Windows Analysis Report
z1ProductSampleRequirement.exe

AI detected suspicious sample

Source: Yara match	File source: 14.2.XyLTxdgHV.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.41cc6c8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.4241ce8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.XyLTxdgHV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.4241ce8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.41cc6c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4498177592.0000000001197000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4498721754.0000000002D2F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4498177592.00000000011D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2105358568.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4498177592.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2129497203.00000000041CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2088133445.000000000499B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z1ProductSampleRequirement.exe PID: 1892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z1ProductSampleRequirement.exe PID: 5708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XyLTxdgHV.exe PID: 7248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XyLTxdgHV.exe PID: 7388, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: z1ProductSampleRequirement.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_004315EC CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

14_2_004315EC

Source: z1ProductSampleRequirement.exe, 00000000.00000002.2088133445.000000000499B000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_a681f401-6

Source: z1ProductSampleRequirement.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: z1ProductSampleRequirement.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: pYIN.pdbSHA256 source: z1ProductSampleRequirement.exe, XyLTxdgHV.exe.0.dr
Source:	Binary string: pYIN.pdb source: z1ProductSampleRequirement.exe, XyLTxdgHV.exe.0.dr

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0041A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	14_2_0041A01B
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0040B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	14_2_0040B28E
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0040838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	14_2_0040838E
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_004087A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	14_2_004087A0
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00407848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	14_2_00407848
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_004068CD FindFirstFileW,FindNextFileW,	14_2_004068CD
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0044BA59 FindFirstFileExA,	14_2_0044BA59
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0040AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	14_2_0040AA71
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00417AAB FindFirstFileW,FindNextFileW,FindNextFileW,	14_2_00417AAB
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0040AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	14_2_0040AC78

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_00406D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

14_2_00406D28

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 4x nop then jmp 02AD10F2h	0_2_02AD11C6
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 4x nop then jmp 02AD10F2h	0_2_02AD130F
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 4x nop then jmp 0AA504DAh	11_2_0AA505AE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49707 -> 51.75.166.98:2195

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: teebro1800.dynamic-dns.net

Source: global traffic

TCP traffic: 192.168.2.5:49707 -> 51.75.166.98:2195

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49708 -> 178.237.33.50:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.5:49711
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.5:49922

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_0041936B InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

14_2_0041936B

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: teebro1800.dynamic-dns.net
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.00000000011D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.0000000001197000.00000004.00000020.00020000.00000000.sdmp, z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.00000000011D7000.00000004.00000020.00020000.00000000.sdmp, z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, XyLTxdgHV.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp$
Source: z1ProductSampleRequirement.exe, 00000000.00000002.2088133445.000000000499B000.00000004.00000800.00020000.00000000.sdmp, XyLTxdgHV.exe, 0000000B.00000002.2129497203.00000000041CC000.00000004.00000800.00020000.00000000.sdmp, XyLTxdgHV.exe, 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.00000000011D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpm
Source: z1ProductSampleRequirement.exe, 00000000.00000002.2087574819.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, XyLTxdgHV.exe, 0000000B.00000002.2126394543.000000000255A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: z1ProductSampleRequirement.exe, XyLTxdgHV.exe.0.dr	String found in binary or memory: http://tempuri.org/DataSet1.xsd

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_00409340 SetWindowsHookExA 0000000D,0040932C,00000000

14_2_00409340

Installs a global keyboard hook

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\z1ProductSampleRequirement.exe

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_0040A65A OpenClipboard,GetClipboardData,CloseClipboard,

14_2_0040A65A

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_00414EC1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

14_2_00414EC1

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_0040A65A OpenClipboard,GetClipboardData,CloseClipboard,

14_2_0040A65A

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_00409468 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,

14_2_00409468

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 14.2.XyLTxdgHV.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.41cc6c8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.4241ce8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.XyLTxdgHV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.4241ce8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.41cc6c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4498177592.0000000001197000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4498721754.0000000002D2F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4498177592.00000000011D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2105358568.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4498177592.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2129497203.00000000041CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2088133445.000000000499B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z1ProductSampleRequirement.exe PID: 1892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z1ProductSampleRequirement.exe PID: 5708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XyLTxdgHV.exe PID: 7248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XyLTxdgHV.exe PID: 7388, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_0041A76C SystemParametersInfoW,

14_2_0041A76C

System Summary

Malicious sample detected (through community Yara rule)

Source: 14.2.XyLTxdgHV.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 14.2.XyLTxdgHV.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.2.XyLTxdgHV.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 11.2.XyLTxdgHV.exe.41cc6c8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.XyLTxdgHV.exe.41cc6c8.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.XyLTxdgHV.exe.41cc6c8.1.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 11.2.XyLTxdgHV.exe.4241ce8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.XyLTxdgHV.exe.4241ce8.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.XyLTxdgHV.exe.4241ce8.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 14.2.XyLTxdgHV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 14.2.XyLTxdgHV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.2.XyLTxdgHV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 11.2.XyLTxdgHV.exe.4241ce8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.XyLTxdgHV.exe.4241ce8.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 11.2.XyLTxdgHV.exe.41cc6c8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.XyLTxdgHV.exe.41cc6c8.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0000000B.00000002.2129497203.00000000041CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.2088133445.000000000499B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: z1ProductSampleRequirement.exe PID: 1892, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: XyLTxdgHV.exe PID: 7248, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: XyLTxdgHV.exe PID: 7388, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_00414DB4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

14_2_00414DB4

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_012C4204	0_2_012C4204
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_012CE134	0_2_012CE134
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_012C7018	0_2_012C7018
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_02AD2D90	0_2_02AD2D90
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_02AD43A8	0_2_02AD43A8
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_07540E28	0_2_07540E28
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_07546AC9	0_2_07546AC9
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_0754A618	0_2_0754A618
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_0754B2C0	0_2_0754B2C0
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_075430D0	0_2_075430D0
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_07543F77	0_2_07543F77
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_07543F88	0_2_07543F88
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_0754AE78	0_2_0754AE78
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_07540E21	0_2_07540E21
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_0754AE88	0_2_0754AE88
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_07543CF0	0_2_07543CF0
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_07543CEA	0_2_07543CEA
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_0754AA50	0_2_0754AA50
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_07547A41	0_2_07547A41
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Code function: 0_2_0754CAC8	0_2_0754CAC8
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_00864204	11_2_00864204
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_0086E134	11_2_0086E134
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_008625D8	11_2_008625D8
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_00867018	11_2_00867018
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA0E28	11_2_06BA0E28
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA6AD3	11_2_06BA6AD3
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAA618	11_2_06BAA618
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAA613	11_2_06BAA613
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAB2BB	11_2_06BAB2BB
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAB2C0	11_2_06BAB2C0
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA30D0	11_2_06BA30D0
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAAE88	11_2_06BAAE88
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAAE80	11_2_06BAAE80
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA0E21	11_2_06BA0E21
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA3F88	11_2_06BA3F88
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA3F87	11_2_06BA3F87
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA3CF0	11_2_06BA3CF0
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA3CEF	11_2_06BA3CEF
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BACAC8	11_2_06BACAC8
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAAA50	11_2_06BAAA50
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA7A4B	11_2_06BA7A4B
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_0AA52170	11_2_0AA52170
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_0AA53788	11_2_0AA53788
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00425152	14_2_00425152
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00435286	14_2_00435286
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_004513D4	14_2_004513D4
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0045050B	14_2_0045050B
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00436510	14_2_00436510
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_004316FB	14_2_004316FB
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0043569E	14_2_0043569E
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00443700	14_2_00443700
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_004257FB	14_2_004257FB
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_004128E3	14_2_004128E3
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00425964	14_2_00425964
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0041B917	14_2_0041B917
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0043D9CC	14_2_0043D9CC
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00435AD3	14_2_00435AD3
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00424BC3	14_2_00424BC3
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0043DBFB	14_2_0043DBFB
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0044ABA9	14_2_0044ABA9
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00433C0B	14_2_00433C0B
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00434D8A	14_2_00434D8A
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0043DE2A	14_2_0043DE2A
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0041CEAF	14_2_0041CEAF
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00435F08	14_2_00435F08

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: String function: 00402073 appears 51 times
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: String function: 00432B90 appears 53 times
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: String function: 00432525 appears 41 times

