyt9gi', 'pR5SibpaTf', 'p2wShkUUd9', 'kNySUT1Q8b'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, qTt1jD6uLAiQcCaLfX.cs	High entropy of concatenated method names: 'koK0sQ1STw', 'hN20cF2YFd', 'rbs0jhcQpH', 'jJi0WxO4Sd', 'G9V0iRvC5U', 'VYl0hKCDQk', 'lA70UwOAp6', 'MJp0401pbs', 'BJc0POiXIZ', 'XoM0QyZLjK'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, WbdAKj4VEMB4yui9GP.cs	High entropy of concatenated method names: 'y3VVBAa7tJ', 'Px4V0ppOYd', 'V7aVyRe87y', 'y4YVvCrYjI', 'tCkVEErYKQ', 'CwBV9uT7Uq', 'p5WV8y6Axe', 'YOhVAXgZl4', 'K3eVT3oRE8', 'fkUVkWZbAQ'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, TkWgOMuCEoagwNQ4VS.cs	High entropy of concatenated method names: 'QpRyoLn8SQ', 'CQByX1uQVJ', 'Epuy6hWs0h', 'HBfyuTrfES', 'Bs7yacesKW', 'CmDyGYMSoP', 'bDEyeVQwAh', 'WGNyVwRHIH', 'KymyF0noch', 'p6PySa53NZ'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, z21JwtjvTtu9KXPZuG.cs	High entropy of concatenated method names: 'ToString', 'JJyGNa5LXK', 'bQAGfCLYQN', 'iHFGt4XnTZ', 'DbqGwl384F', 'gs2GReFWsn', 'XeRG1Qe5Zt', 'CmEGdYjNCh', 'x3UGmsN9HX', 'QFcGKbGEEo'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, HdvmekPkaeEmR64SGd.cs	High entropy of concatenated method names: 'Bn5VHWxxCE', 'vFOVftMoH7', 'qvSVtS7iWO', 'ty8Vw299TX', 'Nr9Vs8rrCa', 'ErNVRuExhX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, IqwdBWcr38ouV1FXyq.cs	High entropy of concatenated method names: 'RWDaUbFLwl', 'zoOa4P7LWC', 'yyDaPQMxxp', 'irjaQTw7s2', 'SJSHDdcCT1G78EApZ82', 'e0mrgXcP1M4OYcbryID', 'kqVp52ckVH6VVc6ElXd'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, UpmDKJ1ZWtji5WUrhh.cs	High entropy of concatenated method names: 'AAmEjIaK2D', 'uItEWrpWcG', 'zIaEi6mtBb', 'ToString', 'PLFEhREG95', 'qe7EULwctr', 'Hs720aGOxqA92O4NYMY', 'BNdkjNGovZYSIYTYP3i', 'BXOK68GSIZsd6YQlOhf'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, TlqPA1K8kwXgfAsvBM.cs	High entropy of concatenated method names: 'Wcu9DwKA5Q', 'eji9riVMCc', 'Sc19Ogt7Cw', 'YYO9o8s3IE', 'vGR9bsbXQd', 'w2m9XXP99r', 'MVs9C9492v', 'Um496PUrNr', 'xrh9u9W3D2', 'yd59pP9UmP'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, pS1VxMWZJHL4v5mmTQ.cs	High entropy of concatenated method names: 't0beTS80xo', 'OyFekoQ77W', 'ToString', 'To3eBiY3m8', 'Ww7e0iI4dv', 'ziUeyPGqKK', 'Dmfev0PKuM', 'hHaeEoDUR7', 'eTDe9tEKNG', 'LWTe8USfsr'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, kNprGw2ZiZwM3sepa2o.cs	High entropy of concatenated method names: 'Ow0FDOTJ1w', 'MEtFrUqxVC', 'OsWFObgaf8', 'tSbFoajkrR', 'zHXFbqrQo8', 'kxWFX4KlEB', 'jAfFCWArIr', 'yx4F6S0V2P', 'gFMFuZIAEP', 'RVsFpVw5MM'
Source: 1.2.MT103-7543324334.exe.8fb0000.8.raw.unpack, eTZ1V5QYHFhQyLXdL9.cs	High entropy of concatenated method names: 'FD6F2qoxOV', 'yqiFglMbu8', 'EZGF7j1DDu', 'IvwFB1lg9j', 'lIKF0ntmZh', 'ikFFvTy4jt', 'a6iFEbxUho', 'O60VUgQ8op', 'wVmV4i6nM7', 'wCdVP8YW8a'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, KiPOYpdaIIK4pENo3x.cs	High entropy of concatenated method names: 'd9T9BtR4XS', 'cWK9yXaDLw', 'B4m9E1JUZX', 'a7lEQHlqqp', 'dLFEzpr4MV', 'lJy9ZKpE18', 'jqh92LVRS9', 'Gut9ILMmNi', 'fKr9gJES5F', 'G8n97lo0Mb'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, NEwbaxH4bE424CAeU6.cs	High entropy of concatenated method names: 'yT3Enqbmsj', 'qKmE07JSYX', 'QXTEv0v6WI', 'ofnE95R9hp', 'AnaE88T4mA', 'GECvix0qmC', 'atVvhrUngt', 'nYavUjO7f5', 'Crfv4PeAC1', 'KnKvPfvWPx'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, ni5L2byy9tC0iqpQ7q.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'zyWIPbWQay', 'u3wIQ79aQA', 'pjyIzIcvSk', 'CVKgZWXZhK', 'xfOg21C4Fd', 'wbygIZJRiO', 'LUIggPdqJ7', 'g9Au7TzWaEG2csZ5aH'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, AKRqW57fOOyNUQDal0.cs	High entropy of concatenated method names: 'XBV29Tt1jD', 'ELA28iQcCa', 'PCE2ToagwN', 'Y4V2kSiEOi', 'pUh2ar5YEw', 'Aax2G4bE42', 'PFD9WpYnr3FuIZPbLb', 'uoeSkrxjyL0bdns3Qi', 'p3e22GdcYy', 'WMZ2gOhhqZ'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, hNn7Ww8yTbd0RVtrHi.cs	High entropy of concatenated method names: 'JaKgnBvNv6', 'QsFgBGPleq', 'Kr8g0iXiDp', 'HeYgyJPPcK', 'VTXgv5yOUV', 'HG7gEDgKgl', 'Seeg9LhBFG', 'nc0g8cMZv5', 'KGjgAKXobi', 'SAEgTr857v'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, ptmZsD0c5ki7aUr4IH.cs	High entropy of concatenated method names: 'Dispose', 'zpw2Ph0NeX', 'sq9IfGlS7R', 'IpvnngaIxp', 'J4b2QdAKjV', 'iMB2z4yui9', 