Windows Analysis Report
tXcFA8apHU.exe

AI detected suspicious sample

Source: Yara match	File source: 5.2.tXcFA8apHU.exe.46a9cb0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.njEnUdtKgG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.njEnUdtKgG.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.tXcFA8apHU.exe.471f2d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.tXcFA8apHU.exe.471f2d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.tXcFA8apHU.exe.46a9cb0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.3725647810.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1351775759.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1374108041.00000000036E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1325620534.00000000046A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tXcFA8apHU.exe PID: 7880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tXcFA8apHU.exe PID: 4620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: njEnUdtKgG.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: njEnUdtKgG.exe PID: 6836, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: tXcFA8apHU.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_004315EC CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

20_2_004315EC

Source: tXcFA8apHU.exe, 00000005.00000002.1325620534.00000000046A9000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_2c7eed20-d

Source: tXcFA8apHU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: tXcFA8apHU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: vlzh.pdb source: tXcFA8apHU.exe, njEnUdtKgG.exe.5.dr
Source:	Binary string: vlzh.pdbSHA256\|\| source: tXcFA8apHU.exe, njEnUdtKgG.exe.5.dr

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0041A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	20_2_0041A01B
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0040B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	20_2_0040B28E
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0040838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	20_2_0040838E
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_004087A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	20_2_004087A0
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00407848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	20_2_00407848
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_004068CD FindFirstFileW,FindNextFileW,	20_2_004068CD
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0044BA59 FindFirstFileExA,	20_2_0044BA59
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0040AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	20_2_0040AA71
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00417AAB FindFirstFileW,FindNextFileW,FindNextFileW,	20_2_00417AAB
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0040AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	20_2_0040AC78

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_00406D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

20_2_00406D28

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49711 -> 154.216.19.139:3124

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: lack.work.gd

Source: global traffic

TCP traffic: 192.168.2.10:49711 -> 154.216.19.139:3124

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 154.216.19.139 154.216.19.139
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: SKHT-ASShenzhenKatherineHengTechnologyInformationCo SKHT-ASShenzhenKatherineHengTechnologyInformationCo

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.10:49724 -> 178.237.33.50:80

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_0041936B InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

20_2_0041936B

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: lack.work.gd
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, njEnUdtKgG.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: tXcFA8apHU.exe, 00000005.00000002.1325620534.00000000046A9000.00000004.00000800.00020000.00000000.sdmp, njEnUdtKgG.exe, 00000010.00000002.1374108041.00000000036E5000.00000004.00000800.00020000.00000000.sdmp, njEnUdtKgG.exe, 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpwk
Source: tXcFA8apHU.exe, 00000005.00000002.1324653197.0000000002C10000.00000004.00000800.00020000.00000000.sdmp, njEnUdtKgG.exe, 00000010.00000002.1371530809.0000000002620000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_00409340 SetWindowsHookExA 0000000D,0040932C,00000000

20_2_00409340

Installs a global keyboard hook

Source: C:\Users\user\Desktop\tXcFA8apHU.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\tXcFA8apHU.exe

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_0040A65A OpenClipboard,GetClipboardData,CloseClipboard,

20_2_0040A65A

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_00414EC1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

20_2_00414EC1

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_0040A65A OpenClipboard,GetClipboardData,CloseClipboard,

20_2_0040A65A

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_00409468 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,

20_2_00409468

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 5.2.tXcFA8apHU.exe.46a9cb0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.njEnUdtKgG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.njEnUdtKgG.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.tXcFA8apHU.exe.471f2d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.tXcFA8apHU.exe.471f2d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.tXcFA8apHU.exe.46a9cb0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.3725647810.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1351775759.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1374108041.00000000036E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1325620534.00000000046A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tXcFA8apHU.exe PID: 7880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tXcFA8apHU.exe PID: 4620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: njEnUdtKgG.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: njEnUdtKgG.exe PID: 6836, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_0041A76C SystemParametersInfoW,

