Windows Analysis Report
HUED23EDE5UGRFQ.exe

AI detected suspicious sample

Source: Yara match	File source: 17.2.jdSldfVS.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42782c0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.jdSldfVS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42f0ce0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42f0ce0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42782c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4580750131.0000000002B6F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4577861683.0000000001007000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2185308624.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2170172636.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2208800454.0000000004278000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUED23EDE5UGRFQ.exe PID: 2820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HUED23EDE5UGRFQ.exe PID: 4896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jdSldfVS.exe PID: 6124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jdSldfVS.exe PID: 6996, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: HUED23EDE5UGRFQ.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

17_2_00433837

Source: HUED23EDE5UGRFQ.exe, 00000000.00000002.2170172636.00000000034F6000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_82b18925-a

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 17.2.jdSldfVS.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42782c0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.jdSldfVS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42f0ce0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42f0ce0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42782c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2170172636.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2208800454.0000000004278000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUED23EDE5UGRFQ.exe PID: 2820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jdSldfVS.exe PID: 6124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jdSldfVS.exe PID: 6996, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_004074FD _wcslen,CoGetObject,

17_2_004074FD

Source: HUED23EDE5UGRFQ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: HUED23EDE5UGRFQ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	17_2_00409253
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	17_2_0041C291
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	17_2_0040C34D
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	17_2_00409665
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0044E879 FindFirstFileExA,	17_2_0044E879
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	17_2_0040880C
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0040783C FindFirstFileW,FindNextFileW,	17_2_0040783C
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	17_2_00419AF5
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	17_2_0040BB30
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	17_2_0040BD37

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

17_2_00407C97

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 4x nop then jmp 07AB431Fh		10_2_07AB3C21
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 4x nop then jmp 07AB431Fh		10_2_07AB3CFA

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.6:49712 -> 94.156.69.93:2973
Source: Traffic	Snort IDS: 2032777 ET TROJAN Remcos 3.x Unencrypted Server Response 94.156.69.93:2973 -> 192.168.2.6:49712

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 94.156.69.93

Source: global traffic

TCP traffic: 192.168.2.6:49712 -> 94.156.69.93:2973

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: TERASYST-ASBG TERASYST-ASBG

Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.69.93
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.69.93
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.69.93
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.69.93
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.69.93
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.69.93
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.69.93
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.69.93
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.69.93
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.69.93
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.69.93
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.69.93
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.69.93
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.69.93
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

17_2_0041B380

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: geoplugin.net

Source: HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001041000.00000004.00000020.00020000.00000000.sdmp, HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001062000.00000004.00000020.00020000.00000000.sdmp, jdSldfVS.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: HUED23EDE5UGRFQ.exe, 00000000.00000002.2170172636.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, jdSldfVS.exe, 0000000A.00000002.2208800454.0000000004278000.00000004.00000800.00020000.00000000.sdmp, jdSldfVS.exe, 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpiiB
Source: HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: HUED23EDE5UGRFQ.exe, 00000000.00000002.2168229174.0000000002491000.00000004.00000800.00020000.00000000.sdmp, jdSldfVS.exe, 0000000A.00000002.2206237212.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: HUED23EDE5UGRFQ.exe, jdSldfVS.exe.0.dr	String found in binary or memory: http://www.opcom.ro/rapoarte/export_csv_raportPIPsiVolumTranzactionat_PI.php?zi=
Source: HUED23EDE5UGRFQ.exe, jdSldfVS.exe.0.dr	String found in binary or memory: http://www.opcom.ro/rapoarte/export_xml_PIPsiVolTranPI.php?zi=

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000

17_2_0040A2B8

Installs a global keyboard hook

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

17_2_0040B70E

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

17_2_004168C1

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

17_2_0040B70E

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

17_2_0040A3E0

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 17.2.jdSldfVS.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42782c0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.jdSldfVS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42f0ce0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42f0ce0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42782c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4580750131.0000000002B6F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4577861683.0000000001007000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2185308624.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2170172636.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2208800454.0000000004278000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUED23EDE5UGRFQ.exe PID: 2820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HUED23EDE5UGRFQ.exe PID: 4896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jdSldfVS.exe PID: 6124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jdSldfVS.exe PID: 6996, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_0041C9E2 SystemParametersInfoW,

17_2_0041C9E2

System Summary

Malicious sample detected (through community Yara rule)

Source: 17.2.jdSldfVS.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 17.2.jdSldfVS.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 17.2.jdSldfVS.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.2.jdSldfVS.exe.42782c0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.jdSldfVS.exe.42782c0.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 10.2.jdSldfVS.exe.42782c0.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 17.2.jdSldfVS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 17.2.jdSldfVS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 17.2.jdSldfVS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.2.jdSldfVS.exe.42f0ce0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.jdSldfVS.exe.42f0ce0.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 10.2.jdSldfVS.exe.42f0ce0.3.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.2.jdSldfVS.exe.42f0ce0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.jdSldfVS.exe.42f0ce0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.2.jdSldfVS.exe.42782c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.jdSldfVS.exe.42782c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.2170172636.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000A.00000002.2208800454.0000000004278000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: HUED23EDE5UGRFQ.exe PID: 2820, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: jdSldfVS.exe PID: 6124, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: jdSldfVS.exe PID: 6996, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: HUED23EDE5UGRFQ.exe

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

17_2_004167B4

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_049E027C	0_2_049E027C
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_049E9A08	0_2_049E9A08
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_049E0448	0_2_049E0448
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_049E0DF8	0_2_049E0DF8
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_049E0E08	0_2_049E0E08
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_049E29B0	0_2_049E29B0
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_049E99F8	0_2_049E99F8
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_06A2E738	0_2_06A2E738
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_06A2E748	0_2_06A2E748
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_06A2E2FF	0_2_06A2E2FF
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_06A263E8	0_2_06A263E8
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_06A263DA	0_2_06A263DA
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_06A2E310	0_2_06A2E310
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_06A2DED8	0_2_06A2DED8
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Code function: 0_2_06A2DAA0	0_2_06A2DAA0
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_0572027C	10_2_0572027C
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_05729A08	10_2_05729A08
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_05720448	10_2_05720448
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_05720DF8	10_2_05720DF8
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_05720E08	10_2_05720E08
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_057229B0	10_2_057229B0
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_057299F8	10_2_057299F8
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_057F63D8	10_2_057F63D8
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_057F6347	10_2_057F6347
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_057F63D1	10_2_057F63D1
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_07AB5258	10_2_07AB5258
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_07AB7548	10_2_07AB7548
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_07AB0007	10_2_07AB0007
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_07AB0040	10_2_07AB0040
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0043E0CC	17_2_0043E0CC
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0041F0FA	17_2_0041F0FA
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00454159	17_2_00454159
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00438168	17_2_00438168
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_004461F0	17_2_004461F0
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0043E2FB	17_2_0043E2FB
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0045332B	17_2_0045332B
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0042739D	17_2_0042739D
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_004374E6	17_2_004374E6
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0043E558	17_2_0043E558
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00438770	17_2_00438770
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_004378FE	17_2_004378FE
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00433946	17_2_00433946
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0044D9C9	17_2_0044D9C9
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00427A46	17_2_00427A46
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0041DB62	17_2_0041DB62
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00427BAF	17_2_00427BAF
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00437D33	17_2_00437D33
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00435E5E	17_2_00435E5E
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00426E0E	17_2_00426E0E
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0043DE9D	17_2_0043DE9D
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00413FCA	17_2_00413FCA
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00436FEA	17_2_00436FEA

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: String function: 00434E10 appears 54 times
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: String function: 00434770 appears 41 times
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: String function: 00401E65 appears 34 times