'ProcessDialogKey', 'pPtIZdvmek', 'maeI2EmR64', 'tGdIInTZ1V'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, JpXWks56wHO9kFhpni.cs	High entropy of concatenated method names: 'p9Vq6Kixcf', 'DfMquAepHB', 'yeTqHuN8q0', 'ps9qfd9cbT', 'e0SqwbRpXu', 'heSqRh3rNn', 'WpMqd0PeHI', 'AN8qmdCWFy', 'eFGqYxci7Z', 'mw4qN1EtVc'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, FtjdyUz7cvYIQV6IoY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FntFqkOcPH', 'hK6FatyNKK', 'jXxFGSsGR9', 'Sk1Fe5iGYX', 'YYYFVA7dPD', 'G6kFFWlrKr', 'E99FStqUWp'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, xEXANMIj5vpvyqnQ0E.cs	High entropy of concatenated method names: 'C1FOeMxvl', 'ifAojYH9e', 'm0mXYw9YU', 'OnVCkjhTv', 'rZAudxu90', 'UcWpC7XTO', 'fjiUyb6oa9w23wdmsd', 'CS7TOsNPOrKjk7h3E9', 'BBaVNFVXR', 'nUESqkjcb'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, gbAZR1haQsmIomgqNg.cs	High entropy of concatenated method names: 'KFve4EcOOP', 'KWXeQlq80s', 'mgiVZPKU1w', 'Fk8V27a9N8', 'VyCeNpB9mY', 'KpReMvMIkv', 'IJTe5QEaae', 'BJcesgoge3', 'Iu5ecH03Dw', 'tlDejgecTH'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, MnGi3hsDga2OlVgbWv.cs	High entropy of concatenated method names: 'wuRaYIGuQ8', 'MGXaMH3VGD', 'Qp9aseKIKt', 'vd5acknXho', 'FI1afyHrLI', 'BfHatO6ag5', 'DQEawcDtCA', 't5LaRufyAS', 'UMra167pbn', 'VYtadsNxqb'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, dSVgjZ2gRcPFXjQx5GS.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'b4DSstfftH', 'wOKSc5NWpi', 'OaVSjnnwvo', 'I3ySWyt9gi', 'pR5SibpaTf', 'p2wShkUUd9', 'kNySUT1Q8b'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, qTt1jD6uLAiQcCaLfX.cs	High entropy of concatenated method names: 'koK0sQ1STw', 'hN20cF2YFd', 'rbs0jhcQpH', 'jJi0WxO4Sd', 'G9V0iRvC5U', 'VYl0hKCDQk', 'lA70UwOAp6', 'MJp0401pbs', 'BJc0POiXIZ', 'XoM0QyZLjK'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, WbdAKj4VEMB4yui9GP.cs	High entropy of concatenated method names: 'y3VVBAa7tJ', 'Px4V0ppOYd', 'V7aVyRe87y', 'y4YVvCrYjI', 'tCkVEErYKQ', 'CwBV9uT7Uq', 'p5WV8y6Axe', 'YOhVAXgZl4', 'K3eVT3oRE8', 'fkUVkWZbAQ'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, TkWgOMuCEoagwNQ4VS.cs	High entropy of concatenated method names: 'QpRyoLn8SQ', 'CQByX1uQVJ', 'Epuy6hWs0h', 'HBfyuTrfES', 'Bs7yacesKW', 'CmDyGYMSoP', 'bDEyeVQwAh', 'WGNyVwRHIH', 'KymyF0noch', 'p6PySa53NZ'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, z21JwtjvTtu9KXPZuG.cs	High entropy of concatenated method names: 'ToString', 'JJyGNa5LXK', 'bQAGfCLYQN', 'iHFGt4XnTZ', 'DbqGwl384F', 'gs2GReFWsn', 'XeRG1Qe5Zt', 'CmEGdYjNCh', 'x3UGmsN9HX', 'QFcGKbGEEo'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, HdvmekPkaeEmR64SGd.cs	High entropy of concatenated method names: 'Bn5VHWxxCE', 'vFOVftMoH7', 'qvSVtS7iWO', 'ty8Vw299TX', 'Nr9Vs8rrCa', 'ErNVRuExhX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, IqwdBWcr38ouV1FXyq.cs	High entropy of concatenated method names: 'RWDaUbFLwl', 'zoOa4P7LWC', 'yyDaPQMxxp', 'irjaQTw7s2', 'SJSHDdcCT1G78EApZ82', 'e0mrgXcP1M4OYcbryID', 'kqVp52ckVH6VVc6ElXd'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, UpmDKJ1ZWtji5WUrhh.cs	High entropy of concatenated method names: 'AAmEjIaK2D', 'uItEWrpWcG', 'zIaEi6mtBb', 'ToString', 'PLFEhREG95', 'qe7EULwctr', 'Hs720aGOxqA92O4NYMY', 'BNdkjNGovZYSIYTYP3i', 'BXOK68GSIZsd6YQlOhf'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, TlqPA1K8kwXgfAsvBM.cs	High entropy of concatenated method names: 'Wcu9DwKA5Q', 'eji9riVMCc', 'Sc19Ogt7Cw', 'YYO9o8s3IE', 'vGR9bsbXQd', 'w2m9XXP99r', 'MVs9C9492v', 'Um496PUrNr', 'xrh9u9W3D2', 'yd59pP9UmP'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, pS1VxMWZJHL4v5mmTQ.cs	High entropy of concatenated method names: 't0beTS80xo', 'OyFekoQ77W', 'ToString', 'To3eBiY3m8', 'Ww7e0iI4dv', 'ziUeyPGqKK', 'Dmfev0PKuM', 'hHaeEoDUR7', 'eTDe9tEKNG', 'LWTe8USfsr'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, kNprGw2ZiZwM3sepa2o.cs	High entropy of concatenated method names: 'Ow0FDOTJ1w', 'MEtFrUqxVC', 'OsWFObgaf8', 'tSbFoajkrR', 'zHXFbqrQo8', 'kxWFX4KlEB', 'jAfFCWArIr', 'yx4F6S0V2P', 'gFMFuZIAEP', 'RVsFpVw5MM'
Source: 1.2.MT103-7543324334.exe.416bbf0.3.raw.unpack, eTZ1V5QYHFhQyLXdL9.cs	High entropy of concatenated method names: 'FD6F2qoxOV', 'yqiFglMbu8', 'EZGF7j1DDu', 'IvwFB1lg9j', 'lIKF0ntmZh', 'ikFFvTy4jt', 'a6iFEbxUho', 'O60VUgQ8op', 'wVmV4i6nM7', 'wCdVP8YW8a'