Source: z1ProductSampleRequirement.exe, 00000000.00000002.2088133445.00000000044FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs z1ProductSampleRequirement.exe
Source: z1ProductSampleRequirement.exe, 00000000.00000002.2094168963.000000000B800000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs z1ProductSampleRequirement.exe
Source: z1ProductSampleRequirement.exe, 00000000.00000000.2032655761.000000000099C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamepYIN.exe: vs z1ProductSampleRequirement.exe
Source: z1ProductSampleRequirement.exe, 00000000.00000002.2085668864.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs z1ProductSampleRequirement.exe
Source: z1ProductSampleRequirement.exe	Binary or memory string: OriginalFilenamepYIN.exe: vs z1ProductSampleRequirement.exe

Source: z1ProductSampleRequirement.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 14.2.XyLTxdgHV.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 14.2.XyLTxdgHV.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.2.XyLTxdgHV.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 11.2.XyLTxdgHV.exe.41cc6c8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.XyLTxdgHV.exe.41cc6c8.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.XyLTxdgHV.exe.41cc6c8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 11.2.XyLTxdgHV.exe.4241ce8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.XyLTxdgHV.exe.4241ce8.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.XyLTxdgHV.exe.4241ce8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 14.2.XyLTxdgHV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 14.2.XyLTxdgHV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.2.XyLTxdgHV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 11.2.XyLTxdgHV.exe.4241ce8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.XyLTxdgHV.exe.4241ce8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 11.2.XyLTxdgHV.exe.41cc6c8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.XyLTxdgHV.exe.41cc6c8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0000000B.00000002.2129497203.00000000041CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.2088133445.000000000499B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: z1ProductSampleRequirement.exe PID: 1892, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: XyLTxdgHV.exe PID: 7248, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: XyLTxdgHV.exe PID: 7388, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: z1ProductSampleRequirement.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: XyLTxdgHV.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, PFcomyYKW8In80MFZA.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, PFcomyYKW8In80MFZA.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, fqDlm59RUfhkRlIwqb.cs	Security API names: _0020.SetAccessControl
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, fqDlm59RUfhkRlIwqb.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, fqDlm59RUfhkRlIwqb.cs	Security API names: _0020.AddAccessRule
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, fqDlm59RUfhkRlIwqb.cs	Security API names: _0020.SetAccessControl
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, fqDlm59RUfhkRlIwqb.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, fqDlm59RUfhkRlIwqb.cs	Security API names: _0020.AddAccessRule
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, fqDlm59RUfhkRlIwqb.cs	Security API names: _0020.SetAccessControl
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, fqDlm59RUfhkRlIwqb.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, fqDlm59RUfhkRlIwqb.cs	Security API names: _0020.AddAccessRule
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, PFcomyYKW8In80MFZA.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@19/17@2/2

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_00415C90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

14_2_00415C90

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_0040E2E7 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,

14_2_0040E2E7

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_00419493 FindResourceA,LoadResource,LockResource,SizeofResource,

14_2_00419493

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_00418A00 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

14_2_00418A00

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

File created: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Mutant created: \Sessions\1\BaseNamedObjects\BPbXAoupxfCN
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-HNOBUS
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6612:120:WilError_03

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

File created: C:\Users\user\AppData\Local\Temp\tmpD6AD.tmp

Source: z1ProductSampleRequirement.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: z1ProductSampleRequirement.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: z1ProductSampleRequirement.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

File read: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

Source: unknown	Process created: C:\Users\user\Desktop\z1ProductSampleRequirement.exe "C:\Users\user\Desktop\z1ProductSampleRequirement.exe"
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z1ProductSampleRequirement.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\XyLTxdgHV.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XyLTxdgHV" /XML "C:\Users\user\AppData\Local\Temp\tmpD6AD.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Users\user\Desktop\z1ProductSampleRequirement.exe "C:\Users\user\Desktop\z1ProductSampleRequirement.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe C:\Users\user\AppData\Roaming\XyLTxdgHV.exe
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XyLTxdgHV" /XML "C:\Users\user\AppData\Local\Temp\tmpEB9C.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process created: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe "C:\Users\user\AppData\Roaming\XyLTxdgHV.exe"
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z1ProductSampleRequirement.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\XyLTxdgHV.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XyLTxdgHV" /XML "C:\Users\user\AppData\Local\Temp\tmpD6AD.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Users\user\Desktop\z1ProductSampleRequirement.exe "C:\Users\user\Desktop\z1ProductSampleRequirement.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XyLTxdgHV" /XML "C:\Users\user\AppData\Local\Temp\tmpEB9C.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process created: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe "C:\Users\user\AppData\Roaming\XyLTxdgHV.exe"	Jump to behavior

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Source: z1ProductSampleRequirement.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: z1ProductSampleRequirement.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: z1ProductSampleRequirement.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: pYIN.pdbSHA256 source: z1ProductSampleRequirement.exe, XyLTxdgHV.exe.0.dr
Source:	Binary string: pYIN.pdb source: z1ProductSampleRequirement.exe, XyLTxdgHV.exe.0.dr

Data Obfuscation

Source: 0.2.z1ProductSampleRequirement.exe.7510000.4.raw.unpack, XlF5VlCIHRSQX8M5eh.cs	.Net Code: _200C_200C_202D_206C_200B_206A_206D_200B_200D_200C_202D_206A_206D_202A_206A_206B_202B_206C_202D_200B_202E_202B_202A_206C_206A_206D_202D_206B_206D_206B_200D_202B_202D_206C_206F_206C_200B_202B_206A_206D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, fqDlm59RUfhkRlIwqb.cs	.Net Code: EeFpeWbbEG System.Reflection.Assembly.Load(byte[])
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, fqDlm59RUfhkRlIwqb.cs	.Net Code: EeFpeWbbEG System.Reflection.Assembly.Load(byte[])
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, fqDlm59RUfhkRlIwqb.cs	.Net Code: EeFpeWbbEG System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_0041A8DA LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

14_2_0041A8DA

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAE7A9 push ss; ret	11_2_06BAE7AA
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAE7E3 push ss; ret	11_2_06BAE7E6
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAE758 push ss; ret	11_2_06BAE75A
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAD470 push cs; ret	11_2_06BAD472
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAC2B3 push es; ret	11_2_06BAC4D2
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAD28B push cs; ret	11_2_06BAD292
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAD2E9 push cs; ret	11_2_06BAD2EA
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAD23B push cs; ret	11_2_06BAD242
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAD239 push cs; ret	11_2_06BAD23A
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAD398 push cs; ret	11_2_06BAD39A
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BAD10F push cs; ret	11_2_06BAD112
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA8CE1 push edi; retn 0006h	11_2_06BA8CE2
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA8D10 push edi; retn 0006h	11_2_06BA8D12
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA8AE0 push esi; retn 0006h	11_2_06BA8AE2
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA8A21 push esi; retn 0006h	11_2_06BA8A22
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA8BE8 push edi; retn 0006h	11_2_06BA8BEA
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA8B4F push esi; retn 0006h	11_2_06BA8B52
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA88A9 push ebp; retn 0006h	11_2_06BA88AA
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA8929 push ebp; retn 0006h	11_2_06BA892A
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 11_2_06BA9940 pushad ; retn 0006h	11_2_06BA9942
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_004000D8 push es; iretd	14_2_004000D9
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0040008C push es; iretd	14_2_0040008D
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_004542E6 push ecx; ret	14_2_004542F9
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0045B4FD push esi; ret	14_2_0045B506
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00432BD6 push ecx; ret	14_2_00432BE9
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00454C08 push eax; ret	14_2_00454C26

Source: z1ProductSampleRequirement.exe	Static PE information: section name: .text entropy: 7.778861872488694
Source: XyLTxdgHV.exe.0.dr	Static PE information: section name: .text entropy: 7.778861872488694

Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, OfkPs5c2FItUjMOkhc.cs	High entropy of concatenated method names: 'VGLRUFfaK6', 'NF1R2ABrXu', 'z7CR47fRI7', 'IqHRsIq7ul', 'WlTRQa70tn', 'sqoR8XqK1D', 'onvR9CsJvo', 'E1YRdFUeKu', 'aiwRgsvfDV', 'c2kRWaJW0k'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, b4dvvSzGgAHJKe1Bl7.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'W5axGKtIFf', 'q06xDOOjPD', 'MSYxjk0p0m', 'Gjyx6YLpfe', 'pN7xRIB0Lm', 'zDFxxfgTVR', 'S4GxyyJco7'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, MW4SVWppeY7JLecETy.cs	High entropy of concatenated method names: 'soTZ8Fcomy', 'uW8Z9In80M', 'aGVZgYIuZ6', 'H7tZWVS8Oc', 'QtmZDQosNn', 'R8uZj08kTX', 'ooUKr5nrE1oPLPYDfo', 'RngN5nuxnur7KKc9Rj', 'gJrZZO1GP6', 'WbBZiw7QZa'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, sGav03ZZZr0Km5DWInu.cs	High entropy of concatenated method names: 'ToString', 'wpGyiKIt85', 'r2HypMXdLU', 'lbIyoOIdZR', 'k4cyUj7Pep', 'q7qy2CVsLT', 'Vgyy4bDXdM', 'rDIyswEgLK', 'cBnDhw7oky6FqLcTndh', 'RFTbYs7QSgPmbwQQ1uJ'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, H7dlL2ZiNN5JYsKhXxs.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'j9wyn8d06p', 'pV7yMlJvm1', 'UUAyugBkYs', 'gCtyLFKDy3', 'IY4yInAipO', 'jYTy1tBwbj', 'YZayk4uDZP'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, PFcomyYKW8In80MFZA.cs	High entropy of concatenated method names: 'HbM2nrx6hn', 's012MJ7Bj4', 'pxY2u6POQC', 'FFg2L21t17', 'vt12I2xeno', 'hAV2121vKI', 'RV42kPE6eA', 'Ing2cXgGQw', 'VJJ2S0Tq3A', 'lnh2BTJ19Q'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, fqDlm59RUfhkRlIwqb.cs	High entropy of concatenated method names: 'DKnioPLkLg', 'Tv6iUnRXtN', 'EJei2fboqi', 'EA6i4CED9E', 'aPkis4ocyF', 'eoOiQhFlVB', 'cmPi8bS51G', 'rtji9xEBuF', 'nmUidwiKKR', 'qpAigmsQti'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, wIC62lOY9n5xvKiwqZ.cs	High entropy of concatenated method names: 'U7YeuIZZf', 'ahkbn8RVc', 'clRCmj6AL', 'Oh9v1GEhq', 'ISb3RousB', 'E3afJKEvQ', 'HOdNNfS4CWwJbCh4Sh', 'GiW2CooXU85mj0LInc', 'tAvRnFRND', 'QLfy7hhUY'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, byeapU11Mu2jVxe52d.cs	High entropy of concatenated method names: 'svS6cYiyi1', 'gr46BIhT7k', 'wj4R0XcALR', 'RlyRZN7oFv', 'fA165AAYjV', 'wtU6XDBcbL', 'ivJ6TJ00Ne', 'JCr6n7FHHN', 'SaC6MKojK0', 'DJN6uD86Fp'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, tPh9SCVZWXZq2HRuVp.cs	High entropy of concatenated method names: 'bf08FS8ibg', 'BU58qhF28I', 'f0m8eqdja1', 'Vqy8bgeWMO', 'sjX8AcMMPk', 'eE88Ckxrgj', 'a088vVLpIF', 'r3O8YR3k27', 'q6s83XXeW1', 'wbU8flWd76'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, uDM1012wTsu4vnsxhg.cs	High entropy of concatenated method names: 'Dispose', 'jjgZSccotV', 'GQtOlZl8wk', 'clpooMNPt9', 'P5fZBkPs52', 'xItZzUjMOk', 'ProcessDialogKey', 'FcPO0QuHcE', 'ctCOZbOG0L', 'OgROOtPIW9'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, wQuHcESOtCbOG0L5gR.cs	High entropy of concatenated method names: 'zaWRhLpk2h', 'VTNRlnUXSU', 'IWYRaqUucR', 'ILORrXZPTm', 'giDRnVnTPp', 'AL3RNI1KVL', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, vPIW9NB61QOJnLALyg.cs	High entropy of concatenated method names: 'TVsxZdOwLk', 'wCOxiU3a4M', 'M1Txp8i2lG', 'x5CxUJC8uO', 'Y37x2o9yew', 'a3Axseul7L', 'chSxQ5ucvT', 'ihnRkxohkJ', 'x4yRcd7qNn', 'tt3RSvvcBV'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, AbkTh6Z0xiJv4l4MUOf.cs	High entropy of concatenated method names: 'pDFxFAFmMw', 'lXmxqRQ0l2', 'hrqxe9gtka', 'Jsoxbhmha5', 'iQtxAAaXOR', 'LYvxCYAVUY', 'XJyxveuEPP', 'LOfxY8g6bM', 'aD5x3TrHWa', 'Q6mxffrTI1'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, S7W1wJrvpPySfdXAnQ.cs	High entropy of concatenated method names: 'T9QQwVNULu', 'vhAQFdLSpj', 'zj8QeOgAjL', 'ROxQbBmdlB', 's7HQCWqbt8', 'jU5Qvf6T8g', 'tZaQ3Ho5gc', 'TThQfcUfT0', 'xVu0kNlr5JihBUvdEUW', 'LIBQ71ltkP0Xcy45VS4'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, hNnM8uh08kTXFPWkdH.cs	High entropy of concatenated method names: 'cLUQoaQgv9', 'dEBQ2k8O0R', 'cp5QsnrvrH', 'OhDQ8a51b3', 'lr7Q9Krf0S', 'gVZsItwUyq', 'BQcs1dfq2S', 'MxAsk3UPrr', 'TBLscMDwxe', 'zqJsS4htf2'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, sEqge03GVYIuZ6l7tV.cs	High entropy of concatenated method names: 'qcj4b8WQ7o', 'hZN4C1Hsh2', 'jyV4YBU7CN', 'O6i43TF7Dw', 'EsZ4DC8aWv', 'xSQ4jN2O7N', 'pBN4649L1p', 'pcB4RSmF3o', 'WnC4xb3f2F', 'G8T4yViZWf'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, UcK0VRmsrV2qTEWOX4.cs	High entropy of concatenated method names: 'Rp48UH9d1q', 'nMH84bV8yr', 'sYS8QmGWAR', 'xXkQBmN114', 'nWMQzwKt4c', 'VCf80KiBUk', 'WPR8ZNZ9ct', 'FCy8ONFQac', 'y2C8ihL7v6', 'vQc8pjve41'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, PwZBsGT1XHuRCDQqu9.cs	High entropy of concatenated method names: 'FvYGY3LfCL', 'HOiG3bXqCh', 'Oy4GhWJy7D', 'xVmGlnAUiU', 'aiIGrj1TMQ', 'KYdGNop1uL', 'yK0GmmGrjI', 'iqtGHVwZT8', 'OwqG7KcqMo', 'GP1G5dVDF1'
Source: 0.2.z1ProductSampleRequirement.exe.b800000.5.raw.unpack, Y8OcsIfTSE2S4TtmQo.cs	High entropy of concatenated method names: 'oWIsAa8Xgg', 'NBCsvIclTl', 'UuV4aTjBlO', 'hJ84rHOiQ8', 'Kca4NtYQDq', 'CjN4JUNhkj', 'Wqx4mC83sg', 'EDe4HcaDWW', 'fwT4VnIj7o', 'S4S47Dv5Zp'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, OfkPs5c2FItUjMOkhc.cs	High entropy of concatenated method names: 'VGLRUFfaK6', 'NF1R2ABrXu', 'z7CR47fRI7', 'IqHRsIq7ul', 'WlTRQa70tn', 'sqoR8XqK1D', 'onvR9CsJvo', 'E1YRdFUeKu', 'aiwRgsvfDV', 'c2kRWaJW0k'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, b4dvvSzGgAHJKe1Bl7.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'W5axGKtIFf', 'q06xDOOjPD', 'MSYxjk0p0m', 'Gjyx6YLpfe', 'pN7xRIB0Lm', 'zDFxxfgTVR', 'S4GxyyJco7'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, MW4SVWppeY7JLecETy.cs	High entropy of concatenated method names: 'soTZ8Fcomy', 'uW8Z9In80M', 'aGVZgYIuZ6', 'H7tZWVS8Oc', 'QtmZDQosNn', 'R8uZj08kTX', 'ooUKr5nrE1oPLPYDfo', 'RngN5nuxnur7KKc9Rj', 'gJrZZO1GP6', 'WbBZiw7QZa'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, sGav03ZZZr0Km5DWInu.cs	High entropy of concatenated method names: 'ToString', 'wpGyiKIt85', 'r2HypMXdLU', 'lbIyoOIdZR', 'k4cyUj7Pep', 'q7qy2CVsLT', 'Vgyy4bDXdM', 'rDIyswEgLK', 'cBnDhw7oky6FqLcTndh', 'RFTbYs7QSgPmbwQQ1uJ'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, H7dlL2ZiNN5JYsKhXxs.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'j9wyn8d06p', 'pV7yMlJvm1', 'UUAyugBkYs', 'gCtyLFKDy3', 'IY4yInAipO', 'jYTy1tBwbj', 'YZayk4uDZP'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, PFcomyYKW8In80MFZA.cs	High entropy of concatenated method names: 'HbM2nrx6hn', 's012MJ7Bj4', 'pxY2u6POQC', 'FFg2L21t17', 'vt12I2xeno', 'hAV2121vKI', 'RV42kPE6eA', 'Ing2cXgGQw', 'VJJ2S0Tq3A', 'lnh2BTJ19Q'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, fqDlm59RUfhkRlIwqb.cs	High entropy of concatenated method names: 'DKnioPLkLg', 'Tv6iUnRXtN', 'EJei2fboqi', 'EA6i4CED9E', 'aPkis4ocyF', 'eoOiQhFlVB', 'cmPi8bS51G', 'rtji9xEBuF', 'nmUidwiKKR', 'qpAigmsQti'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, wIC62lOY9n5xvKiwqZ.cs	High entropy of concatenated method names: 'U7YeuIZZf', 'ahkbn8RVc', 'clRCmj6AL', 'Oh9v1GEhq', 'ISb3RousB', 'E3afJKEvQ', 'HOdNNfS4CWwJbCh4Sh', 'GiW2CooXU85mj0LInc', 'tAvRnFRND', 'QLfy7hhUY'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, byeapU11Mu2jVxe52d.cs	High entropy of concatenated method names: 'svS6cYiyi1', 'gr46BIhT7k', 'wj4R0XcALR', 'RlyRZN7oFv', 'fA165AAYjV', 'wtU6XDBcbL', 'ivJ6TJ00Ne', 'JCr6n7FHHN', 'SaC6MKojK0', 'DJN6uD86Fp'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, tPh9SCVZWXZq2HRuVp.cs	High entropy of concatenated method names: 'bf08FS8ibg', 'BU58qhF28I', 'f0m8eqdja1', 'Vqy8bgeWMO', 'sjX8AcMMPk', 'eE88Ckxrgj', 'a088vVLpIF', 'r3O8YR3k27', 'q6s83XXeW1', 