Source: HUED23EDE5UGRFQ.exe, 00000000.00000002.2173388823.0000000006A40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs HUED23EDE5UGRFQ.exe
Source: HUED23EDE5UGRFQ.exe, 00000000.00000000.2118623343.000000000013E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegrUk.exe, vs HUED23EDE5UGRFQ.exe
Source: HUED23EDE5UGRFQ.exe, 00000000.00000002.2162131813.000000000072E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs HUED23EDE5UGRFQ.exe
Source: HUED23EDE5UGRFQ.exe, 00000000.00000002.2173416724.0000000006ACE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegrUk.exe, vs HUED23EDE5UGRFQ.exe
Source: HUED23EDE5UGRFQ.exe, 00000000.00000002.2174742533.00000000075C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs HUED23EDE5UGRFQ.exe
Source: HUED23EDE5UGRFQ.exe	Binary or memory string: OriginalFilenamegrUk.exe, vs HUED23EDE5UGRFQ.exe

Source: HUED23EDE5UGRFQ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 17.2.jdSldfVS.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 17.2.jdSldfVS.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 17.2.jdSldfVS.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.2.jdSldfVS.exe.42782c0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.jdSldfVS.exe.42782c0.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 10.2.jdSldfVS.exe.42782c0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 17.2.jdSldfVS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 17.2.jdSldfVS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 17.2.jdSldfVS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.2.jdSldfVS.exe.42f0ce0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.jdSldfVS.exe.42f0ce0.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 10.2.jdSldfVS.exe.42f0ce0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.2.jdSldfVS.exe.42f0ce0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.jdSldfVS.exe.42f0ce0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.2.jdSldfVS.exe.42782c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.jdSldfVS.exe.42782c0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.2170172636.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000A.00000002.2208800454.0000000004278000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: HUED23EDE5UGRFQ.exe PID: 2820, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: jdSldfVS.exe PID: 6124, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: jdSldfVS.exe PID: 6996, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: HUED23EDE5UGRFQ.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: jdSldfVS.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, DSSwTQO1NWXixqGlCL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, ihbe3xiO3YppFp0VLe.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, ihbe3xiO3YppFp0VLe.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, ihbe3xiO3YppFp0VLe.cs	Security API names: _0020.AddAccessRule
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, DSSwTQO1NWXixqGlCL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, ihbe3xiO3YppFp0VLe.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, ihbe3xiO3YppFp0VLe.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, ihbe3xiO3YppFp0VLe.cs	Security API names: _0020.AddAccessRule
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, DSSwTQO1NWXixqGlCL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, ihbe3xiO3YppFp0VLe.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, ihbe3xiO3YppFp0VLe.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, ihbe3xiO3YppFp0VLe.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@23/17@1/2

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

17_2_00417952

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

17_2_0040F474

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

17_2_0041B4A8

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

17_2_0041AA4A

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

File created: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3048:120:WilError_03
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Mutant created: \Sessions\1\BaseNamedObjects\donmtwtGg
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6404:120:WilError_03
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-HKC0PV
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1808:120:WilError_03

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

File created: C:\Users\user\AppData\Local\Temp\tmpAF95.tmp

Source: HUED23EDE5UGRFQ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: HUED23EDE5UGRFQ.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: HUED23EDE5UGRFQ.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

File read: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

Source: unknown	Process created: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe "C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe"
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\jdSldfVS.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jdSldfVS" /XML "C:\Users\user\AppData\Local\Temp\tmpAF95.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe "C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jdSldfVS.exe C:\Users\user\AppData\Roaming\jdSldfVS.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jdSldfVS" /XML "C:\Users\user\AppData\Local\Temp\tmpBFB2.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process created: C:\Users\user\AppData\Roaming\jdSldfVS.exe "C:\Users\user\AppData\Roaming\jdSldfVS.exe"
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process created: C:\Users\user\AppData\Roaming\jdSldfVS.exe "C:\Users\user\AppData\Roaming\jdSldfVS.exe"
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process created: C:\Users\user\AppData\Roaming\jdSldfVS.exe "C:\Users\user\AppData\Roaming\jdSldfVS.exe"
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\jdSldfVS.exe"	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jdSldfVS" /XML "C:\Users\user\AppData\Local\Temp\tmpAF95.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe "C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jdSldfVS" /XML "C:\Users\user\AppData\Local\Temp\tmpBFB2.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process created: C:\Users\user\AppData\Roaming\jdSldfVS.exe "C:\Users\user\AppData\Roaming\jdSldfVS.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process created: C:\Users\user\AppData\Roaming\jdSldfVS.exe "C:\Users\user\AppData\Roaming\jdSldfVS.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process created: C:\Users\user\AppData\Roaming\jdSldfVS.exe "C:\Users\user\AppData\Roaming\jdSldfVS.exe"	Jump to behavior

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Source: HUED23EDE5UGRFQ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: HUED23EDE5UGRFQ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: HUED23EDE5UGRFQ.exe, OptionsWindow.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: jdSldfVS.exe.0.dr, OptionsWindow.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, ihbe3xiO3YppFp0VLe.cs	.Net Code: q9teSJ6F7G System.Reflection.Assembly.Load(byte[])
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, ihbe3xiO3YppFp0VLe.cs	.Net Code: q9teSJ6F7G System.Reflection.Assembly.Load(byte[])
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, ihbe3xiO3YppFp0VLe.cs	.Net Code: q9teSJ6F7G System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

17_2_0041CB50

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_01592540 push 55030BC3h; ret	10_2_0159254D
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_07AB5F29 push es; ret	10_2_07AB5F2A
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_07AB3730 push A407A9C5h; ret	10_2_07AB3735
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_07AB5EF9 push es; ret	10_2_07AB5EFA
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_07AB5E63 push es; ret	10_2_07AB5E6A
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_07AB5E60 push es; ret	10_2_07AB5E62
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 10_2_07AB6999 push cs; ret	10_2_07AB699A
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00457106 push ecx; ret	17_2_00457119
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0045B11A push esp; ret	17_2_0045B141
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0045E54D push esi; ret	17_2_0045E556
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00457A28 push eax; ret	17_2_00457A46
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00434E56 push ecx; ret	17_2_00434E69

Source: HUED23EDE5UGRFQ.exe	Static PE information: section name: .text entropy: 7.9794014993218445
Source: jdSldfVS.exe.0.dr	Static PE information: section name: .text entropy: 7.9794014993218445

Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, VrKmqeMx6E5LwgMLC4.cs	High entropy of concatenated method names: 'Hk4PbZ6o4W', 'VnOPQM2EvY', 'dQ3PAdMbr5', 'RrjPkQgbk9', 'GdUPvUwXie', 'Iu5A9QMDGZ', 'swAA3J5jSD', 'OGQAMjonbp', 'IlVAubPjAv', 'uaTAgVOgfP'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, IAZmwL4UXY1NmAmY0w.cs	High entropy of concatenated method names: 'x4dwfjD7lx', 'bXNwTXmSlW', 'x6ZwRUCnTU', 'nDKwGUZ9cB', 'ooGws6yYUT', 'Jg3woJxfib', 'tv3wYmOAms', 'sDAwiXeBJ8', 'AGbw4tPchd', 'uBYw7cABxV'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, EdXujie0QO3KCWsV9Qe.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'EWw7myx8Xg', 'tgM7nSnlDS', 'WYx7NdtG5s', 'QWL7aFNuWN', 'aLJ79vHwDM', 'Jim730CBsR', 'oHm7MWbIT6'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, hlyFOV3NjigwVy9fWY.cs	High entropy of concatenated method names: 'qDsKRXhbuX', 'fyJKGAkTmK', 'Nm5Kq5QiVA', 'sehKUAXuPH', 'MWOK0HHkTE', 'lxkKElCtxW', 'qcVKWrPrIx', 'zWDKxmvBnu', 'UbiK1N4cM5', 'wBjKpj5Qcw'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, IhhE4IzvotpcF7E1nA.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gxD4K2YmEV', 'rtj4s9kOKg', 'bcr4oIWZjq', 'TNr4YvISuw', 'jGW4iHoZYy', 'rmj44epd0y', 'i3A47A7BEN'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, omVVIsy4JEq4JnFNAX.cs	High entropy of concatenated method names: 'EgDSs6MYC', 'jYxfUQvu8', 'yUCTwEpHm', 'bOu5YFQOJ', 'w4PGF4JH8', 'ANyXrZKI8', 'klr8eTiECNQnABjAq9', 'gJgGq5P51BjqKhEsa3', 'nhji4jqOJ', 'gjb7kQr5c'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, LSEQgSWw6PFKkwBvUW.cs	High entropy of concatenated method names: 'Q2m4IAvWFa', 'TSd4yo1BkD', 'chP4e03fj1', 'Joh4Jx8hrE', 'Udn4Q1UQbF', 'Ohb4AbKENj', 'lZd4Pwy1Ah', 'D4LiMCDf3c', 'Fediuk7eN7', 'Mycigmo5s5'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, C5Fi006NlErAQ6vXTa.cs	High entropy of concatenated method names: 'rM5YBeiIku', 'dT1YrB7yhh', 'ToString', 'Ao3YJ0DXSw', 'E3XYQYK3cL', 'gWnYwMF2Vj', 'HFKYAbWJkm', 'w5bYPoqBjv', 'gQQYkPE11J', 'RHdYvwLqhL'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, n026WbD77LwpII4skq.cs	High entropy of concatenated method names: 'lJHAFjLdXH', 'AsMA5B816f', 'vfrwtn6SYn', 'vHuw0lcSKs', 'vnUwEc939r', 'UB3wCmGo0e', 'lRXwWRdJ55', 'G12wxZTVE2', 'XLqwdOpbpe', 'BiAw16wqCc'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, QUsUCJZYbbjkgd53fi.cs	High entropy of concatenated method names: 'Jt1Ik8ZB02', 'shyIvcio2y', 'vlbIBjhP3D', 'N11Irfslj0', 'gGjIsOHOSk', 'uwiIoisVXe', 'WsVbIsEdoSd1VYCdns', 'VdMVqG0teZ9AKdHlWT', 'dbyIIL1OnQ', 'mv8IyFivtb'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, KevtKNusq8g1AfXZ5c.cs	High entropy of concatenated method names: 'BaskcxbOHJ', 'LYukZdPo3O', 'HX9kSewxDQ', 'NvykfmtBjl', 'M5ikFbNDVL', 'UsokTm9dBM', 'DGKk5ldC6t', 'SDwkRX5ySJ', 'V9vkGpn5Zb', 'WvkkXS8vqt'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, ihbe3xiO3YppFp0VLe.cs	High entropy of concatenated method names: 'pt5yb7OWcw', 'XFRyJUg1wV', 'NnHyQgEXDc', 'oyQywJoPli', 't8YyA8yUdn', 'N7QyP3H2AE', 'sjiykyXWgr', 'rGsyvLuMG5', 'v95y6xTj0e', 'oWXyBiLwIp'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, O7QaxOP1WHfuKiysCB.cs	High entropy of concatenated method names: 'iF1iqN2Ix7', 'qyJiUJAgbi', 'atRitsUWSG', 'UoEi0ZTDMw', 'dquimOLOel', 'cZ3iEOe2tr', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, UsNrrbl72Ir1JF4Inh.cs	High entropy of concatenated method names: 'RR5iJQSZlT', 'aM7iQBhrAS', 'EZKiwuLK8J', 'hDPiAhGv1Q', 'GGJiPL0pxD', 'vegikF3Qys', 'Qrwivv9eID', 'pOEi6NrRx0', 'xqfiBhaXAK', 'eR8irPgAc5'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, ULLvmxT725yvDGgCf2.cs	High entropy of concatenated method names: 'Kufs1jK0Hw', 'DIrshoW4RW', 'zFvsmLWmUu', 'lwisncaH5M', 'bBEsUdMnPP', 'w0kstIFyvh', 'I1ls0VZ5DC', 'tNWsEiwVEj', 'MkwsCcVV2Q', 'caEsWea0Dc'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, DSSwTQO1NWXixqGlCL.cs	High entropy of concatenated method names: 'zlBQmA66Lh', 'EEQQnjJRDT', 'A1eQNBJOhJ', 'P55Qaden2w', 't1bQ96PaJw', 'HNyQ3WKvm1', 'yClQMfqAY5', 'AODQuFaXhT', 'j5aQg4rj8o', 'alRQDH46qh'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, oT9uaNmRpGhyBXALGV.cs	High entropy of concatenated method names: 'O8VkJWd4Cf', 'bbLkwssU52', 'quRkPAjuXO', 'KmOPD0dkpB', 's50PzKtHQL', 'xX2kOGa260', 'TAdkI3bhaB', 'TBdk2twsMf', 'Acwky4QwXT', 'ueckeQIEnl'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, x2AqPHq2qhLej4XYqg.cs	High entropy of concatenated method names: 'QoIPN1ljCY', 'B0WPaOkxZO', 'A3tP9aiSEI', 'ToString', 'HsiP3vy0jA', 'e2sPMT2cGD', 'VmfrR0l3MWhDe4bkGsg', 'UBP4OtlNENICldRnPou', 'VU6ZITlrYnYsgKZkO7Q', 'OFxHAyly07COCRvgANx'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, flsNFv1jqRn4UFfbYv.cs	High entropy of concatenated method names: 'AK1Yuw30dv', 'DMNYDKofPr', 't1tiO2Iai7', 'gi5iIVjKpB', 'Xp4YpUP5CX', 'M75Yhl2fHN', 'EG4Y81lKAP', 'qmWYmw7roK', 'lAHYnUmdON', 'EwkYNZeps6'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, qVbjiYeg51FIPLgDide.cs	High entropy of concatenated method names: 'zwH4cUCJDl', 'vdX4ZNxuaD', 'LOa4Sx6V7l', 'uFB4fUUoZO', 'Oft4FIqtry', 'Qce4TCe74A', 'wl345clhix', 't2K4Red2VO', 'Y4M4GK1488', 'HmA4Xk0S9m'