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_00406EB0 ShellExecuteW,URLDownloadToFileW,

4_2_00406EB0

Source: C:\Users\user\Desktop\MT103-7543324334.exe

File created: C:\Users\user\AppData\Roaming\QQ\QQ.exe

Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-R6CJUW

Loading BitLocker PowerShell Module

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

4_2_0041AA4A

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-R6CJUW	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-R6CJUW	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-R6CJUW	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-R6CJUW	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\MT103-7543324334.exe

4_2_0041CB50

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: MT103-7543324334.exe PID: 3696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 8064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 6048, type: MEMORYSTR

Delayed program exit found

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_0040F7A7 Sleep,ExitProcess,

4_2_0040F7A7

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Memory allocated: 13C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Memory allocated: 2D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Memory allocated: 4D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Memory allocated: 9170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Memory allocated: A170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Memory allocated: A380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Memory allocated: B380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 1370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 2E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 4E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 9280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: A280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: A490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: B490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 3120000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 31E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 51E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 95D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: A5D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: A7E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: B7E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: E50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 2B50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 2A60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 8F00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 9F00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: A110000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: B110000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 10E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 2D30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 4D30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 9380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: 7AE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: A380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory allocated: B380000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

4_2_0041A748

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6563	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2011	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7033	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 905	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Window / User API: threadDelayed 9332
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Window / User API: foregroundWindowGot 1749

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Evaded block: after key decision			graph_4-47650
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Evaded block: after key decision			graph_4-47673

Source: C:\Users\user\Desktop\MT103-7543324334.exe

API coverage: 6.3 %

Source: C:\Users\user\Desktop\MT103-7543324334.exe TID: 5764	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4640	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2684	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe TID: 6648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1260	Thread sleep count: 7033 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7212	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5296	Thread sleep count: 905 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7176	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe TID: 6396	Thread sleep count: 252 > 30
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe TID: 6396	Thread sleep time: -126000s >= -30000s
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe TID: 7068	Thread sleep count: 148 > 30
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe TID: 7068	Thread sleep time: -444000s >= -30000s
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe TID: 7068	Thread sleep count: 9332 > 30
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe TID: 7068	Thread sleep time: -27996000s >= -30000s
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe TID: 7836	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe TID: 8088	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe TID: 4904	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409253
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	4_2_0041C291
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	4_2_0040C34D
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409665
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0044E879 FindFirstFileExA,	4_2_0044E879
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	4_2_0040880C
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0040783C FindFirstFileW,FindNextFileW,	4_2_0040783C
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	4_2_00419AF5
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	4_2_0040BB30
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	4_2_0040BD37

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

4_2_00407C97

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Thread delayed: delay time: 922337203685477

Source: MT103-7543324334.exe, 00000004.00000002.1254234461.0000000000FA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: MT103-7543324334.exe, 00000004.00000002.1254234461.0000000000FA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y?
Source: MT103-7543324334.exe, 00000001.00000002.1284268739.0000000007AD9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_004349F9

Source: C:\Users\user\Desktop\MT103-7543324334.exe

4_2_0041CB50

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_004432B5 mov eax, dword ptr fs:[00000030h]

4_2_004432B5

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_00412077 GetProcessHeap,HeapFree,

4_2_00412077

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004349F9
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00434B47 SetUnhandledExceptionFilter,	4_2_00434B47
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0043BB22
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: 4_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00434FDC

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MT103-7543324334.exe"
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MT103-7543324334.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\QQ\QQ.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Memory written: C:\Users\user\Desktop\MT103-7543324334.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory written: C:\Users\user\AppData\Roaming\QQ\QQ.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory written: C:\Users\user\AppData\Roaming\QQ\QQ.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory written: C:\Users\user\AppData\Roaming\QQ\QQ.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Memory written: C:\Users\user\AppData\Roaming\QQ\QQ.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

4_2_004120F7

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_00419627 mouse_event,

4_2_00419627

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MT103-7543324334.exe"	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process created: C:\Users\user\Desktop\MT103-7543324334.exe "C:\Users\user\Desktop\MT103-7543324334.exe"	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\QQ\QQ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Process created: C:\Users\user\AppData\Roaming\QQ\QQ.exe "C:\Users\user\AppData\Roaming\QQ\QQ.exe"

Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager(
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerUW\
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager!
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerB
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerO
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerP
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerM
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manageri
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerV
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager4
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager?
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager{
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager[
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerUW\QQ
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager\|
Source: QQ.exe, 0000000B.00000002.3700500743.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, QQ.exe, 0000000B.00000002.3700500743.0000000000F64000.00000004.00000020.00020000.00000000.sdmp, logs.dat.11.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_00434C52 cpuid

4_2_00434C52

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: EnumSystemLocalesW,	4_2_00452036
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_004520C3
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: GetLocaleInfoW,	4_2_00452313
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: EnumSystemLocalesW,	4_2_00448404
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_0045243C
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: GetLocaleInfoW,	4_2_00452543
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00452610
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: GetLocaleInfoA,	4_2_0040F8D1
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: GetLocaleInfoW,	4_2_004488ED
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	4_2_00451CD8
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: EnumSystemLocalesW,	4_2_00451F50
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: EnumSystemLocalesW,	4_2_00451F9B

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Queries volume information: C:\Users\user\Desktop\MT103-7543324334.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\QQ\QQ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\QQ\QQ.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\QQ\QQ.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\QQ\QQ.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll VolumeInformation

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_0040B164 GetLocalTime,wsprintfW,

4_2_0040B164

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_0041B60D GetUserNameW,

4_2_0041B60D

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: 4_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

4_2_00449190

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 23.2.QQ.exe.3c31ae8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3f41930.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MT103-7543324334.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3e30ab8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.QQ.exe.42c3d90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3d5a1b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3bb8ec8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MT103-7543324334.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3ec8d10.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3e112b0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3c31ae8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3f41930.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3e30ab8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.QQ.exe.42c3d90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3db7e98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3d5a1b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3e112b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3db7e98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3ec8d10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3bb8ec8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.1548659538.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3700500743.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1465639102.0000000001478000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1580860250.0000000003D5A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1274790008.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1385310551.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1301342473.0000000003EC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1496790759.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3707534940.0000000002B0F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1254234461.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1418482659.00000000042BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1580860250.0000000003E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MT103-7543324334.exe PID: 3696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MT103-7543324334.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 2404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 5628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 7880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 8064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 8128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 6048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 4640, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