'wbU8flWd76'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, uDM1012wTsu4vnsxhg.cs	High entropy of concatenated method names: 'Dispose', 'jjgZSccotV', 'GQtOlZl8wk', 'clpooMNPt9', 'P5fZBkPs52', 'xItZzUjMOk', 'ProcessDialogKey', 'FcPO0QuHcE', 'ctCOZbOG0L', 'OgROOtPIW9'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, wQuHcESOtCbOG0L5gR.cs	High entropy of concatenated method names: 'zaWRhLpk2h', 'VTNRlnUXSU', 'IWYRaqUucR', 'ILORrXZPTm', 'giDRnVnTPp', 'AL3RNI1KVL', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, vPIW9NB61QOJnLALyg.cs	High entropy of concatenated method names: 'TVsxZdOwLk', 'wCOxiU3a4M', 'M1Txp8i2lG', 'x5CxUJC8uO', 'Y37x2o9yew', 'a3Axseul7L', 'chSxQ5ucvT', 'ihnRkxohkJ', 'x4yRcd7qNn', 'tt3RSvvcBV'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, AbkTh6Z0xiJv4l4MUOf.cs	High entropy of concatenated method names: 'pDFxFAFmMw', 'lXmxqRQ0l2', 'hrqxe9gtka', 'Jsoxbhmha5', 'iQtxAAaXOR', 'LYvxCYAVUY', 'XJyxveuEPP', 'LOfxY8g6bM', 'aD5x3TrHWa', 'Q6mxffrTI1'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, S7W1wJrvpPySfdXAnQ.cs	High entropy of concatenated method names: 'T9QQwVNULu', 'vhAQFdLSpj', 'zj8QeOgAjL', 'ROxQbBmdlB', 's7HQCWqbt8', 'jU5Qvf6T8g', 'tZaQ3Ho5gc', 'TThQfcUfT0', 'xVu0kNlr5JihBUvdEUW', 'LIBQ71ltkP0Xcy45VS4'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, hNnM8uh08kTXFPWkdH.cs	High entropy of concatenated method names: 'cLUQoaQgv9', 'dEBQ2k8O0R', 'cp5QsnrvrH', 'OhDQ8a51b3', 'lr7Q9Krf0S', 'gVZsItwUyq', 'BQcs1dfq2S', 'MxAsk3UPrr', 'TBLscMDwxe', 'zqJsS4htf2'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, sEqge03GVYIuZ6l7tV.cs	High entropy of concatenated method names: 'qcj4b8WQ7o', 'hZN4C1Hsh2', 'jyV4YBU7CN', 'O6i43TF7Dw', 'EsZ4DC8aWv', 'xSQ4jN2O7N', 'pBN4649L1p', 'pcB4RSmF3o', 'WnC4xb3f2F', 'G8T4yViZWf'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, UcK0VRmsrV2qTEWOX4.cs	High entropy of concatenated method names: 'Rp48UH9d1q', 'nMH84bV8yr', 'sYS8QmGWAR', 'xXkQBmN114', 'nWMQzwKt4c', 'VCf80KiBUk', 'WPR8ZNZ9ct', 'FCy8ONFQac', 'y2C8ihL7v6', 'vQc8pjve41'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, PwZBsGT1XHuRCDQqu9.cs	High entropy of concatenated method names: 'FvYGY3LfCL', 'HOiG3bXqCh', 'Oy4GhWJy7D', 'xVmGlnAUiU', 'aiIGrj1TMQ', 'KYdGNop1uL', 'yK0GmmGrjI', 'iqtGHVwZT8', 'OwqG7KcqMo', 'GP1G5dVDF1'
Source: 0.2.z1ProductSampleRequirement.exe.47eeed0.2.raw.unpack, Y8OcsIfTSE2S4TtmQo.cs	High entropy of concatenated method names: 'oWIsAa8Xgg', 'NBCsvIclTl', 'UuV4aTjBlO', 'hJ84rHOiQ8', 'Kca4NtYQDq', 'CjN4JUNhkj', 'Wqx4mC83sg', 'EDe4HcaDWW', 'fwT4VnIj7o', 'S4S47Dv5Zp'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, OfkPs5c2FItUjMOkhc.cs	High entropy of concatenated method names: 'VGLRUFfaK6', 'NF1R2ABrXu', 'z7CR47fRI7', 'IqHRsIq7ul', 'WlTRQa70tn', 'sqoR8XqK1D', 'onvR9CsJvo', 'E1YRdFUeKu', 'aiwRgsvfDV', 'c2kRWaJW0k'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, b4dvvSzGgAHJKe1Bl7.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'W5axGKtIFf', 'q06xDOOjPD', 'MSYxjk0p0m', 'Gjyx6YLpfe', 'pN7xRIB0Lm', 'zDFxxfgTVR', 'S4GxyyJco7'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, MW4SVWppeY7JLecETy.cs	High entropy of concatenated method names: 'soTZ8Fcomy', 'uW8Z9In80M', 'aGVZgYIuZ6', 'H7tZWVS8Oc', 'QtmZDQosNn', 'R8uZj08kTX', 'ooUKr5nrE1oPLPYDfo', 'RngN5nuxnur7KKc9Rj', 'gJrZZO1GP6', 'WbBZiw7QZa'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, sGav03ZZZr0Km5DWInu.cs	High entropy of concatenated method names: 'ToString', 'wpGyiKIt85', 'r2HypMXdLU', 'lbIyoOIdZR', 'k4cyUj7Pep', 'q7qy2CVsLT', 'Vgyy4bDXdM', 'rDIyswEgLK', 'cBnDhw7oky6FqLcTndh', 'RFTbYs7QSgPmbwQQ1uJ'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, H7dlL2ZiNN5JYsKhXxs.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'j9wyn8d06p', 'pV7yMlJvm1', 'UUAyugBkYs', 'gCtyLFKDy3', 'IY4yInAipO', 'jYTy1tBwbj', 'YZayk4uDZP'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, PFcomyYKW8In80MFZA.cs	High entropy of concatenated method names: 'HbM2nrx6hn', 's012MJ7Bj4', 'pxY2u6POQC', 'FFg2L21t17', 'vt12I2xeno', 'hAV2121vKI', 'RV42kPE6eA', 'Ing2cXgGQw', 'VJJ2S0Tq3A', 'lnh2BTJ19Q'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, fqDlm59RUfhkRlIwqb.cs	High entropy of concatenated method names: 'DKnioPLkLg', 'Tv6iUnRXtN', 'EJei2fboqi', 'EA6i4CED9E', 'aPkis4ocyF', 'eoOiQhFlVB', 'cmPi8bS51G', 'rtji9xEBuF', 'nmUidwiKKR', 'qpAigmsQti'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, wIC62lOY9n5xvKiwqZ.cs	High entropy of concatenated method names: 'U7YeuIZZf', 'ahkbn8RVc', 'clRCmj6AL', 'Oh9v1GEhq', 'ISb3RousB', 'E3afJKEvQ', 'HOdNNfS4CWwJbCh4Sh', 'GiW2CooXU85mj0LInc', 'tAvRnFRND', 'QLfy7hhUY'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, byeapU11Mu2jVxe52d.cs	High entropy of concatenated method names: 'svS6cYiyi1', 'gr46BIhT7k', 'wj4R0XcALR', 'RlyRZN7oFv', 'fA165AAYjV', 'wtU6XDBcbL', 'ivJ6TJ00Ne', 'JCr6n7FHHN', 'SaC6MKojK0', 'DJN6uD86Fp'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, tPh9SCVZWXZq2HRuVp.cs	High entropy of concatenated method names: 'bf08FS8ibg', 'BU58qhF28I', 'f0m8eqdja1', 'Vqy8bgeWMO', 'sjX8AcMMPk', 'eE88Ckxrgj', 'a088vVLpIF', 'r3O8YR3k27', 'q6s83XXeW1', 'wbU8flWd76'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, uDM1012wTsu4vnsxhg.cs	High entropy of concatenated method names: 'Dispose', 'jjgZSccotV', 'GQtOlZl8wk', 'clpooMNPt9', 'P5fZBkPs52', 'xItZzUjMOk', 'ProcessDialogKey', 'FcPO0QuHcE', 'ctCOZbOG0L', 'OgROOtPIW9'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, wQuHcESOtCbOG0L5gR.cs	High entropy of concatenated method names: 'zaWRhLpk2h', 'VTNRlnUXSU', 'IWYRaqUucR', 'ILORrXZPTm', 'giDRnVnTPp', 'AL3RNI1KVL', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, vPIW9NB61QOJnLALyg.cs	High entropy of concatenated method names: 'TVsxZdOwLk', 'wCOxiU3a4M', 'M1Txp8i2lG', 'x5CxUJC8uO', 'Y37x2o9yew', 'a3Axseul7L', 'chSxQ5ucvT', 'ihnRkxohkJ', 'x4yRcd7qNn', 'tt3RSvvcBV'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, AbkTh6Z0xiJv4l4MUOf.cs	High entropy of concatenated method names: 'pDFxFAFmMw', 'lXmxqRQ0l2', 'hrqxe9gtka', 'Jsoxbhmha5', 'iQtxAAaXOR', 'LYvxCYAVUY', 'XJyxveuEPP', 'LOfxY8g6bM', 'aD5x3TrHWa', 'Q6mxffrTI1'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, S7W1wJrvpPySfdXAnQ.cs	High entropy of concatenated method names: 'T9QQwVNULu', 'vhAQFdLSpj', 'zj8QeOgAjL', 'ROxQbBmdlB', 's7HQCWqbt8', 'jU5Qvf6T8g', 'tZaQ3Ho5gc', 'TThQfcUfT0', 'xVu0kNlr5JihBUvdEUW', 'LIBQ71ltkP0Xcy45VS4'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, hNnM8uh08kTXFPWkdH.cs	High entropy of concatenated method names: 'cLUQoaQgv9', 'dEBQ2k8O0R', 'cp5QsnrvrH', 'OhDQ8a51b3', 'lr7Q9Krf0S', 'gVZsItwUyq', 'BQcs1dfq2S', 'MxAsk3UPrr', 'TBLscMDwxe', 'zqJsS4htf2'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, sEqge03GVYIuZ6l7tV.cs	High entropy of concatenated method names: 'qcj4b8WQ7o', 'hZN4C1Hsh2', 'jyV4YBU7CN', 'O6i43TF7Dw', 'EsZ4DC8aWv', 'xSQ4jN2O7N', 'pBN4649L1p', 'pcB4RSmF3o', 'WnC4xb3f2F', 'G8T4yViZWf'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, UcK0VRmsrV2qTEWOX4.cs	High entropy of concatenated method names: 'Rp48UH9d1q', 'nMH84bV8yr', 'sYS8QmGWAR', 'xXkQBmN114', 'nWMQzwKt4c', 'VCf80KiBUk', 'WPR8ZNZ9ct', 'FCy8ONFQac', 'y2C8ihL7v6', 'vQc8pjve41'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, PwZBsGT1XHuRCDQqu9.cs	High entropy of concatenated method names: 'FvYGY3LfCL', 'HOiG3bXqCh', 'Oy4GhWJy7D', 'xVmGlnAUiU', 'aiIGrj1TMQ', 'KYdGNop1uL', 'yK0GmmGrjI', 'iqtGHVwZT8', 'OwqG7KcqMo', 'GP1G5dVDF1'
Source: 0.2.z1ProductSampleRequirement.exe.48a5ef0.0.raw.unpack, Y8OcsIfTSE2S4TtmQo.cs	High entropy of concatenated method names: 'oWIsAa8Xgg', 'NBCsvIclTl', 'UuV4aTjBlO', 'hJ84rHOiQ8', 'Kca4NtYQDq', 'CjN4JUNhkj', 'Wqx4mC83sg', 'EDe4HcaDWW', 'fwT4VnIj7o', 'S4S47Dv5Zp'