Source: 0.2.HUED23EDE5UGRFQ.exe.75c0000.6.raw.unpack, yxkao7hiFSsCxJrj6x.cs	High entropy of concatenated method names: 'Dispose', 'scYIg4SsGH', 'NsG2UcEpqL', 'aYvjjmHQdT', 'xXHIDRqdFg', 'sCgIzqmx7K', 'ProcessDialogKey', 'FDb2ONo6rM', 'XZY2IVTUPT', 'fVb22oh36r'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, VrKmqeMx6E5LwgMLC4.cs	High entropy of concatenated method names: 'Hk4PbZ6o4W', 'VnOPQM2EvY', 'dQ3PAdMbr5', 'RrjPkQgbk9', 'GdUPvUwXie', 'Iu5A9QMDGZ', 'swAA3J5jSD', 'OGQAMjonbp', 'IlVAubPjAv', 'uaTAgVOgfP'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, IAZmwL4UXY1NmAmY0w.cs	High entropy of concatenated method names: 'x4dwfjD7lx', 'bXNwTXmSlW', 'x6ZwRUCnTU', 'nDKwGUZ9cB', 'ooGws6yYUT', 'Jg3woJxfib', 'tv3wYmOAms', 'sDAwiXeBJ8', 'AGbw4tPchd', 'uBYw7cABxV'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, EdXujie0QO3KCWsV9Qe.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'EWw7myx8Xg', 'tgM7nSnlDS', 'WYx7NdtG5s', 'QWL7aFNuWN', 'aLJ79vHwDM', 'Jim730CBsR', 'oHm7MWbIT6'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, hlyFOV3NjigwVy9fWY.cs	High entropy of concatenated method names: 'qDsKRXhbuX', 'fyJKGAkTmK', 'Nm5Kq5QiVA', 'sehKUAXuPH', 'MWOK0HHkTE', 'lxkKElCtxW', 'qcVKWrPrIx', 'zWDKxmvBnu', 'UbiK1N4cM5', 'wBjKpj5Qcw'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, IhhE4IzvotpcF7E1nA.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gxD4K2YmEV', 'rtj4s9kOKg', 'bcr4oIWZjq', 'TNr4YvISuw', 'jGW4iHoZYy', 'rmj44epd0y', 'i3A47A7BEN'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, omVVIsy4JEq4JnFNAX.cs	High entropy of concatenated method names: 'EgDSs6MYC', 'jYxfUQvu8', 'yUCTwEpHm', 'bOu5YFQOJ', 'w4PGF4JH8', 'ANyXrZKI8', 'klr8eTiECNQnABjAq9', 'gJgGq5P51BjqKhEsa3', 'nhji4jqOJ', 'gjb7kQr5c'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, LSEQgSWw6PFKkwBvUW.cs	High entropy of concatenated method names: 'Q2m4IAvWFa', 'TSd4yo1BkD', 'chP4e03fj1', 'Joh4Jx8hrE', 'Udn4Q1UQbF', 'Ohb4AbKENj', 'lZd4Pwy1Ah', 'D4LiMCDf3c', 'Fediuk7eN7', 'Mycigmo5s5'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, C5Fi006NlErAQ6vXTa.cs	High entropy of concatenated method names: 'rM5YBeiIku', 'dT1YrB7yhh', 'ToString', 'Ao3YJ0DXSw', 'E3XYQYK3cL', 'gWnYwMF2Vj', 'HFKYAbWJkm', 'w5bYPoqBjv', 'gQQYkPE11J', 'RHdYvwLqhL'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, n026WbD77LwpII4skq.cs	High entropy of concatenated method names: 'lJHAFjLdXH', 'AsMA5B816f', 'vfrwtn6SYn', 'vHuw0lcSKs', 'vnUwEc939r', 'UB3wCmGo0e', 'lRXwWRdJ55', 'G12wxZTVE2', 'XLqwdOpbpe', 'BiAw16wqCc'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, QUsUCJZYbbjkgd53fi.cs	High entropy of concatenated method names: 'Jt1Ik8ZB02', 'shyIvcio2y', 'vlbIBjhP3D', 'N11Irfslj0', 'gGjIsOHOSk', 'uwiIoisVXe', 'WsVbIsEdoSd1VYCdns', 'VdMVqG0teZ9AKdHlWT', 'dbyIIL1OnQ', 'mv8IyFivtb'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, KevtKNusq8g1AfXZ5c.cs	High entropy of concatenated method names: 'BaskcxbOHJ', 'LYukZdPo3O', 'HX9kSewxDQ', 'NvykfmtBjl', 'M5ikFbNDVL', 'UsokTm9dBM', 'DGKk5ldC6t', 'SDwkRX5ySJ', 'V9vkGpn5Zb', 'WvkkXS8vqt'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, ihbe3xiO3YppFp0VLe.cs	High entropy of concatenated method names: 'pt5yb7OWcw', 'XFRyJUg1wV', 'NnHyQgEXDc', 'oyQywJoPli', 't8YyA8yUdn', 'N7QyP3H2AE', 'sjiykyXWgr', 'rGsyvLuMG5', 'v95y6xTj0e', 'oWXyBiLwIp'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, O7QaxOP1WHfuKiysCB.cs	High entropy of concatenated method names: 'iF1iqN2Ix7', 'qyJiUJAgbi', 'atRitsUWSG', 'UoEi0ZTDMw', 'dquimOLOel', 'cZ3iEOe2tr', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, UsNrrbl72Ir1JF4Inh.cs	High entropy of concatenated method names: 'RR5iJQSZlT', 'aM7iQBhrAS', 'EZKiwuLK8J', 'hDPiAhGv1Q', 'GGJiPL0pxD', 'vegikF3Qys', 'Qrwivv9eID', 'pOEi6NrRx0', 'xqfiBhaXAK', 'eR8irPgAc5'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, ULLvmxT725yvDGgCf2.cs	High entropy of concatenated method names: 'Kufs1jK0Hw', 'DIrshoW4RW', 'zFvsmLWmUu', 'lwisncaH5M', 'bBEsUdMnPP', 'w0kstIFyvh', 'I1ls0VZ5DC', 'tNWsEiwVEj', 'MkwsCcVV2Q', 'caEsWea0Dc'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, DSSwTQO1NWXixqGlCL.cs	High entropy of concatenated method names: 'zlBQmA66Lh', 'EEQQnjJRDT', 'A1eQNBJOhJ', 'P55Qaden2w', 't1bQ96PaJw', 'HNyQ3WKvm1', 'yClQMfqAY5', 'AODQuFaXhT', 'j5aQg4rj8o', 'alRQDH46qh'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, oT9uaNmRpGhyBXALGV.cs	High entropy of concatenated method names: 'O8VkJWd4Cf', 'bbLkwssU52', 'quRkPAjuXO', 'KmOPD0dkpB', 's50PzKtHQL', 'xX2kOGa260', 'TAdkI3bhaB', 'TBdk2twsMf', 'Acwky4QwXT', 'ueckeQIEnl'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, x2AqPHq2qhLej4XYqg.cs	High entropy of concatenated method names: 'QoIPN1ljCY', 'B0WPaOkxZO', 'A3tP9aiSEI', 'ToString', 'HsiP3vy0jA', 'e2sPMT2cGD', 'VmfrR0l3MWhDe4bkGsg', 'UBP4OtlNENICldRnPou', 'VU6ZITlrYnYsgKZkO7Q', 'OFxHAyly07COCRvgANx'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, flsNFv1jqRn4UFfbYv.cs	High entropy of concatenated method names: 'AK1Yuw30dv', 'DMNYDKofPr', 't1tiO2Iai7', 'gi5iIVjKpB', 'Xp4YpUP5CX', 'M75Yhl2fHN', 'EG4Y81lKAP', 'qmWYmw7roK', 'lAHYnUmdON', 'EwkYNZeps6'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, qVbjiYeg51FIPLgDide.cs	High entropy of concatenated method names: 'zwH4cUCJDl', 'vdX4ZNxuaD', 'LOa4Sx6V7l', 'uFB4fUUoZO', 'Oft4FIqtry', 'Qce4TCe74A', 'wl345clhix', 't2K4Red2VO', 'Y4M4GK1488', 'HmA4Xk0S9m'