4_2_0040BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		4_2_0040BB30
Source: C:\Users\user\Desktop\MT103-7543324334.exe	Code function: \key3.db		4_2_0040BB30

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\MT103-7543324334.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-R6CJUW	Jump to behavior
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-R6CJUW
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-R6CJUW
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-R6CJUW
Source: C:\Users\user\AppData\Roaming\QQ\QQ.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-R6CJUW

Source: Yara match	File source: 23.2.QQ.exe.3c31ae8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3f41930.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MT103-7543324334.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3e30ab8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.QQ.exe.42c3d90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3d5a1b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3bb8ec8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MT103-7543324334.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3ec8d10.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3e112b0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3c31ae8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3f41930.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3e30ab8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.QQ.exe.42c3d90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3db7e98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3d5a1b0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.QQ.exe.3e112b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MT103-7543324334.exe.3db7e98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.QQ.exe.3ec8d10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.QQ.exe.3bb8ec8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.1548659538.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3700500743.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1465639102.0000000001478000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1580860250.0000000003D5A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1274790008.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1385310551.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1301342473.0000000003EC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1496790759.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3707534940.0000000002B0F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1254234461.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1418482659.00000000042BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1580860250.0000000003E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MT103-7543324334.exe PID: 3696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MT103-7543324334.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 2404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 5628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 7880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 8064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 8128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 6048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QQ.exe PID: 4640, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\Desktop\MT103-7543324334.exe

Code function: cmd.exe

4_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	4 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	11 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	122 Process Injection	1 DLL Side-Loading	LSA Secrets	33 System Information Discovery	SSH	Keylogging	1 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 Bypass User Account Control	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	21 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	122 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MT103-7543324334.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
MT103-7543324334.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\QQ\QQ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\QQ\QQ.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Source	Detection	Scanner	Label
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://tempuri.org/AukcionDBDataSet.xsd	0%	Avira URL Cloud	safe
ollar23.duckdns.org	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp/C	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
milliondollar23.duckdns.org	138.201.150.244	true	true		unknown
milliondollar23backup.duckdns.org	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
ollar23.duckdns.org	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	MT103-7543324334.exe	false	URL Reputation: safe	unknown
http://tempuri.org/AukcionDBDataSet.xsd	MT103-7543324334.exe, QQ.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	MT103-7543324334.exe, 00000001.00000002.1274790008.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, MT103-7543324334.exe, 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, QQ.exe, 00000006.00000002.1301342473.0000000003EC8000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000014.00000002.1418482659.00000000042BA000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000017.00000002.1496790759.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000019.00000002.1580860250.0000000003D5A000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000019.00000002.1580860250.0000000003E11000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MT103-7543324334.exe, 00000001.00000002.1271398062.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000006.00000002.1296460638.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000014.00000002.1408801876.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000017.00000002.1488168688.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp, QQ.exe, 00000019.00000002.1569302206.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
138.201.150.244	milliondollar23.duckdns.org	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465305
Start date and time:	2024-07-01 15:02:43 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MT103-7543324334.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@25/14@27/1
EGA Information:	Successful, ratio: 85.7%
HCA Information:	Successful, ratio: 98% Number of executed functions: 306 Number of non-executed functions: 223
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target QQ.exe, PID 5628 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: MT103-7543324334.exe

Simulations

Behavior and APIs

Time	Type	Description
09:03:36	API Interceptor	1x Sleep call for process: MT103-7543324334.exe modified
09:03:37	API Interceptor	30x Sleep call for process: powershell.exe modified
09:03:38	API Interceptor	7347856x Sleep call for process: QQ.exe modified
15:03:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Rmc-R6CJUW "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
15:03:49	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Rmc-R6CJUW "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
15:03:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Rmc-R6CJUW "C:\Users\user\AppData\Roaming\QQ\QQ.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
138.201.150.244	rSCAN31804.exe	Get hash	malicious	GuLoader, Remcos	Browse
	MT103-7543324334hsbc.com.exe	Get hash	malicious	Remcos	Browse
	FACTURA08798696.vbe	Get hash	malicious	GuLoader, Remcos	Browse
	SCAN00381638.SCR.exe	Get hash	malicious	GuLoader, Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
milliondollar23.duckdns.org	rSCAN31804.exe	Get hash	malicious	GuLoader, Remcos	Browse	138.201.150.244
	MT103-7543324334hsbc.com.exe	Get hash	malicious	Remcos	Browse	138.201.150.244
	FACTURA08798696.vbe	Get hash	malicious	GuLoader, Remcos	Browse	138.201.150.244
	SCAN00381638.SCR.exe	Get hash	malicious	GuLoader, Remcos	Browse	138.201.150.244
	oeillet.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.245.214.71
	DHL04AWB01173903102023PDF.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse	79.134.225.111

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	file.exe	Get hash	malicious	FormBook	Browse	135.181.212.206
	file.exe	Get hash	malicious	FormBook	Browse	135.181.212.206
	Re_ gerechtelijke dagvaarding..eml	Get hash	malicious	Unknown	Browse	95.217.55.136
	zyJWi2vy29.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer, Vidar, zgRAT	Browse	195.201.251.214
	56bDgH9sMQ.exe	Get hash	malicious	Vidar	Browse	195.201.251.214
	NI0Y4iB1ON.exe	Get hash	malicious	RedLine	Browse	5.161.190.139
	https://www.teamviewer.com/en-in/download/windows/	Get hash	malicious	Unknown	Browse	144.76.236.241
	https://he110ca11he1lpn0wwb112.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	https://serviceca11he1pn0waa12.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	https://u.to/NuS5IA	Get hash	malicious	Unknown	Browse	94.130.141.49

Process:	C:\Users\user\AppData\Roaming\QQ\QQ.exe
File Type:	data
Category:	dropped
Size (bytes):	360
Entropy (8bit):	3.2835458468971743
Encrypted:	false
SSDEEP:	6:6lVKd4b5YcIeeDAlOWAAe5q1gWAAe5q1gWAAe5q1gWAv:6lVKMec0WFe5BWFe5BWFe5BW+
MD5:	9C191842332AC930AC649FBEEEC6A62F
SHA1:	57CA72E4BEEAD603E72C29AB9BF1049E103D4C10
SHA-256:	9EBA88E137113A00CD76FAAC7699F069000B44E5B461D03E1965920A46279D7B
SHA-512:	CFDF041836F92ECC25453EED4B29637261A9DC30D4D9DE121FF33B7AE2381ADAE2F96B777DD4D1899C7CEB027F79EC97267F8AE4FA4F1EEF3477B438EA2C4461
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.4./.0.7./.0.1. .0.9.:.0.3.:.3.9. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MT103-7543324334.exe.log