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_004063C6 ShellExecuteW,URLDownloadToFileW,

14_2_004063C6

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

File created: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XyLTxdgHV" /XML "C:\Users\user\AppData\Local\Temp\tmpD6AD.tmp"

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_00418A00 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

14_2_00418A00

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

14_2_0041A8DA

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: z1ProductSampleRequirement.exe PID: 1892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XyLTxdgHV.exe PID: 7248, type: MEMORYSTR

Delayed program exit found

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_0040E18D Sleep,ExitProcess,

14_2_0040E18D

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Memory allocated: 12C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Memory allocated: 2CA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Memory allocated: 8F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Memory allocated: 9F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Memory allocated: A190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Memory allocated: B190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Memory allocated: B8C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Memory allocated: C8C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Memory allocated: D8C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Memory allocated: 860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Memory allocated: 24D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Memory allocated: 2300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Memory allocated: 82F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Memory allocated: 92F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Memory allocated: 94E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Memory allocated: A4E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Memory allocated: ABD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Memory allocated: BBD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Memory allocated: CBD0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

14_2_004186FE

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6646	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1188	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6650	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 851	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Window / User API: threadDelayed 2295	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Window / User API: threadDelayed 7152	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Window / User API: foregroundWindowGot 1768	Jump to behavior

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

API coverage: 5.1 %

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe TID: 6716	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5428	Thread sleep count: 6646 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1496	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2876	Thread sleep count: 1188 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6592	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1812	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2972	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe TID: 6528	Thread sleep count: 261 > 30	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe TID: 6528	Thread sleep time: -130500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe TID: 6688	Thread sleep count: 2295 > 30	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe TID: 6688	Thread sleep time: -6885000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe TID: 6688	Thread sleep count: 7152 > 30	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe TID: 6688	Thread sleep time: -21456000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe TID: 7284	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0041A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	14_2_0041A01B
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0040B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	14_2_0040B28E
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0040838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	14_2_0040838E
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_004087A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	14_2_004087A0
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00407848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	14_2_00407848
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_004068CD FindFirstFileW,FindNextFileW,	14_2_004068CD
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0044BA59 FindFirstFileExA,	14_2_0044BA59
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0040AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	14_2_0040AA71
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00417AAB FindFirstFileW,FindNextFileW,FindNextFileW,	14_2_00417AAB
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_0040AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	14_2_0040AC78

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_00406D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

14_2_00406D28

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.0000000001197000.00000004.00000020.00020000.00000000.sdmp, z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.0000000001210000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

Code function: 9_2_02F2FA00 LdrInitializeThunk,

9_2_02F2FA00

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_004327AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