Source: 0.2.HUED23EDE5UGRFQ.exe.3965450.0.raw.unpack, yxkao7hiFSsCxJrj6x.cs	High entropy of concatenated method names: 'Dispose', 'scYIg4SsGH', 'NsG2UcEpqL', 'aYvjjmHQdT', 'xXHIDRqdFg', 'sCgIzqmx7K', 'ProcessDialogKey', 'FDb2ONo6rM', 'XZY2IVTUPT', 'fVb22oh36r'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, VrKmqeMx6E5LwgMLC4.cs	High entropy of concatenated method names: 'Hk4PbZ6o4W', 'VnOPQM2EvY', 'dQ3PAdMbr5', 'RrjPkQgbk9', 'GdUPvUwXie', 'Iu5A9QMDGZ', 'swAA3J5jSD', 'OGQAMjonbp', 'IlVAubPjAv', 'uaTAgVOgfP'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, IAZmwL4UXY1NmAmY0w.cs	High entropy of concatenated method names: 'x4dwfjD7lx', 'bXNwTXmSlW', 'x6ZwRUCnTU', 'nDKwGUZ9cB', 'ooGws6yYUT', 'Jg3woJxfib', 'tv3wYmOAms', 'sDAwiXeBJ8', 'AGbw4tPchd', 'uBYw7cABxV'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, EdXujie0QO3KCWsV9Qe.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'EWw7myx8Xg', 'tgM7nSnlDS', 'WYx7NdtG5s', 'QWL7aFNuWN', 'aLJ79vHwDM', 'Jim730CBsR', 'oHm7MWbIT6'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, hlyFOV3NjigwVy9fWY.cs	High entropy of concatenated method names: 'qDsKRXhbuX', 'fyJKGAkTmK', 'Nm5Kq5QiVA', 'sehKUAXuPH', 'MWOK0HHkTE', 'lxkKElCtxW', 'qcVKWrPrIx', 'zWDKxmvBnu', 'UbiK1N4cM5', 'wBjKpj5Qcw'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, IhhE4IzvotpcF7E1nA.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gxD4K2YmEV', 'rtj4s9kOKg', 'bcr4oIWZjq', 'TNr4YvISuw', 'jGW4iHoZYy', 'rmj44epd0y', 'i3A47A7BEN'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, omVVIsy4JEq4JnFNAX.cs	High entropy of concatenated method names: 'EgDSs6MYC', 'jYxfUQvu8', 'yUCTwEpHm', 'bOu5YFQOJ', 'w4PGF4JH8', 'ANyXrZKI8', 'klr8eTiECNQnABjAq9', 'gJgGq5P51BjqKhEsa3', 'nhji4jqOJ', 'gjb7kQr5c'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, LSEQgSWw6PFKkwBvUW.cs	High entropy of concatenated method names: 'Q2m4IAvWFa', 'TSd4yo1BkD', 'chP4e03fj1', 'Joh4Jx8hrE', 'Udn4Q1UQbF', 'Ohb4AbKENj', 'lZd4Pwy1Ah', 'D4LiMCDf3c', 'Fediuk7eN7', 'Mycigmo5s5'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, C5Fi006NlErAQ6vXTa.cs	High entropy of concatenated method names: 'rM5YBeiIku', 'dT1YrB7yhh', 'ToString', 'Ao3YJ0DXSw', 'E3XYQYK3cL', 'gWnYwMF2Vj', 'HFKYAbWJkm', 'w5bYPoqBjv', 'gQQYkPE11J', 'RHdYvwLqhL'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, n026WbD77LwpII4skq.cs	High entropy of concatenated method names: 'lJHAFjLdXH', 'AsMA5B816f', 'vfrwtn6SYn', 'vHuw0lcSKs', 'vnUwEc939r', 'UB3wCmGo0e', 'lRXwWRdJ55', 'G12wxZTVE2', 'XLqwdOpbpe', 'BiAw16wqCc'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, QUsUCJZYbbjkgd53fi.cs	High entropy of concatenated method names: 'Jt1Ik8ZB02', 'shyIvcio2y', 'vlbIBjhP3D', 'N11Irfslj0', 'gGjIsOHOSk', 'uwiIoisVXe', 'WsVbIsEdoSd1VYCdns', 'VdMVqG0teZ9AKdHlWT', 'dbyIIL1OnQ', 'mv8IyFivtb'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, KevtKNusq8g1AfXZ5c.cs	High entropy of concatenated method names: 'BaskcxbOHJ', 'LYukZdPo3O', 'HX9kSewxDQ', 'NvykfmtBjl', 'M5ikFbNDVL', 'UsokTm9dBM', 'DGKk5ldC6t', 'SDwkRX5ySJ', 'V9vkGpn5Zb', 'WvkkXS8vqt'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, ihbe3xiO3YppFp0VLe.cs	High entropy of concatenated method names: 'pt5yb7OWcw', 'XFRyJUg1wV', 'NnHyQgEXDc', 'oyQywJoPli', 't8YyA8yUdn', 'N7QyP3H2AE', 'sjiykyXWgr', 'rGsyvLuMG5', 'v95y6xTj0e', 'oWXyBiLwIp'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, O7QaxOP1WHfuKiysCB.cs	High entropy of concatenated method names: 'iF1iqN2Ix7', 'qyJiUJAgbi', 'atRitsUWSG', 'UoEi0ZTDMw', 'dquimOLOel', 'cZ3iEOe2tr', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, UsNrrbl72Ir1JF4Inh.cs	High entropy of concatenated method names: 'RR5iJQSZlT', 'aM7iQBhrAS', 'EZKiwuLK8J', 'hDPiAhGv1Q', 'GGJiPL0pxD', 'vegikF3Qys', 'Qrwivv9eID', 'pOEi6NrRx0', 'xqfiBhaXAK', 'eR8irPgAc5'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, ULLvmxT725yvDGgCf2.cs	High entropy of concatenated method names: 'Kufs1jK0Hw', 'DIrshoW4RW', 'zFvsmLWmUu', 'lwisncaH5M', 'bBEsUdMnPP', 'w0kstIFyvh', 'I1ls0VZ5DC', 'tNWsEiwVEj', 'MkwsCcVV2Q', 'caEsWea0Dc'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, DSSwTQO1NWXixqGlCL.cs	High entropy of concatenated method names: 'zlBQmA66Lh', 'EEQQnjJRDT', 'A1eQNBJOhJ', 'P55Qaden2w', 't1bQ96PaJw', 'HNyQ3WKvm1', 'yClQMfqAY5', 'AODQuFaXhT', 'j5aQg4rj8o', 'alRQDH46qh'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, oT9uaNmRpGhyBXALGV.cs	High entropy of concatenated method names: 'O8VkJWd4Cf', 'bbLkwssU52', 'quRkPAjuXO', 'KmOPD0dkpB', 's50PzKtHQL', 'xX2kOGa260', 'TAdkI3bhaB', 'TBdk2twsMf', 'Acwky4QwXT', 'ueckeQIEnl'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, x2AqPHq2qhLej4XYqg.cs	High entropy of concatenated method names: 'QoIPN1ljCY', 'B0WPaOkxZO', 'A3tP9aiSEI', 'ToString', 'HsiP3vy0jA', 'e2sPMT2cGD', 'VmfrR0l3MWhDe4bkGsg', 'UBP4OtlNENICldRnPou', 'VU6ZITlrYnYsgKZkO7Q', 'OFxHAyly07COCRvgANx'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, flsNFv1jqRn4UFfbYv.cs	High entropy of concatenated method names: 'AK1Yuw30dv', 'DMNYDKofPr', 't1tiO2Iai7', 'gi5iIVjKpB', 'Xp4YpUP5CX', 'M75Yhl2fHN', 'EG4Y81lKAP', 'qmWYmw7roK', 'lAHYnUmdON', 'EwkYNZeps6'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, qVbjiYeg51FIPLgDide.cs	High entropy of concatenated method names: 'zwH4cUCJDl', 'vdX4ZNxuaD', 'LOa4Sx6V7l', 'uFB4fUUoZO', 'Oft4FIqtry', 'Qce4TCe74A', 'wl345clhix', 't2K4Red2VO', 'Y4M4GK1488', 'HmA4Xk0S9m'
Source: 0.2.HUED23EDE5UGRFQ.exe.38aae30.1.raw.unpack, yxkao7hiFSsCxJrj6x.cs	High entropy of concatenated method names: 'Dispose', 'scYIg4SsGH', 'NsG2UcEpqL', 'aYvjjmHQdT', 'xXHIDRqdFg', 'sCgIzqmx7K', 'ProcessDialogKey', 'FDb2ONo6rM', 'XZY2IVTUPT', 'fVb22oh36r'