Process:	C:\Users\user\Desktop\MT103-7543324334.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	5.35299682261553
Encrypted:	false
SSDEEP:	48:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HKHKMR5vzHKnHKU57Uy:Pq5qHwCYqh3oPtI6eqzxqqMR5rqnqU5t
MD5:	4D047149BCD6E4625565C631F1F723B2
SHA1:	33909516B8ACB42E0B7E5E7D48F8B2D917094BCB
SHA-256:	E84139F7D948F47ADF2E6346641261ADED096D1DB640EFF9B9B7D122121685DC
SHA-512:	AE0D2AC2C282AEBA1B63851529892240C3BE5D56F3996F1BEE3263FBB13A7A044348D63F04B0705836C5847994BD553F342511F6BB4DD075E4E8A3E9CB12D54F
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QQ.exe.log

Process:	C:\Users\user\AppData\Roaming\QQ\QQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	5.35299682261553
Encrypted:	false
SSDEEP:	48:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HKHKMR5vzHKnHKU57Uy:Pq5qHwCYqh3oPtI6eqzxqqMR5rqnqU5t
MD5:	4D047149BCD6E4625565C631F1F723B2
SHA1:	33909516B8ACB42E0B7E5E7D48F8B2D917094BCB
SHA-256:	E84139F7D948F47ADF2E6346641261ADED096D1DB640EFF9B9B7D122121685DC
SHA-512:	AE0D2AC2C282AEBA1B63851529892240C3BE5D56F3996F1BEE3263FBB13A7A044348D63F04B0705836C5847994BD553F342511F6BB4DD075E4E8A3E9CB12D54F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379552885213346
Encrypted:	false
SSDEEP:	48:fWSU4xympjgs4RIoU99tK8NPZHUl7u1iMuge//ZM0UyuVws:fLHxvCsIfA2KRHmOugr1Vws
MD5:	A8E0D497947F820B1578A90D417338D4
SHA1:	945FF7C68A85BA98DD6077BF821D70C5D553C605
SHA-256:	4626E2474B02F78DBD152878E50A4789514B4975D10D2C6D2FF557C7BCBAA166
SHA-512:	971F39BC7970CA54CF45CB7065ADEA48559404E838BFAC09B4A4CEAD255A08B5D329C8F607CC0BA92B9C5761977BA904BC61A46B77FC40FB19BE582A6EDE3D91
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3nh1psxk.o4j.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fhgouosc.xao.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gki20n25.suv.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hgiwqtjo.usc.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_le4cxdbk.v33.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lyei5cct.e1z.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rm1xrjzx.aw1.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y0whuj45.knt.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\QQ\QQ.exe

Process:	C:\Users\user\Desktop\MT103-7543324334.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1601536
Entropy (8bit):	7.372300066955007
Encrypted:	false
SSDEEP:	24576:wDDK7x0BPwAcDSnCITaaLue2jootHfCTVibOgSKma8i3Cxf:gPc62j/fSngRC
MD5:	6D16DCF1423B30677D2918AE11FE2BC3
SHA1:	E1FC54FB00530AB8E07C11B4CC16785858F1917C
SHA-256:	B6F0586D835ACFF8C86C02904729023D95B10D879A066A9EECA973DEAF582E07
SHA-512:	52815E0970FE4FA29A20C0127A14C133E0149D7B3C1F0315B3404FADC7F07D5B72D9CF83FAB32D488B43DCFC576CF60D3647167FC2114A4F0BA5ABEEA31407F6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zf.................R...........p... ........@.. ....................................@..................................o..S.................................................................................... ............... ..H............text...4P... ...R.................. ..`.rsrc................T..............@..@.reloc...............n..............@..B.................p......H.......t...d.......T....................................................0.......... d........%....(......... .........%.C...(.....D... .........%....(......... H........%.J...(.....K... @........%.f...(.....g... `........%.....(......... .........%.....(......... .........%.....(..... ... .........%.....(......... .........%.2...(.....3...(.........&....0..G.........}B....(.....(.....(8......a...s.....+..(.....o.....(.....o.....(....*..0............}B.......(.......(....

C:\Users\user\AppData\Roaming\QQ\QQ.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\MT103-7543324334.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.372300066955007
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	MT103-7543324334.exe
File size:	1'601'536 bytes
MD5:	6d16dcf1423b30677d2918ae11fe2bc3
SHA1:	e1fc54fb00530ab8e07c11b4cc16785858f1917c
SHA256:	b6f0586d835acff8c86c02904729023d95b10d879a066a9eeca973deaf582e07
SHA512:	52815e0970fe4fa29a20c0127a14c133e0149d7b3c1f0315b3404fadc7f07d5b72d9cf83fab32d488b43dcfc576cf60d3647167fc2114a4f0ba5abeea31407f6
SSDEEP:	24576:wDDK7x0BPwAcDSnCITaaLue2jootHfCTVibOgSKma8i3Cxf:gPc62j/fSngRC
TLSH:	8875C00D37A45647EA1E933BC392009587B5D126B75AE38F8DCA38E82DE53598FC3523
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zf.................R...........p... ........@.. ....................................@................................

File Icon


Icon Hash:	4d0e9370312b2b33

Static PE Info

General

Entrypoint:	0x58702e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x667A1E17 [Tue Jun 25 01:32:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x186fd8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x188000	0x1a00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x18a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x185034	0x185200	4665ed26931ea8f42af234673aa533ff	False	0.6937025678605846	data	7.374820869707466	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x188000	0x1a00	0x1a00	f95e66c2f784ce48e7f75fc2c6cf0eb9	False	0.8416466346153846	data	7.154450119530442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x18a000	0xc	0x200	acb5dc57a1a877a7273af9b87c1227ec	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x1880c8	0x13cb	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9850009867771857
RT_GROUP_ICON	0x1894a4	0x14	data	1.05
RT_VERSION	0x1894c8	0x3b4	data	0.48945147679324896