14_2_004327AE

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

14_2_0041A8DA

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_004407B5 mov eax, dword ptr fs:[00000030h]

14_2_004407B5

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_00410763 SetLastError,GetNativeSystemInfo,SetLastError,GetProcessHeap,HeapAlloc,SetLastError,

14_2_00410763

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_004327AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_004327AE
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_004328FC SetUnhandledExceptionFilter,	14_2_004328FC
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_004398AC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_004398AC
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: 14_2_00432D5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_00432D5C

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z1ProductSampleRequirement.exe"
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\XyLTxdgHV.exe"
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z1ProductSampleRequirement.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\XyLTxdgHV.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Memory written: C:\Users\user\Desktop\z1ProductSampleRequirement.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Memory written: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

14_2_00410B5C

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_004175E1 mouse_event,

14_2_004175E1

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z1ProductSampleRequirement.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\XyLTxdgHV.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XyLTxdgHV" /XML "C:\Users\user\AppData\Local\Temp\tmpD6AD.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Process created: C:\Users\user\Desktop\z1ProductSampleRequirement.exe "C:\Users\user\Desktop\z1ProductSampleRequirement.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XyLTxdgHV" /XML "C:\Users\user\AppData\Local\Temp\tmpEB9C.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Process created: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe "C:\Users\user\AppData\Roaming\XyLTxdgHV.exe"	Jump to behavior

Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.0000000001203000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerUS\27
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.0000000001203000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerUS\8
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.0000000001203000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerUS\
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.0000000001203000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.0000000001203000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerUS\'
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.0000000001203000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerUS\L
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.0000000001203000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager1
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.0000000001203000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerUS\
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.0000000001197000.00000004.00000020.00020000.00000000.sdmp, logs.dat.9.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_004329DA cpuid

14_2_004329DA

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: EnumSystemLocalesW,	14_2_0044F17B
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: EnumSystemLocalesW,	14_2_0044F130
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: EnumSystemLocalesW,	14_2_0044F216
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_0044F2A3
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: GetLocaleInfoA,	14_2_0040E2BB
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: GetLocaleInfoW,	14_2_0044F4F3
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_0044F61C
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: GetLocaleInfoW,	14_2_0044F723
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_0044F7F0
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: EnumSystemLocalesW,	14_2_00445914
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: GetLocaleInfoW,	14_2_00445E1C
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	14_2_0044EEB8

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Queries volume information: C:\Users\user\Desktop\z1ProductSampleRequirement.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Queries volume information: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_0040A0B0 GetLocalTime,wsprintfW,

14_2_0040A0B0

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_004195F8 GetUserNameW,

14_2_004195F8

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: 14_2_004466BF _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

14_2_004466BF

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 14.2.XyLTxdgHV.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.41cc6c8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.4241ce8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.XyLTxdgHV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.4241ce8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.41cc6c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4498177592.0000000001197000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4498721754.0000000002D2F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4498177592.00000000011D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2105358568.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4498177592.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2129497203.00000000041CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2088133445.000000000499B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z1ProductSampleRequirement.exe PID: 1892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z1ProductSampleRequirement.exe PID: 5708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XyLTxdgHV.exe PID: 7248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XyLTxdgHV.exe PID: 7388, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

14_2_0040A953

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		14_2_0040AA71
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Code function: \key3.db		14_2_0040AA71

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\z1ProductSampleRequirement.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-HNOBUS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-HNOBUS

Source: Yara match	File source: 14.2.XyLTxdgHV.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.41cc6c8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.4241ce8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.XyLTxdgHV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.4a11280.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.4241ce8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.XyLTxdgHV.exe.41cc6c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z1ProductSampleRequirement.exe.499bc60.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4498177592.0000000001197000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4498721754.0000000002D2F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4498177592.00000000011D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2105358568.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4498177592.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2129497203.00000000041CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2088133445.000000000499B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z1ProductSampleRequirement.exe PID: 1892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z1ProductSampleRequirement.exe PID: 5708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XyLTxdgHV.exe PID: 7248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XyLTxdgHV.exe PID: 7388, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Code function: cmd.exe

14_2_0040567A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Windows Service	4 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	122 Process Injection	12 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	33 System Information Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	12 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	122 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
z1ProductSampleRequirement.exe	66%	ReversingLabs	ByteCode-MSIL.Backdoor.Remcos
z1ProductSampleRequirement.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\XyLTxdgHV.exe	66%	ReversingLabs	ByteCode-MSIL.Backdoor.Remcos

Source	Detection	Scanner	Label
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
teebro1800.dynamic-dns.net	51.75.166.98	true	true		unknown
geoplugin.net	178.237.33.50	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown
teebro1800.dynamic-dns.net	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp$	z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.0000000001197000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://geoplugin.net/	z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.00000000011D7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://geoplugin.net/json.gp/C	z1ProductSampleRequirement.exe, 00000000.00000002.2088133445.000000000499B000.00000004.00000800.00020000.00000000.sdmp, XyLTxdgHV.exe, 0000000B.00000002.2129497203.00000000041CC000.00000004.00000800.00020000.00000000.sdmp, XyLTxdgHV.exe, 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpl	z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.00000000011D7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	z1ProductSampleRequirement.exe, 00000000.00000002.2087574819.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, XyLTxdgHV.exe, 0000000B.00000002.2126394543.000000000255A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpSystem32	z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://tempuri.org/DataSet1.xsd	z1ProductSampleRequirement.exe, XyLTxdgHV.exe.0.dr	false		unknown
http://geoplugin.net/json.gpm	z1ProductSampleRequirement.exe, 00000009.00000002.4498177592.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
51.75.166.98	teebro1800.dynamic-dns.net	France		16276	OVHFR	true
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546626
Start date and time:	2024-11-01 09:31:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	z1ProductSampleRequirement.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@19/17@2/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 99% Number of executed functions: 77 Number of non-executed functions: 197
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target z1ProductSampleRequirement.exe, PID 5708 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: z1ProductSampleRequirement.exe

Simulations

Behavior and APIs

Time	Type	Description
04:31:55	API Interceptor	7433102x Sleep call for process: z1ProductSampleRequirement.exe modified
04:31:58	API Interceptor	27x Sleep call for process: powershell.exe modified
04:32:01	API Interceptor	2x Sleep call for process: XyLTxdgHV.exe modified
09:32:00	Task Scheduler	Run new task: XyLTxdgHV path: C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
178.237.33.50	17304052250b9baaf5a761ccc772d95d677ec70f56bbae9f30fbbf26b5b71b9b9867fc8bb2802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	5Tqze.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	PO-33463334788.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	A & C Metrology OC 545714677889Materiale.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	geoplugin.net/json.gp
	QUOTE #46789_AL_JAMEELA24.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	0001.xls	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1.rtf	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	HSBC Payment Swift Copy.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	ingswhic.doc	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	swithnew.doc	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
teebro1800.dynamic-dns.net	HSBC Payment Swift Copy.exe	Get hash	malicious	Remcos	Browse	140.228.29.6
geoplugin.net	17304052250b9baaf5a761ccc772d95d677ec70f56bbae9f30fbbf26b5b71b9b9867fc8bb2802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	5Tqze.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	PO-33463334788.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	A & C Metrology OC 545714677889Materiale.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	178.237.33.50
	QUOTE #46789_AL_JAMEELA24.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	0001.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	1.rtf	Get hash	malicious	Remcos	Browse	178.237.33.50
	HSBC Payment Swift Copy.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	ingswhic.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	swithnew.doc	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	file.exe	Get hash	malicious	WhiteSnake Stealer	Browse	51.255.106.85
	https://send-space.s3.eu-north-1.amazonaws.com/de.html	Get hash	malicious	Unknown	Browse	51.91.79.17
	VkTNb6p288.exe	Get hash	malicious	FormBook	Browse	5.39.10.93
	12Jh49DCAj.exe	Get hash	malicious	Xmrig	Browse	54.37.232.103
	El9HaBFrFM.exe	Get hash	malicious	Blank Grabber	Browse	51.89.9.252
	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	54.37.62.77
	http://3d1.gmobb.jp/dcm299ccyag4e/gov/	Get hash	malicious	Phisher	Browse	178.32.210.226
	https://www.kwconnect.com/redirect?url=https%3A%2F%2Fwww.ingenieriawj.com/trx/#XdGFtYXJhLnBlcmVpcmFkZWplc3VzQGRhaWljaGktc2Fua3lvLmV1	Get hash	malicious	HTMLPhisher	Browse	149.56.200.84
	segura.vbs	Get hash	malicious	Remcos	Browse	164.132.58.105
	asegurar.vbs	Get hash	malicious	Remcos	Browse	164.132.58.105
ATOM86-ASATOM86NL	17304052250b9baaf5a761ccc772d95d677ec70f56bbae9f30fbbf26b5b71b9b9867fc8bb2802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	5Tqze.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	PO-33463334788.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	A & C Metrology OC 545714677889Materiale.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	178.237.33.50
	QUOTE #46789_AL_JAMEELA24.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	0001.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	1.rtf	Get hash	malicious	Remcos	Browse	178.237.33.50
	HSBC Payment Swift Copy.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	ingswhic.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	swithnew.doc	Get hash	malicious	Remcos	Browse	178.237.33.50