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_00406EB0 ShellExecuteW,URLDownloadToFileW,

17_2_00406EB0

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

File created: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jdSldfVS" /XML "C:\Users\user\AppData\Local\Temp\tmpAF95.tmp"

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

17_2_0041AA4A

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

17_2_0041CB50

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: jdSldfVS.exe PID: 6124, type: MEMORYSTR

Delayed program exit found

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_0040F7A7 Sleep,ExitProcess,

17_2_0040F7A7

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Memory allocated: AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Memory allocated: 2490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Memory allocated: 4490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Memory allocated: 77C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Memory allocated: 87C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Memory allocated: 8980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Memory allocated: 9980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Memory allocated: 1590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Memory allocated: 3210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Memory allocated: 2FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Memory allocated: 8060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Memory allocated: 9060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Memory allocated: 9210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Memory allocated: A210000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

17_2_0041A748

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6616	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 371	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6564	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 398	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Window / User API: threadDelayed 409	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Window / User API: threadDelayed 9065	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Window / User API: foregroundWindowGot 1771	Jump to behavior

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

API coverage: 6.4 %

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe TID: 1012	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3532	Thread sleep count: 6616 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3532	Thread sleep count: 371 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6044	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2304	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6244	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe TID: 4088	Thread sleep count: 252 > 30	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe TID: 4088	Thread sleep time: -126000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe TID: 3328	Thread sleep count: 409 > 30	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe TID: 3328	Thread sleep time: -1227000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe TID: 3328	Thread sleep count: 9065 > 30	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe TID: 3328	Thread sleep time: -27195000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe TID: 4196	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	17_2_00409253
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	17_2_0041C291
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	17_2_0040C34D
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	17_2_00409665
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0044E879 FindFirstFileExA,	17_2_0044E879
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	17_2_0040880C
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0040783C FindFirstFileW,FindNextFileW,	17_2_0040783C
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	17_2_00419AF5
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	17_2_0040BB30
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	17_2_0040BD37

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

17_2_00407C97

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001078000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3
Source: HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001078000.00000004.00000020.00020000.00000000.sdmp, HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001007000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

17_2_004349F9

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

17_2_0041CB50

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_004432B5 mov eax, dword ptr fs:[00000030h]

17_2_004432B5

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_00412077 GetProcessHeap,HeapFree,

17_2_00412077

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_004349F9
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00434B47 SetUnhandledExceptionFilter,	17_2_00434B47
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_0043BB22
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: 17_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_00434FDC

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe"
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\jdSldfVS.exe"
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\jdSldfVS.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Memory written: C:\Users\user\AppData\Roaming\jdSldfVS.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

17_2_004120F7

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_00419627 mouse_event,

17_2_00419627

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\jdSldfVS.exe"	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jdSldfVS" /XML "C:\Users\user\AppData\Local\Temp\tmpAF95.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Process created: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe "C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jdSldfVS" /XML "C:\Users\user\AppData\Local\Temp\tmpBFB2.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process created: C:\Users\user\AppData\Roaming\jdSldfVS.exe "C:\Users\user\AppData\Roaming\jdSldfVS.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process created: C:\Users\user\AppData\Roaming\jdSldfVS.exe "C:\Users\user\AppData\Roaming\jdSldfVS.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Process created: C:\Users\user\AppData\Roaming\jdSldfVS.exe "C:\Users\user\AppData\Roaming\jdSldfVS.exe"	Jump to behavior

Source: HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001041000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerPV\9`
Source: HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001007000.00000004.00000020.00020000.00000000.sdmp, HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001041000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001041000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerPV\]`
Source: HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001041000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerPV\13B`
Source: HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001041000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerPV\
Source: HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001041000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerB~P
Source: HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001041000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001007000.00000004.00000020.00020000.00000000.sdmp, HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001041000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001007000.00000004.00000020.00020000.00000000.sdmp, logs.dat.9.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_00434C52 cpuid

17_2_00434C52

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: EnumSystemLocalesW,	17_2_00452036
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	17_2_004520C3
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: GetLocaleInfoW,	17_2_00452313
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: EnumSystemLocalesW,	17_2_00448404
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	17_2_0045243C
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: GetLocaleInfoW,	17_2_00452543
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	17_2_00452610
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: GetLocaleInfoA,	17_2_0040F8D1
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: GetLocaleInfoW,	17_2_004488ED
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	17_2_00451CD8
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: EnumSystemLocalesW,	17_2_00451F50
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: EnumSystemLocalesW,	17_2_00451F9B

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Queries volume information: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Queries volume information: C:\Users\user\AppData\Roaming\jdSldfVS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_0040B164 GetLocalTime,wsprintfW,

17_2_0040B164

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_0041B60D GetUserNameW,

17_2_0041B60D

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: 17_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

17_2_00449190

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 17.2.jdSldfVS.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42782c0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.jdSldfVS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42f0ce0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42f0ce0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42782c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4580750131.0000000002B6F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4577861683.0000000001007000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2185308624.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2170172636.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2208800454.0000000004278000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUED23EDE5UGRFQ.exe PID: 2820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HUED23EDE5UGRFQ.exe PID: 4896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jdSldfVS.exe PID: 6124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jdSldfVS.exe PID: 6996, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

17_2_0040BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		17_2_0040BB30
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Code function: \key3.db		17_2_0040BB30

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-HKC0PV			Jump to behavior
Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-HKC0PV

Source: Yara match	File source: 17.2.jdSldfVS.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42782c0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.jdSldfVS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42f0ce0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.356f910.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUED23EDE5UGRFQ.exe.34f6ef0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42f0ce0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jdSldfVS.exe.42782c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4580750131.0000000002B6F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4577861683.0000000001007000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2185308624.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2170172636.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2208800454.0000000004278000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUED23EDE5UGRFQ.exe PID: 2820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HUED23EDE5UGRFQ.exe PID: 4896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jdSldfVS.exe PID: 6124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jdSldfVS.exe PID: 6996, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Code function: cmd.exe

17_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Access Token Manipulation	4 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	1 Windows Service	12 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	122 Process Injection	1 DLL Side-Loading	LSA Secrets	33 System Information Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	1 Bypass User Account Control	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	12 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	122 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
HUED23EDE5UGRFQ.exe	32%	ReversingLabs	ByteCode-MSIL.Trojan.XWorm
HUED23EDE5UGRFQ.exe	100%	Avira	HEUR/AGEN.1308776
HUED23EDE5UGRFQ.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\jdSldfVS.exe	100%	Avira	HEUR/AGEN.1308776
C:\Users\user\AppData\Roaming\jdSldfVS.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\jdSldfVS.exe	32%	ReversingLabs	ByteCode-MSIL.Trojan.XWorm

Source	Detection	Scanner	Label
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://geoplugin.net/json.gpiiB	0%	Avira URL Cloud	safe
94.156.69.93	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpl	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown
94.156.69.93	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp/C	HUED23EDE5UGRFQ.exe, 00000000.00000002.2170172636.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, jdSldfVS.exe, 0000000A.00000002.2208800454.0000000004278000.00000004.00000800.00020000.00000000.sdmp, jdSldfVS.exe, 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpl	HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001041000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	HUED23EDE5UGRFQ.exe, 00000000.00000002.2168229174.0000000002491000.00000004.00000800.00020000.00000000.sdmp, jdSldfVS.exe, 0000000A.00000002.2206237212.0000000003211000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpiiB	HUED23EDE5UGRFQ.exe, 00000009.00000002.4577861683.0000000001041000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.156.69.93	unknown	Bulgaria		31420	TERASYST-ASBG	true
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465543
Start date and time:	2024-07-01 19:41:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HUED23EDE5UGRFQ.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@23/17@1/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 98% Number of executed functions: 171 Number of non-executed functions: 220
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target HUED23EDE5UGRFQ.exe, PID 4896 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: HUED23EDE5UGRFQ.exe