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 15:03:40.055960894 CEST	49703	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:03:40.060970068 CEST	3984	49703	138.201.150.244	192.168.2.7
Jul 1, 2024 15:03:40.061072111 CEST	49703	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:03:40.075956106 CEST	49703	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:03:40.080996037 CEST	3984	49703	138.201.150.244	192.168.2.7
Jul 1, 2024 15:04:01.442066908 CEST	3984	49703	138.201.150.244	192.168.2.7
Jul 1, 2024 15:04:01.442209005 CEST	49703	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:01.442303896 CEST	49703	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:01.447057962 CEST	3984	49703	138.201.150.244	192.168.2.7
Jul 1, 2024 15:04:03.985188961 CEST	49712	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:03.989945889 CEST	3984	49712	138.201.150.244	192.168.2.7
Jul 1, 2024 15:04:03.992152929 CEST	49712	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:03.997312069 CEST	49712	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:04.002162933 CEST	3984	49712	138.201.150.244	192.168.2.7
Jul 1, 2024 15:04:25.345175028 CEST	3984	49712	138.201.150.244	192.168.2.7
Jul 1, 2024 15:04:25.345282078 CEST	49712	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:25.345366955 CEST	49712	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:25.350291014 CEST	3984	49712	138.201.150.244	192.168.2.7
Jul 1, 2024 15:04:27.964086056 CEST	49713	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:27.968976021 CEST	3984	49713	138.201.150.244	192.168.2.7
Jul 1, 2024 15:04:27.969054937 CEST	49713	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:27.972599983 CEST	49713	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:27.977421999 CEST	3984	49713	138.201.150.244	192.168.2.7
Jul 1, 2024 15:04:49.347301960 CEST	3984	49713	138.201.150.244	192.168.2.7
Jul 1, 2024 15:04:49.347367048 CEST	49713	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:49.347419024 CEST	49713	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:49.352222919 CEST	3984	49713	138.201.150.244	192.168.2.7
Jul 1, 2024 15:04:52.105035067 CEST	49715	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:52.110178947 CEST	3984	49715	138.201.150.244	192.168.2.7
Jul 1, 2024 15:04:52.110294104 CEST	49715	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:52.113620043 CEST	49715	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:04:52.118474007 CEST	3984	49715	138.201.150.244	192.168.2.7
Jul 1, 2024 15:05:13.492234945 CEST	3984	49715	138.201.150.244	192.168.2.7
Jul 1, 2024 15:05:13.496207952 CEST	49715	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:05:13.496238947 CEST	49715	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:05:13.501051903 CEST	3984	49715	138.201.150.244	192.168.2.7
Jul 1, 2024 15:05:19.248091936 CEST	49716	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:05:19.253297091 CEST	3984	49716	138.201.150.244	192.168.2.7
Jul 1, 2024 15:05:19.253396034 CEST	49716	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:05:19.256933928 CEST	49716	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:05:19.261708021 CEST	3984	49716	138.201.150.244	192.168.2.7
Jul 1, 2024 15:05:40.627655983 CEST	3984	49716	138.201.150.244	192.168.2.7
Jul 1, 2024 15:05:40.627743959 CEST	49716	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:05:40.627789974 CEST	49716	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:05:40.632741928 CEST	3984	49716	138.201.150.244	192.168.2.7
Jul 1, 2024 15:05:44.246912956 CEST	49717	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:05:44.252119064 CEST	3984	49717	138.201.150.244	192.168.2.7
Jul 1, 2024 15:05:44.252294064 CEST	49717	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:05:44.256443024 CEST	49717	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:05:44.268768072 CEST	3984	49717	138.201.150.244	192.168.2.7
Jul 1, 2024 15:06:05.663501024 CEST	3984	49717	138.201.150.244	192.168.2.7
Jul 1, 2024 15:06:05.663568020 CEST	49717	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:05.663681030 CEST	49717	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:05.668909073 CEST	3984	49717	138.201.150.244	192.168.2.7
Jul 1, 2024 15:06:07.511431932 CEST	49718	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:07.518153906 CEST	3984	49718	138.201.150.244	192.168.2.7
Jul 1, 2024 15:06:07.518246889 CEST	49718	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:07.522746086 CEST	49718	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:07.528491974 CEST	3984	49718	138.201.150.244	192.168.2.7
Jul 1, 2024 15:06:28.899935961 CEST	3984	49718	138.201.150.244	192.168.2.7
Jul 1, 2024 15:06:28.900032997 CEST	49718	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:28.900094986 CEST	49718	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:28.905031919 CEST	3984	49718	138.201.150.244	192.168.2.7
Jul 1, 2024 15:06:34.793287992 CEST	49719	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:34.798367977 CEST	3984	49719	138.201.150.244	192.168.2.7
Jul 1, 2024 15:06:34.798497915 CEST	49719	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:34.801925898 CEST	49719	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:34.806978941 CEST	3984	49719	138.201.150.244	192.168.2.7
Jul 1, 2024 15:06:56.179780960 CEST	3984	49719	138.201.150.244	192.168.2.7
Jul 1, 2024 15:06:56.179841042 CEST	49719	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:56.179956913 CEST	49719	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:56.184778929 CEST	3984	49719	138.201.150.244	192.168.2.7
Jul 1, 2024 15:06:58.995734930 CEST	49720	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:59.000636101 CEST	3984	49720	138.201.150.244	192.168.2.7
Jul 1, 2024 15:06:59.000736952 CEST	49720	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:59.004391909 CEST	49720	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:06:59.010301113 CEST	3984	49720	138.201.150.244	192.168.2.7
Jul 1, 2024 15:07:20.380860090 CEST	3984	49720	138.201.150.244	192.168.2.7
Jul 1, 2024 15:07:20.384401083 CEST	49720	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:07:20.387778044 CEST	49720	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:07:20.392889977 CEST	3984	49720	138.201.150.244	192.168.2.7
Jul 1, 2024 15:07:25.511554956 CEST	49721	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:07:25.517159939 CEST	3984	49721	138.201.150.244	192.168.2.7
Jul 1, 2024 15:07:25.517338991 CEST	49721	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:07:25.520668983 CEST	49721	3984	192.168.2.7	138.201.150.244
Jul 1, 2024 15:07:25.525595903 CEST	3984	49721	138.201.150.244	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 15:03:40.043550014 CEST	51957	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:03:40.051640034 CEST	53	51957	1.1.1.1	192.168.2.7
Jul 1, 2024 15:04:01.442944050 CEST	52490	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:04:02.447475910 CEST	52490	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:04:02.854818106 CEST	53	52490	1.1.1.1	192.168.2.7
Jul 1, 2024 15:04:02.854830980 CEST	53	52490	1.1.1.1	192.168.2.7
Jul 1, 2024 15:04:03.869904041 CEST	62099	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:04:03.980568886 CEST	53	62099	1.1.1.1	192.168.2.7
Jul 1, 2024 15:04:25.345948935 CEST	52022	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:04:26.338239908 CEST	52022	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:04:26.951253891 CEST	53	52022	1.1.1.1	192.168.2.7
Jul 1, 2024 15:04:26.952110052 CEST	53	52022	1.1.1.1	192.168.2.7
Jul 1, 2024 15:04:49.348035097 CEST	52259	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:04:50.353912115 CEST	52259	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:04:51.094003916 CEST	53	52259	1.1.1.1	192.168.2.7
Jul 1, 2024 15:04:51.094022036 CEST	53	52259	1.1.1.1	192.168.2.7
Jul 1, 2024 15:05:13.496834993 CEST	61431	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:05:14.131128073 CEST	53	61431	1.1.1.1	192.168.2.7
Jul 1, 2024 15:05:15.135895014 CEST	51963	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:05:16.151300907 CEST	51963	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:05:17.166553974 CEST	51963	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:05:19.166562080 CEST	51963	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:05:19.247064114 CEST	53	51963	1.1.1.1	192.168.2.7
Jul 1, 2024 15:05:19.247077942 CEST	53	51963	1.1.1.1	192.168.2.7
Jul 1, 2024 15:05:19.247088909 CEST	53	51963	1.1.1.1	192.168.2.7
Jul 1, 2024 15:05:19.247121096 CEST	53	51963	1.1.1.1	192.168.2.7