Process:	C:\Users\user\Desktop\z1ProductSampleRequirement.exe
File Type:	data
Category:	dropped
Size (bytes):	224
Entropy (8bit):	3.4209319376574494
Encrypted:	false
SSDEEP:	3:rhlKlfjxnftb5JWRal2Jl+7R0DAlBG45klovDl65lQWluEkiEW/ufWPlgMlRQlRR:6lfnb5YcIeeDAlOWA7DxbN2fBMMm0v
MD5:	DAF843AC217A76264985783FCD76A522
SHA1:	2ED6A3993A21DDAE8FDA9B6A0B25318A92A01A09
SHA-256:	8FDE9C59D1D63E159EF293EC4087636FB529A01D746C36D57811602155AC0BC5
SHA-512:	DE5413AC1A594FE8F175FF0C104097EBD5CB3434C55C33ADAB933B21E578F4AD0E7798598EAA41830D47F3C22A2A940535595E5644EB1CFC680106EFE4C2452E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.4./.1.1./.0.1. .0.4.:.3.1.:.5.8. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........{. .U.s.e.r. .h.a.s. .b.e.e.n. .i.d.l.e. .f.o.r. .0. .m.i.n.u.t.e.s. .}.....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\XyLTxdgHV.exe.log

Process:	C:\Users\user\AppData\Roaming\XyLTxdgHV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z1ProductSampleRequirement.exe.log

Process:	C:\Users\user\Desktop\z1ProductSampleRequirement.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

Process:	C:\Users\user\Desktop\z1ProductSampleRequirement.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	957
Entropy (8bit):	5.008295404649503
Encrypted:	false
SSDEEP:	24:qXdRNuKyGX85jHf3SvXhNlT3/7YvfbYro:6PN0GX85mvhjTkvfEro
MD5:	96B063F9C5EF78A161994420DFEC25F2
SHA1:	FCFF5C810833BB7C878D9D74E1468E1347C75230
SHA-256:	2F61ACE63CC007BF73EA371A90020323E8252EB4D0274162CE31E5F45E09740E
SHA-512:	A8630CBFD24959CFCDDE23F10515F7D4CA50A83F63B7B6EA233EB09AFCA121008A8AA5214E81B64776E8331741BD57A9BD18C89399B7F9C076A666BEF1CD4BC1
Malicious:	false
Preview:	{. "geoplugin_request":"173.254.250.82",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"Killeen",. "geoplugin_region":"Texas",. "geoplugin_regionCode":"TX",. "geoplugin_regionName":"Texas",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"625",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"31.0065",. "geoplugin_longitude":"-97.8406",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/Chicago",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379736180876081
Encrypted:	false
SSDEEP:	48:tWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//8PUyus:tLHyIFKL3IZ2KRH9Oug8s
MD5:	6826FE6ABAF3CE3CD345B5433F8715E5
SHA1:	FD4601A7FC9A41EBADE5E185DA0927E4D9A72FBF
SHA-256:	6C6BECB629E8CA772941CF328E222C3A5D3620B8683BA896395291589AF0DAE9
SHA-512:	9DA9FFCD5B8E1E774183485E99834F003F50B459B341E4211B5F9C408ECF260505A75CF08BFB41C23C310209A755FF2156A0A6E66999B0F36776AA1EF0E4B562
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1sbinw2s.obi.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fbzovge2.xyy.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gfyrjtpj.55g.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k32bucgb.nl2.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k4djtcyi.buw.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_omv1kqfp.3zm.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sjx5xepu.z2j.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u1pkaw5e.tuk.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpD6AD.tmp

Process:	C:\Users\user\Desktop\z1ProductSampleRequirement.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1582
Entropy (8bit):	5.1080279957434715
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtJxAxvn:cgergYrFdOFzOzN33ODOiDdKrsuTJKv
MD5:	116CDCB91C6AB7CCA8CCFAF2BFF55587
SHA1:	F3491A2D000BD269CC63F0FAF7A34214ED0E5FB4
SHA-256:	D3CE7BAFBE9F86B1C4C58249C44519489B04B0CAF43EBA03FF067ADFD677706A
SHA-512:	4B268E5D81CD1A12D3C551E9EB5344BEB631B3452F201B7A2989DA3E6123D66FCFC7A0A5992B5A3A4EE2FF03448A5BE81EC745A3004A284634477087D1941478
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmpEB9C.tmp

Process:	C:\Users\user\AppData\Roaming\XyLTxdgHV.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1582
Entropy (8bit):	5.1080279957434715
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtJxAxvn:cgergYrFdOFzOzN33ODOiDdKrsuTJKv
MD5:	116CDCB91C6AB7CCA8CCFAF2BFF55587
SHA1:	F3491A2D000BD269CC63F0FAF7A34214ED0E5FB4
SHA-256:	D3CE7BAFBE9F86B1C4C58249C44519489B04B0CAF43EBA03FF067ADFD677706A
SHA-512:	4B268E5D81CD1A12D3C551E9EB5344BEB631B3452F201B7A2989DA3E6123D66FCFC7A0A5992B5A3A4EE2FF03448A5BE81EC745A3004A284634477087D1941478
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Roaming\XyLTxdgHV.exe

Process:	C:\Users\user\Desktop\z1ProductSampleRequirement.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1022464
Entropy (8bit):	7.7739166723261475
Encrypted:	false
SSDEEP:	24576:XwKjd3QboMkqo8VnR4la8/GmLVqugzVdy/d:Ayd3QboMkqOla8VMVdy
MD5:	2B3AA1B01D8963ED35A0050F793B4811
SHA1:	34DF4CA808F2D35290D4008F2C6B3EA7E8E80D8A
SHA-256:	1682EE7703DD036CBDF6AD6DAA38DDB7A4E7AB567B273F9EE209672F339FEB2D
SHA-512:	B42D1B09FB0C092074E38A2E885C959D12A63C5E7741EC976EC507CF2F7A14B6DCE7E40E9BEA7EB0D55CAF6ACBECE8D1DD841427E43041CB8F7E742DFBCF67B4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....#g..............0.................. ........@.. ....................................@.....................................O...................................@z..T............................................ ............... ..H............text...P.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......P...........Y....[..h............................................0..L.........}.....( ......(!.....(............s".....(#....o$.....(%....o&.....('.....0............}........((........().....,5...(............s".....(.....o$.....(.....o&....85....r...p.o...(...o+...to.......(,..........9.....s ........s-...s....o/......o#...r...po0..........,$..(#.....o#...r...po0...s....o1........o2...(3.......o4...(5.......o6...(7.......o8...(9.......o:...(;.......o<...(=.........