Simulations

Behavior and APIs

Time	Type	Description
13:41:56	API Interceptor	7614019x Sleep call for process: HUED23EDE5UGRFQ.exe modified
13:41:58	API Interceptor	33x Sleep call for process: powershell.exe modified
13:42:01	API Interceptor	1x Sleep call for process: jdSldfVS.exe modified
19:41:58	Task Scheduler	Run new task: jdSldfVS path: C:\Users\user\AppData\Roaming\jdSldfVS.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
94.156.69.93	UHUH45EDRFQ.exe	Get hash	malicious	Remcos	Browse
178.237.33.50	DHL Shipping Document Awb & BL.vbs	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	tWitaq427K.exe	Get hash	malicious	Remcos, AgentTesla	Browse	geoplugin.net/json.gp
	TOP URGENT PURCHASE ORDER SHEET & SPECIFICATIONS.vbs	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	Offer ZI-0428.doc	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	cKiTq7RRCn.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Quotation.xls	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	awb_shipping_post_01072024224782020031808174CN18010724000000124(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	Maersk_BL_Invoice_Packinglist.vbs	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geoplugin.net	DHL Shipping Document Awb & BL.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	tWitaq427K.exe	Get hash	malicious	Remcos, AgentTesla	Browse	178.237.33.50
	TOP URGENT PURCHASE ORDER SHEET & SPECIFICATIONS.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	Offer ZI-0428.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	cKiTq7RRCn.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	178.237.33.50
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	178.237.33.50
	Quotation.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	awb_shipping_post_01072024224782020031808174CN18010724000000124(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	Maersk_BL_Invoice_Packinglist.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TERASYST-ASBG	s1C1DWgj73.elf	Get hash	malicious	Mirai	Browse	94.156.67.161
	ScjfNQG5l0.elf	Get hash	malicious	Unknown	Browse	94.156.67.161
	Jieok44uQ5.elf	Get hash	malicious	Mirai	Browse	94.156.67.161
	94.156.67.161-mips-2024-07-01T10_28_03.elf	Get hash	malicious	Mirai	Browse	94.156.67.161
	94.156.67.161-arm-2024-07-01T10_28_03.elf	Get hash	malicious	Unknown	Browse	94.156.67.161
	UHUH45EDRFQ.exe	Get hash	malicious	Remcos	Browse	94.156.69.93
	0GrL5SShus.exe	Get hash	malicious	XWorm	Browse	94.156.68.110
	9444f34a94d494a78e19e19f4e1615744e500aca97a56.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	94.156.68.153
	9mgWSJhsD0.rtf	Get hash	malicious	Remcos	Browse	94.156.68.221
	1719515826e3bb9af6f04480ac892d4c6a17ba1a711cc73b126620af7dbb5bfec4a271373f775.dat-decoded.exe	Get hash	malicious	Remcos	Browse	94.156.68.221
ATOM86-ASATOM86NL	DHL Shipping Document Awb & BL.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	tWitaq427K.exe	Get hash	malicious	Remcos, AgentTesla	Browse	178.237.33.50
	TOP URGENT PURCHASE ORDER SHEET & SPECIFICATIONS.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	Offer ZI-0428.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	cKiTq7RRCn.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	178.237.33.50
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	178.237.33.50
	Quotation.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	awb_shipping_post_01072024224782020031808174CN18010724000000124(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	Maersk_BL_Invoice_Packinglist.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50

Process:	C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe
File Type:	data
Category:	dropped
Size (bytes):	224
Entropy (8bit):	3.4354190470227914
Encrypted:	false
SSDEEP:	3:rhlKlVmNlN3Yb5JWRal2Jl+7R0DAlBG45klovDl65lQWluEkiEW/ufWPlgMlRQln:6lVMPYb5YcIeeDAlOWA7DxbN2fBMMm0v
MD5:	4CF845C6F4D24FFDB8AE19EB917DCAE7
SHA1:	14A1E843A9B5DF883CC6D0F74341DDDE22EC5C7A
SHA-256:	C4D52FDB08880FDA02E3A4F182935D08F3AE7A129CAED0D826C5CA8FDFAA4B79
SHA-512:	4F2DFE1EA57F5E7D529E94DC24C1B8302DBCA1222C7B3DC07EDAE3A43C19ECABB6409BC174B7DCEC72490969E0B814F283E154E6EEE54F3FC92660FD41B4FF38
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.4./.0.7./.0.1. .1.3.:.4.1.:.5.8. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........{. .U.s.e.r. .h.a.s. .b.e.e.n. .i.d.l.e. .f.o.r. .0. .m.i.n.u.t.e.s. .}.....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HUED23EDE5UGRFQ.exe.log

Process:	C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jdSldfVS.exe.log

Process:	C:\Users\user\AppData\Roaming\jdSldfVS.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Process:	C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.012309356796613
Encrypted:	false
SSDEEP:	12:tklu+mnd66GkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkwV:qlu+KdbauKyGX85jvXhNlT3/7AcV9Wro
MD5:	14B479958E659C5A4480548A393022AC
SHA1:	CD0766C1DAB80656D469ABDB22917BE668622015
SHA-256:	0F92BDD807D2F5C9947E1775A20231233043C171F62E1AFA705A7E7938909BFE
SHA-512:	4E87CA47392DD9710F9E3D4A2124A34B41938986A4F43D50A48623DB1838C0D6CFF05FD2A23792DCD5A974A94416C97DC04ECEF85025FC785F3393B69A0B1DC5
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"0ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380192968514367
Encrypted:	false
SSDEEP:	48:+WSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugeC/ZPUyus:+LHyIFKL3IZ2KRH9Oug8s
MD5:	E3EC01FAB7E327602A9550342FA73464
SHA1:	7F06C78BA2496A8DDB3DDCD63BAF741CB8C84886
SHA-256:	4ECCD285FCD821659092ADB47638B559656F97512183BA76AEE2760D531273C5
SHA-512:	B66B707510DE1B0AA29F65F1C99BDEEBDC4D34EC3D9950B62E17058D2E5B1599C85A09EC056F1C4BCE019213485F1E3D7E9D68651890A853819F98DBF2492407
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qoqftdm.xej.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_drg11gux.d1n.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eydoxywx.z2h.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fqhikuo2.jtt.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jt3rqlf2.rqb.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vrrnp4pv.kln.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wg514shz.w0u.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xdgz0ssf.ujp.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpAF95.tmp

Process:	C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1595
Entropy (8bit):	5.09524540039865
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtL/6xvn:cge7QYrFdOFzOzN33ODOiDdKrsuTjOv
MD5:	0454D4DBB6AA05FB8AA823FCDC9A6CC4
SHA1:	34BE814378D1B6517891265C19EABEA09F9C65E4
SHA-256:	130E0A8D3B3614B64F798CA2A91EE19C43B559820E145769E4F1E5E8BC8C2C0A
SHA-512:	1EC2C48011DCAFC916594ECD992704D17C14BE51BFA9043B53BFAF8FA29160EBAF1F5A775163BE9DC06AA2304AC24A21C9D6304BD0FF09254C5B47111F92FE96
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Local\Temp\tmpBFB2.tmp

Process:	C:\Users\user\AppData\Roaming\jdSldfVS.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1595
Entropy (8bit):	5.09524540039865
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtL/6xvn:cge7QYrFdOFzOzN33ODOiDdKrsuTjOv
MD5:	0454D4DBB6AA05FB8AA823FCDC9A6CC4
SHA1:	34BE814378D1B6517891265C19EABEA09F9C65E4
SHA-256:	130E0A8D3B3614B64F798CA2A91EE19C43B559820E145769E4F1E5E8BC8C2C0A
SHA-512:	1EC2C48011DCAFC916594ECD992704D17C14BE51BFA9043B53BFAF8FA29160EBAF1F5A775163BE9DC06AA2304AC24A21C9D6304BD0FF09254C5B47111F92FE96
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Roaming\jdSldfVS.exe

Process:	C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1011712
Entropy (8bit):	7.795064861179612
Encrypted:	false
SSDEEP:	24576:OGIRtbsb56UfvzYc0UuGwsZIazwvZgiLF7i8eTqCs:mtgzZgscZfLFPr
MD5:	EA0D00B95A91C801893B5526347170BB
SHA1:	26D81494EB3C0FD67A6037DBD68E3BF8C7677D0D
SHA-256:	6B585CAAF4299C406C45A3BEB76A8624D159404E1AAC48A292976119C6D9B72C
SHA-512:	3B06324A0CB87E821DDC9980A23C68FD886F0A6EE639CE6E349ADF3CD9C17E07AA129218C237338317907EF291FF45485E7FA7EFADBC1C019B342D1B6D8731BB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f..............0.................. ........@.. ....................................@.................................d...O.......T............................................................................ ............... ..H............text........ ...................... ..`.rsrc...T...........................@..@.reloc...............h..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jdSldfVS.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.795064861179612
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	HUED23EDE5UGRFQ.exe
File size:	1'011'712 bytes
MD5:	ea0d00b95a91c801893b5526347170bb
SHA1:	26d81494eb3c0fd67a6037dbd68e3bf8c7677d0d
SHA256:	6b585caaf4299c406c45a3beb76a8624d159404e1aac48a292976119c6d9b72c
SHA512:	3b06324a0cb87e821ddc9980a23c68fd886f0a6ee639ce6e349adf3cd9c17e07aa129218c237338317907ef291ff45485e7fa7efadbc1c019b342d1b6d8731bb
SSDEEP:	24576:OGIRtbsb56UfvzYc0UuGwsZIazwvZgiLF7i8eTqCs:mtgzZgscZfLFPr
TLSH:	2F2501C2E5908682ED295F7810366C640377BE767CB5E28D9D4DB0B16BF37A70422D8B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	1103212484000000