Jul 1, 2024 15:05:40.628432989 CEST	54357	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:05:41.619757891 CEST	54357	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:05:42.622153997 CEST	54357	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:05:43.236727953 CEST	53	54357	1.1.1.1	192.168.2.7
Jul 1, 2024 15:05:43.236747980 CEST	53	54357	1.1.1.1	192.168.2.7
Jul 1, 2024 15:05:43.236759901 CEST	53	54357	1.1.1.1	192.168.2.7
Jul 1, 2024 15:06:05.664602041 CEST	60429	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:06:06.501097918 CEST	53	60429	1.1.1.1	192.168.2.7
Jul 1, 2024 15:06:28.900648117 CEST	60336	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:06:29.885446072 CEST	60336	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:06:30.901087999 CEST	60336	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:06:32.916130066 CEST	53	60336	1.1.1.1	192.168.2.7
Jul 1, 2024 15:06:32.916167021 CEST	53	60336	1.1.1.1	192.168.2.7
Jul 1, 2024 15:06:32.916177988 CEST	53	60336	1.1.1.1	192.168.2.7
Jul 1, 2024 15:06:33.932868004 CEST	53593	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:06:34.792347908 CEST	53	53593	1.1.1.1	192.168.2.7
Jul 1, 2024 15:06:56.181320906 CEST	50866	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:06:57.177201986 CEST	50866	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:06:57.990528107 CEST	53	50866	1.1.1.1	192.168.2.7
Jul 1, 2024 15:06:57.990737915 CEST	53	50866	1.1.1.1	192.168.2.7
Jul 1, 2024 15:07:20.395689011 CEST	57356	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:07:21.401304960 CEST	57356	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:07:22.416827917 CEST	57356	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:07:24.432508945 CEST	57356	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:07:24.496567011 CEST	53	57356	1.1.1.1	192.168.2.7
Jul 1, 2024 15:07:24.496586084 CEST	53	57356	1.1.1.1	192.168.2.7
Jul 1, 2024 15:07:24.496596098 CEST	53	57356	1.1.1.1	192.168.2.7
Jul 1, 2024 15:07:24.500766993 CEST	53	57356	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 1, 2024 15:03:40.043550014 CEST	192.168.2.7	1.1.1.1	0x648e	Standard query (0)	milliondollar23.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:04:01.442944050 CEST	192.168.2.7	1.1.1.1	0x4601	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:04:02.447475910 CEST	192.168.2.7	1.1.1.1	0x4601	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:04:03.869904041 CEST	192.168.2.7	1.1.1.1	0xee46	Standard query (0)	milliondollar23.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:04:25.345948935 CEST	192.168.2.7	1.1.1.1	0x9c90	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:04:26.338239908 CEST	192.168.2.7	1.1.1.1	0x9c90	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:04:49.348035097 CEST	192.168.2.7	1.1.1.1	0x903a	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:04:50.353912115 CEST	192.168.2.7	1.1.1.1	0x903a	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:13.496834993 CEST	192.168.2.7	1.1.1.1	0x38f8	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:15.135895014 CEST	192.168.2.7	1.1.1.1	0x63a3	Standard query (0)	milliondollar23.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:16.151300907 CEST	192.168.2.7	1.1.1.1	0x63a3	Standard query (0)	milliondollar23.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:17.166553974 CEST	192.168.2.7	1.1.1.1	0x63a3	Standard query (0)	milliondollar23.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:19.166562080 CEST	192.168.2.7	1.1.1.1	0x63a3	Standard query (0)	milliondollar23.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:40.628432989 CEST	192.168.2.7	1.1.1.1	0x18f8	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:41.619757891 CEST	192.168.2.7	1.1.1.1	0x18f8	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:42.622153997 CEST	192.168.2.7	1.1.1.1	0x18f8	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:06:05.664602041 CEST	192.168.2.7	1.1.1.1	0xfebc	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:06:28.900648117 CEST	192.168.2.7	1.1.1.1	0xc5ff	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:06:29.885446072 CEST	192.168.2.7	1.1.1.1	0xc5ff	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:06:30.901087999 CEST	192.168.2.7	1.1.1.1	0xc5ff	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:06:33.932868004 CEST	192.168.2.7	1.1.1.1	0xfcd3	Standard query (0)	milliondollar23.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:06:56.181320906 CEST	192.168.2.7	1.1.1.1	0x46cd	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:06:57.177201986 CEST	192.168.2.7	1.1.1.1	0x46cd	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:07:20.395689011 CEST	192.168.2.7	1.1.1.1	0x786f	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:07:21.401304960 CEST	192.168.2.7	1.1.1.1	0x786f	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:07:22.416827917 CEST	192.168.2.7	1.1.1.1	0x786f	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:07:24.432508945 CEST	192.168.2.7	1.1.1.1	0x786f	Standard query (0)	milliondollar23backup.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 1, 2024 15:03:40.051640034 CEST	1.1.1.1	192.168.2.7	0x648e	No error (0)	milliondollar23.duckdns.org		138.201.150.244	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:04:02.854818106 CEST	1.1.1.1	192.168.2.7	0x4601	Name error (3)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:04:02.854830980 CEST	1.1.1.1	192.168.2.7	0x4601	Name error (3)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:04:03.980568886 CEST	1.1.1.1	192.168.2.7	0xee46	No error (0)	milliondollar23.duckdns.org		138.201.150.244	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:04:26.951253891 CEST	1.1.1.1	192.168.2.7	0x9c90	Name error (3)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:04:26.952110052 CEST	1.1.1.1	192.168.2.7	0x9c90	Name error (3)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:04:51.094003916 CEST	1.1.1.1	192.168.2.7	0x903a	Name error (3)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:04:51.094022036 CEST	1.1.1.1	192.168.2.7	0x903a	Name error (3)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:14.131128073 CEST	1.1.1.1	192.168.2.7	0x38f8	Name error (3)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:19.247064114 CEST	1.1.1.1	192.168.2.7	0x63a3	No error (0)	milliondollar23.duckdns.org		138.201.150.244	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:19.247077942 CEST	1.1.1.1	192.168.2.7	0x63a3	No error (0)	milliondollar23.duckdns.org		138.201.150.244	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:19.247088909 CEST	1.1.1.1	192.168.2.7	0x63a3	No error (0)	milliondollar23.duckdns.org		138.201.150.244	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:19.247121096 CEST	1.1.1.1	192.168.2.7	0x63a3	No error (0)	milliondollar23.duckdns.org		138.201.150.244	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:43.236727953 CEST	1.1.1.1	192.168.2.7	0x18f8	Name error (3)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:43.236747980 CEST	1.1.1.1	192.168.2.7	0x18f8	Name error (3)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:05:43.236759901 CEST	1.1.1.1	192.168.2.7	0x18f8	Name error (3)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:06:06.501097918 CEST	1.1.1.1	192.168.2.7	0xfebc	Name error (3)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:06:32.916130066 CEST	1.1.1.1	192.168.2.7	0xc5ff	Server failure (2)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:06:32.916167021 CEST	1.1.1.1	192.168.2.7	0xc5ff	Server failure (2)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:06:32.916177988 CEST	1.1.1.1	192.168.2.7	0xc5ff	Server failure (2)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:06:34.792347908 CEST	1.1.1.1	192.168.2.7	0xfcd3	No error (0)	milliondollar23.duckdns.org		138.201.150.244	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:06:57.990528107 CEST	1.1.1.1	192.168.2.7	0x46cd	Name error (3)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:06:57.990737915 CEST	1.1.1.1	192.168.2.7	0x46cd	Name error (3)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:07:24.496567011 CEST	1.1.1.1	192.168.2.7	0x786f	Server failure (2)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:07:24.496586084 CEST	1.1.1.1	192.168.2.7	0x786f	Server failure (2)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:07:24.496596098 CEST	1.1.1.1	192.168.2.7	0x786f	Server failure (2)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:07:24.500766993 CEST	1.1.1.1	192.168.2.7	0x786f	Server failure (2)	milliondollar23backup.duckdns.org	none	none	A (IP address)	IN (0x0001)	false