C:\Users\user\AppData\Roaming\XyLTxdgHV.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\z1ProductSampleRequirement.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.7739166723261475
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	z1ProductSampleRequirement.exe
File size:	1'022'464 bytes
MD5:	2b3aa1b01d8963ed35a0050f793b4811
SHA1:	34df4ca808f2d35290d4008f2c6b3ea7e8e80d8a
SHA256:	1682ee7703dd036cbdf6ad6daa38ddb7a4e7ab567b273f9ee209672f339feb2d
SHA512:	b42d1b09fb0c092074e38a2e885c959d12a63c5e7741ec976ec507cf2f7a14b6dce7e40e9bea7eb0d55caf6acbece8d1dd841427e43041cb8f7e742dfbcf67b4
SSDEEP:	24576:XwKjd3QboMkqo8VnR4la8/GmLVqugzVdy/d:Ayd3QboMkqOla8VMVdy
TLSH:	7325DFD03A767319DEB44AB89528DDB543B52E69B010FAE61DCC3BD739AD3009E08F46
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....#g..............0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4fae12
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67231AD6 [Thu Oct 31 05:51:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
push ebx
add byte ptr [ecx+00h], bh
jnc 00007FDDED1037C2h
je 00007FDDED1037C2h
add byte ptr [ebp+00h], ch
add byte ptr [ecx+00h], al
arpl word ptr [eax], ax
je 00007FDDED1037C2h
imul eax, dword ptr [eax], 00610076h
je 00007FDDED1037C2h
outsd
add byte ptr [edx+00h], dh
add dword ptr [eax], eax
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add eax, dword ptr [eax]
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add eax, 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xfadc0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfc000	0x5ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf7a40	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xf8e50	0xf9000	fd534b529b24f3041d53d11395a1c912	False	0.8818173082956827	data	7.778861872488694	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xfc000	0x5ac	0x600	69ee05e44e2112ba54e5f3095b6c9750	False	0.4212239583333333	data	4.087576745907995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfe000	0xc	0x200	ec29b6749c3c1ce2255ba0319198d251	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xfc090	0x31c	data			0.4321608040201005
RT_MANIFEST	0xfc3bc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T09:32:00.575139+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49707	51.75.166.98	2195	TCP
2024-11-01T09:32:02.348331+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49708	178.237.33.50	80	TCP
2024-11-01T09:32:14.685625+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.5	49711	TCP
2024-11-01T09:32:53.372550+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.5	49922	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 09:31:59.724946976 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:31:59.729753971 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:31:59.730119944 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:31:59.735193014 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:31:59.740237951 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:32:00.528578997 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:32:00.575139046 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:32:00.630790949 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:32:00.649257898 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:32:00.656404018 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:32:00.656502962 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:32:00.664402962 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:32:00.911179066 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:32:00.930330992 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:32:00.935193062 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:32:01.013417006 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:32:01.075941086 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:32:01.500919104 CET	49708	80	192.168.2.5	178.237.33.50
Nov 1, 2024 09:32:01.505716085 CET	80	49708	178.237.33.50	192.168.2.5
Nov 1, 2024 09:32:01.505827904 CET	49708	80	192.168.2.5	178.237.33.50
Nov 1, 2024 09:32:01.524656057 CET	49708	80	192.168.2.5	178.237.33.50
Nov 1, 2024 09:32:01.529526949 CET	80	49708	178.237.33.50	192.168.2.5
Nov 1, 2024 09:32:02.348257065 CET	80	49708	178.237.33.50	192.168.2.5
Nov 1, 2024 09:32:02.348330975 CET	49708	80	192.168.2.5	178.237.33.50
Nov 1, 2024 09:32:02.375124931 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:32:02.380006075 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:32:03.472436905 CET	80	49708	178.237.33.50	192.168.2.5
Nov 1, 2024 09:32:03.472507954 CET	49708	80	192.168.2.5	178.237.33.50
Nov 1, 2024 09:32:31.371165037 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:32:31.372873068 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:32:31.377768040 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:33:01.840245962 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:33:01.841527939 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:33:01.846473932 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:33:32.309000969 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:33:32.310551882 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:33:32.315320015 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:33:51.231524944 CET	49708	80	192.168.2.5	178.237.33.50
Nov 1, 2024 09:33:51.670126915 CET	49708	80	192.168.2.5	178.237.33.50
Nov 1, 2024 09:33:52.316121101 CET	49708	80	192.168.2.5	178.237.33.50
Nov 1, 2024 09:33:53.528300047 CET	49708	80	192.168.2.5	178.237.33.50
Nov 1, 2024 09:33:56.028415918 CET	49708	80	192.168.2.5	178.237.33.50
Nov 1, 2024 09:34:00.919241905 CET	49708	80	192.168.2.5	178.237.33.50
Nov 1, 2024 09:34:02.778143883 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:34:02.779532909 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:34:02.784332991 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:34:10.528275967 CET	49708	80	192.168.2.5	178.237.33.50
Nov 1, 2024 09:34:33.371174097 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:34:33.372807026 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:34:33.377804995 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:35:03.716877937 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:35:03.719146013 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:35:03.724013090 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:35:34.153378010 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:35:34.154725075 CET	49707	2195	192.168.2.5	51.75.166.98
Nov 1, 2024 09:35:34.160110950 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:36:04.669101000 CET	2195	49707	51.75.166.98	192.168.2.5
Nov 1, 2024 09:36:04.715929985 CET	49707	2195	192.168.2.5	51.75.166.98

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 09:31:59.406703949 CET	58255	53	192.168.2.5	1.1.1.1
Nov 1, 2024 09:31:59.716320992 CET	53	58255	1.1.1.1	192.168.2.5
Nov 1, 2024 09:32:01.488461018 CET	57372	53	192.168.2.5	1.1.1.1
Nov 1, 2024 09:32:01.496764898 CET	53	57372	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 1, 2024 09:31:59.406703949 CET	192.168.2.5	1.1.1.1	0x34ca	Standard query (0)	teebro1800.dynamic-dns.net	A (IP address)	IN (0x0001)	false
Nov 1, 2024 09:32:01.488461018 CET	192.168.2.5	1.1.1.1	0x92ab	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 1, 2024 09:31:59.716320992 CET	1.1.1.1	192.168.2.5	0x34ca	No error (0)	teebro1800.dynamic-dns.net		51.75.166.98	A (IP address)	IN (0x0001)	false
Nov 1, 2024 09:32:01.496764898 CET	1.1.1.1	192.168.2.5	0x92ab	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	178.237.33.50	80	5708	C:\Users\user\Desktop\z1ProductSampleRequirement.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 09:32:01.524656057 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Nov 1, 2024 09:32:02.348257065 CET	1165	IN	HTTP/1.1 200 OK date: Fri, 01 Nov 2024 08:32:02 GMT server: Apache content-length: 957 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4b 69 6c 6c 65 65 6e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 54 65 78 61 73 22 2c 0a 20 20 22 67 65 6f 70 [TRUNCATED] Data Ascii: { "geoplugin_request":"173.254.250.82", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"Killeen", "geoplugin_region":"Texas", "geoplugin_regionCode":"TX", "geoplugin_regionName":"Texas", "geoplugin_areaCode":"", "geoplugin_dmaCode":"625", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"31.0065", "geoplugin_longitude":"-97.8406", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/Chicago", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	04:31:55
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\z1ProductSampleRequirement.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z1ProductSampleRequirement.exe"
Imagebase:	0x8a0000
File size:	1'022'464 bytes
MD5 hash:	2B3AA1B01D8963ED35A0050F793B4811
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2088133445.000000000499B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2088133445.000000000499B000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	04:31:56
Start date:	01/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z1ProductSampleRequirement.exe"
Imagebase:	0x690000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	04:31:56
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	04:31:56
Start date:	01/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\XyLTxdgHV.exe"
Imagebase:	0x690000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	04:31:56
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	04:31:56
Start date:	01/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XyLTxdgHV" /XML "C:\Users\user\AppData\Local\Temp\tmpD6AD.tmp"
Imagebase:	0x600000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	04:31:57
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	04:31:58
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\z1ProductSampleRequirement.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z1ProductSampleRequirement.exe"
Imagebase:	0x9a0000
File size:	1'022'464 bytes
MD5 hash:	2B3AA1B01D8963ED35A0050F793B4811
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000009.00000002.4498177592.0000000001197000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000009.00000002.4498721754.0000000002D2F000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000009.00000002.4498177592.00000000011D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000009.00000002.4498177592.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	10
Start time:	04:31:59
Start date:	01/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	04:32:00
Start date:	01/11/2024
Path:	C:\Users\user\AppData\Roaming\XyLTxdgHV.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\XyLTxdgHV.exe
Imagebase:	0x50000
File size:	1'022'464 bytes
MD5 hash:	2B3AA1B01D8963ED35A0050F793B4811
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000B.00000002.2129497203.00000000041CC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000B.00000002.2129497203.00000000041CC000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	04:32:02
Start date:	01/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XyLTxdgHV" /XML "C:\Users\user\AppData\Local\Temp\tmpEB9C.tmp"
Imagebase:	0x600000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	04:32:02
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	04:32:02
Start date:	01/11/2024
Path:	C:\Users\user\AppData\Roaming\XyLTxdgHV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\XyLTxdgHV.exe"
Imagebase:	0xec0000
File size:	1'022'464 bytes
MD5 hash:	2B3AA1B01D8963ED35A0050F793B4811
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.2105358568.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 0000000E.00000002.2104824544.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true