20_2_0041A76C

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.tXcFA8apHU.exe.46a9cb0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.tXcFA8apHU.exe.46a9cb0.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.tXcFA8apHU.exe.46a9cb0.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 20.2.njEnUdtKgG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 20.2.njEnUdtKgG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 20.2.njEnUdtKgG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 20.2.njEnUdtKgG.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 20.2.njEnUdtKgG.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 20.2.njEnUdtKgG.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 5.2.tXcFA8apHU.exe.471f2d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.tXcFA8apHU.exe.471f2d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.tXcFA8apHU.exe.471f2d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 5.2.tXcFA8apHU.exe.471f2d0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.tXcFA8apHU.exe.471f2d0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.tXcFA8apHU.exe.471f2d0.1.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 5.2.tXcFA8apHU.exe.46a9cb0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.tXcFA8apHU.exe.46a9cb0.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 00000010.00000002.1374108041.00000000036E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000005.00000002.1325620534.00000000046A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: tXcFA8apHU.exe PID: 7880, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: njEnUdtKgG.exe PID: 7500, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: njEnUdtKgG.exe PID: 6836, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Users\user\Desktop\tXcFA8apHU.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_00414DB4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

20_2_00414DB4

Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Code function: 5_2_0298DE14	5_2_0298DE14
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_0256DE14	16_2_0256DE14
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_04C17988	16_2_04C17988
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_04C10040	16_2_04C10040
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_04C10007	16_2_04C10007
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_04C17979	16_2_04C17979
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_05219AE8	16_2_05219AE8
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_0521E568	16_2_0521E568
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_0521E130	16_2_0521E130
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_0521EE40	16_2_0521EE40
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_0521CE90	16_2_0521CE90
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_05219AD8	16_2_05219AD8
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00425152	20_2_00425152
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00435286	20_2_00435286
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_004513D4	20_2_004513D4
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0045050B	20_2_0045050B
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00436510	20_2_00436510
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_004316FB	20_2_004316FB
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0043569E	20_2_0043569E
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00443700	20_2_00443700
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_004257FB	20_2_004257FB
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_004128E3	20_2_004128E3
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00425964	20_2_00425964
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0041B917	20_2_0041B917
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0043D9CC	20_2_0043D9CC
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00435AD3	20_2_00435AD3
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00424BC3	20_2_00424BC3
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0043DBFB	20_2_0043DBFB
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0044ABA9	20_2_0044ABA9
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00433C0B	20_2_00433C0B
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00434D8A	20_2_00434D8A
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0043DE2A	20_2_0043DE2A
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0041CEAF	20_2_0041CEAF
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00435F08	20_2_00435F08

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: String function: 00402073 appears 51 times
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: String function: 00432B90 appears 53 times
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: String function: 00432525 appears 41 times

Source: tXcFA8apHU.exe, 00000005.00000002.1327846063.0000000005220000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs tXcFA8apHU.exe
Source: tXcFA8apHU.exe, 00000005.00000002.1325620534.0000000003CD4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs tXcFA8apHU.exe
Source: tXcFA8apHU.exe, 00000005.00000002.1328819513.0000000007900000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs tXcFA8apHU.exe
Source: tXcFA8apHU.exe, 00000005.00000002.1322649352.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs tXcFA8apHU.exe
Source: tXcFA8apHU.exe	Binary or memory string: OriginalFilenamevlzh.exe" vs tXcFA8apHU.exe

Source: tXcFA8apHU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.2.tXcFA8apHU.exe.46a9cb0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.tXcFA8apHU.exe.46a9cb0.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.tXcFA8apHU.exe.46a9cb0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 20.2.njEnUdtKgG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 20.2.njEnUdtKgG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 20.2.njEnUdtKgG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 20.2.njEnUdtKgG.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 20.2.njEnUdtKgG.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 20.2.njEnUdtKgG.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 5.2.tXcFA8apHU.exe.471f2d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.tXcFA8apHU.exe.471f2d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.tXcFA8apHU.exe.471f2d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 5.2.tXcFA8apHU.exe.471f2d0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.tXcFA8apHU.exe.471f2d0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.tXcFA8apHU.exe.471f2d0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 5.2.tXcFA8apHU.exe.46a9cb0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.tXcFA8apHU.exe.46a9cb0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 00000010.00000002.1374108041.00000000036E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000005.00000002.1325620534.00000000046A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: tXcFA8apHU.exe PID: 7880, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: njEnUdtKgG.exe PID: 7500, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: njEnUdtKgG.exe PID: 6836, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: tXcFA8apHU.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: njEnUdtKgG.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, eQKgF25LTNMlXvF3Mj.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, JxavqxQjqmpnLA54qd.cs	Security API names: _0020.SetAccessControl
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, JxavqxQjqmpnLA54qd.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, JxavqxQjqmpnLA54qd.cs	Security API names: _0020.AddAccessRule
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, JxavqxQjqmpnLA54qd.cs	Security API names: _0020.SetAccessControl
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, JxavqxQjqmpnLA54qd.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, JxavqxQjqmpnLA54qd.cs	Security API names: _0020.AddAccessRule
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, eQKgF25LTNMlXvF3Mj.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@19/17@3/2