Target ID:	1
Start time:	09:03:35
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\MT103-7543324334.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MT103-7543324334.exe"
Imagebase:	0x8e0000
File size:	1'601'536 bytes
MD5 hash:	6D16DCF1423B30677D2918AE11FE2BC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.1274790008.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.1274790008.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000001.00000002.1274790008.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	09:03:37
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MT103-7543324334.exe"
Imagebase:	0x320000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	09:03:37
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\MT103-7543324334.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MT103-7543324334.exe"
Imagebase:	0x740000
File size:	1'601'536 bytes
MD5 hash:	6D16DCF1423B30677D2918AE11FE2BC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000004.00000002.1253903088.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.1254234461.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	09:03:37
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	09:03:37
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\QQ\QQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Imagebase:	0x9d0000
File size:	1'601'536 bytes
MD5 hash:	6D16DCF1423B30677D2918AE11FE2BC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.1301342473.0000000003EC8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000002.1301342473.0000000003EC8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000006.00000002.1301342473.0000000003EC8000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	09:03:39
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Imagebase:	0x320000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	09:03:39
Start date:	01/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7fb730000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	09:03:39
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	09:03:39
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\QQ\QQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Imagebase:	0x800000
File size:	1'601'536 bytes
MD5 hash:	6D16DCF1423B30677D2918AE11FE2BC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000B.00000002.3700500743.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000B.00000002.3707534940.0000000002B0F000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	20
Start time:	09:03:49
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\QQ\QQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Imagebase:	0xd90000
File size:	1'601'536 bytes
MD5 hash:	6D16DCF1423B30677D2918AE11FE2BC3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000014.00000002.1418482659.00000000042BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000014.00000002.1418482659.00000000042BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000014.00000002.1418482659.00000000042BA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	21
Start time:	09:03:50
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\QQ\QQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Imagebase:	0x750000
File size:	1'601'536 bytes
MD5 hash:	6D16DCF1423B30677D2918AE11FE2BC3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000015.00000002.1385310551.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	23
Start time:	09:03:57
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\QQ\QQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Imagebase:	0x710000
File size:	1'601'536 bytes
MD5 hash:	6D16DCF1423B30677D2918AE11FE2BC3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000017.00000002.1496790759.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000017.00000002.1496790759.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000017.00000002.1496790759.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	24
Start time:	09:03:58
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\QQ\QQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Imagebase:	0xd30000
File size:	1'601'536 bytes
MD5 hash:	6D16DCF1423B30677D2918AE11FE2BC3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000018.00000002.1465639102.0000000001478000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	25
Start time:	10:32:41
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\QQ\QQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Imagebase:	0x840000
File size:	1'601'536 bytes
MD5 hash:	6D16DCF1423B30677D2918AE11FE2BC3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000002.1580860250.0000000003D5A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000019.00000002.1580860250.0000000003D5A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000019.00000002.1580860250.0000000003D5A000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000002.1580860250.0000000003E11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000019.00000002.1580860250.0000000003E11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000019.00000002.1580860250.0000000003E11000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	26
Start time:	10:32:42
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\QQ\QQ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Imagebase:	0x260000
File size:	1'601'536 bytes
MD5 hash:	6D16DCF1423B30677D2918AE11FE2BC3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	27
Start time:	10:32:42
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\QQ\QQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\QQ\QQ.exe"
Imagebase:	0x790000
File size:	1'601'536 bytes
MD5 hash:	6D16DCF1423B30677D2918AE11FE2BC3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001B.00000002.1548659538.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true