Static PE Info

General

Entrypoint:	0x4deeb6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6682DD86 [Mon Jul 1 16:47:02 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdee64	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe0000	0x18a54	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xdcebc	0xdd000	eeb374652e0640e661390343b550f12f	False	0.9691896740667421	OpenPGP Public Key	7.9794014993218445	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe0000	0x18a54	0x19000	2a958b86e9eac7dc11d5316f6c4eb566	False	0.18439453125	data	3.238054128897843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfa000	0xc	0x800	f353ee3eb698afe9dd364954c62fb864	False	0.01611328125	data	0.03037337037012526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xe01d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 23622 x 23622 px/m	0.3324468085106383
RT_ICON	0xe0640	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 23622 x 23622 px/m	0.25117260787992496
RT_ICON	0xe16e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 23622 x 23622 px/m	0.2183609958506224
RT_ICON	0xe3c90	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 23622 x 23622 px/m	0.19550070854983467
RT_ICON	0xe7eb8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 23622 x 23622 px/m	0.1723796285342482
RT_GROUP_ICON	0xf86e0	0x4c	data	0.75
RT_GROUP_ICON	0xf872c	0x14	data	1.05
RT_VERSION	0xf8740	0x312	data	0.43638676844783714

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/01/24-19:44:18.352759	TCP	2032777	ET TROJAN Remcos 3.x Unencrypted Server Response	2973	49712	94.156.69.93	192.168.2.6
07/01/24-19:41:59.286996	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49712	2973	192.168.2.6	94.156.69.93

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 19:41:59.280551910 CEST	49712	2973	192.168.2.6	94.156.69.93
Jul 1, 2024 19:41:59.285382986 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:41:59.285702944 CEST	49712	2973	192.168.2.6	94.156.69.93
Jul 1, 2024 19:41:59.286995888 CEST	49712	2973	192.168.2.6	94.156.69.93
Jul 1, 2024 19:41:59.291820049 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:42:00.880173922 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:42:00.904875040 CEST	49712	2973	192.168.2.6	94.156.69.93
Jul 1, 2024 19:42:00.909691095 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:42:01.010234118 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:42:01.128710985 CEST	49712	2973	192.168.2.6	94.156.69.93
Jul 1, 2024 19:42:02.228837967 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 1, 2024 19:42:02.233824968 CEST	80	49715	178.237.33.50	192.168.2.6
Jul 1, 2024 19:42:02.233891010 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 1, 2024 19:42:02.235013008 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 1, 2024 19:42:02.240540028 CEST	80	49715	178.237.33.50	192.168.2.6
Jul 1, 2024 19:42:02.858299971 CEST	80	49715	178.237.33.50	192.168.2.6
Jul 1, 2024 19:42:02.858437061 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 1, 2024 19:42:02.871731043 CEST	49712	2973	192.168.2.6	94.156.69.93
Jul 1, 2024 19:42:02.876640081 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:42:03.858366013 CEST	80	49715	178.237.33.50	192.168.2.6
Jul 1, 2024 19:42:03.858416080 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 1, 2024 19:42:17.700526953 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:42:17.702244997 CEST	49712	2973	192.168.2.6	94.156.69.93
Jul 1, 2024 19:42:17.707052946 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:42:47.754066944 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:42:47.755279064 CEST	49712	2973	192.168.2.6	94.156.69.93
Jul 1, 2024 19:42:47.760703087 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:43:17.767117023 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:43:17.769068003 CEST	49712	2973	192.168.2.6	94.156.69.93
Jul 1, 2024 19:43:17.775547028 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:43:48.222774029 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:43:48.225577116 CEST	49712	2973	192.168.2.6	94.156.69.93
Jul 1, 2024 19:43:48.232368946 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:43:52.176400900 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 1, 2024 19:43:52.503951073 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 1, 2024 19:43:53.206918955 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 1, 2024 19:43:54.503787041 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 1, 2024 19:43:57.003794909 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 1, 2024 19:44:01.910087109 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 1, 2024 19:44:11.707464933 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 1, 2024 19:44:18.352758884 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:44:18.355592012 CEST	49712	2973	192.168.2.6	94.156.69.93
Jul 1, 2024 19:44:18.360419989 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:44:49.272547960 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:44:49.277657032 CEST	49712	2973	192.168.2.6	94.156.69.93
Jul 1, 2024 19:44:49.282766104 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:45:20.157531023 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:45:20.160970926 CEST	49712	2973	192.168.2.6	94.156.69.93
Jul 1, 2024 19:45:20.166017056 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:45:50.248716116 CEST	2973	49712	94.156.69.93	192.168.2.6
Jul 1, 2024 19:45:50.252813101 CEST	49712	2973	192.168.2.6	94.156.69.93
Jul 1, 2024 19:45:50.257771969 CEST	2973	49712	94.156.69.93	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 19:42:02.210078955 CEST	54801	53	192.168.2.6	1.1.1.1
Jul 1, 2024 19:42:02.219374895 CEST	53	54801	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 1, 2024 19:42:02.210078955 CEST	192.168.2.6	1.1.1.1	0x772d	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 1, 2024 19:42:02.219374895 CEST	1.1.1.1	192.168.2.6	0x772d	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	178.237.33.50	80	4896	C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:42:02.235013008 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Jul 1, 2024 19:42:02.858299971 CEST	1170	IN	HTTP/1.1 200 OK date: Mon, 01 Jul 2024 17:42:02 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 30 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"0ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	13:41:56
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe"
Imagebase:	0x50000
File size:	1'011'712 bytes
MD5 hash:	EA0D00B95A91C801893B5526347170BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2170172636.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2170172636.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2170172636.00000000034F6000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	13:41:57
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe"
Imagebase:	0xf30000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	13:41:57
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	13:41:57
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\jdSldfVS.exe"
Imagebase:	0xf30000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	13:41:57
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	13:41:57
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jdSldfVS" /XML "C:\Users\user\AppData\Local\Temp\tmpAF95.tmp"
Imagebase:	0x820000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	13:41:57
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	13:41:58
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HUED23EDE5UGRFQ.exe"
Imagebase:	0x9a0000
File size:	1'011'712 bytes
MD5 hash:	EA0D00B95A91C801893B5526347170BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000009.00000002.4580750131.0000000002B6F000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000009.00000002.4577861683.0000000001007000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	10
Start time:	13:41:58
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\jdSldfVS.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jdSldfVS.exe
Imagebase:	0xd90000
File size:	1'011'712 bytes
MD5 hash:	EA0D00B95A91C801893B5526347170BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.2208800454.0000000004278000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.2208800454.0000000004278000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.2208800454.0000000004278000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	13:41:59
Start date:	01/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	13:42:02
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jdSldfVS" /XML "C:\Users\user\AppData\Local\Temp\tmpBFB2.tmp"
Imagebase:	0x820000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	13:42:02
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	13:42:02
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\jdSldfVS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\jdSldfVS.exe"
Imagebase:	0x2a0000
File size:	1'011'712 bytes
MD5 hash:	EA0D00B95A91C801893B5526347170BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	16
Start time:	13:42:02
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\jdSldfVS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\jdSldfVS.exe"
Imagebase:	0x3a0000
File size:	1'011'712 bytes
MD5 hash:	EA0D00B95A91C801893B5526347170BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	17
Start time:	13:42:02
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\jdSldfVS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\jdSldfVS.exe"
Imagebase:	0x5b0000
File size:	1'011'712 bytes
MD5 hash:	EA0D00B95A91C801893B5526347170BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000011.00000002.2185308624.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000011.00000002.2184795000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true