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_00415C90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

20_2_00415C90

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_0040E2E7 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,

20_2_0040E2E7

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_00419493 FindResourceA,LoadResource,LockResource,SizeofResource,

20_2_00419493

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_00418A00 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

20_2_00418A00

Source: C:\Users\user\Desktop\tXcFA8apHU.exe

File created: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Mutant created: \Sessions\1\BaseNamedObjects\QAGvCtl
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3144:120:WilError_03
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Mutant created: \Sessions\1\BaseNamedObjects\gig-RM2DNS
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5832:120:WilError_03

Source: C:\Users\user\Desktop\tXcFA8apHU.exe

File created: C:\Users\user\AppData\Local\Temp\tmp4537.tmp

Source: tXcFA8apHU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: tXcFA8apHU.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\tXcFA8apHU.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\tXcFA8apHU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: tXcFA8apHU.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\tXcFA8apHU.exe

File read: C:\Users\user\Desktop\tXcFA8apHU.exe

Source: unknown	Process created: C:\Users\user\Desktop\tXcFA8apHU.exe "C:\Users\user\Desktop\tXcFA8apHU.exe"
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\tXcFA8apHU.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\njEnUdtKgG.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\njEnUdtKgG" /XML "C:\Users\user\AppData\Local\Temp\tmp4537.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Users\user\Desktop\tXcFA8apHU.exe "C:\Users\user\Desktop\tXcFA8apHU.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe C:\Users\user\AppData\Roaming\njEnUdtKgG.exe
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\njEnUdtKgG" /XML "C:\Users\user\AppData\Local\Temp\tmp567D.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process created: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe "C:\Users\user\AppData\Roaming\njEnUdtKgG.exe"
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\tXcFA8apHU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\njEnUdtKgG.exe"	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\njEnUdtKgG" /XML "C:\Users\user\AppData\Local\Temp\tmp4537.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Users\user\Desktop\tXcFA8apHU.exe "C:\Users\user\Desktop\tXcFA8apHU.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\njEnUdtKgG" /XML "C:\Users\user\AppData\Local\Temp\tmp567D.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process created: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe "C:\Users\user\AppData\Roaming\njEnUdtKgG.exe"	Jump to behavior

Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\tXcFA8apHU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\tXcFA8apHU.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Source: tXcFA8apHU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: tXcFA8apHU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: tXcFA8apHU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: vlzh.pdb source: tXcFA8apHU.exe, njEnUdtKgG.exe.5.dr
Source:	Binary string: vlzh.pdbSHA256\|\| source: tXcFA8apHU.exe, njEnUdtKgG.exe.5.dr

Data Obfuscation

Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, JxavqxQjqmpnLA54qd.cs	.Net Code: I8p8IEBymg System.Reflection.Assembly.Load(byte[])
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, JxavqxQjqmpnLA54qd.cs	.Net Code: I8p8IEBymg System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_0041A8DA LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

20_2_0041A8DA

Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Code function: 14_2_02B1F978 push ebp; retf	14_2_02B1F97A
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_04C1A189 push cs; ret	16_2_04C1A18A
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_04C1A280 push cs; ret	16_2_04C1A282
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_04C1A283 push cs; ret	16_2_04C1A29A
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_04C1AB33 push ss; ret	16_2_04C1AB3A
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_04C1B7FB push ds; ret	16_2_04C1B802
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_04C19149 push es; ret	16_2_04C1914A
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_04C19258 push es; ret	16_2_04C1925A
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 16_2_04C1934B push es; ret	16_2_04C19352
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_004000D8 push es; iretd	20_2_004000D9
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0040008C push es; iretd	20_2_0040008D
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_004542E6 push ecx; ret	20_2_004542F9
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0045B4FD push esi; ret	20_2_0045B506
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00432BD6 push ecx; ret	20_2_00432BE9
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00454C08 push eax; ret	20_2_00454C26

Source: tXcFA8apHU.exe	Static PE information: section name: .text entropy: 7.913890207128523
Source: njEnUdtKgG.exe.5.dr	Static PE information: section name: .text entropy: 7.913890207128523

Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, y8Bw73aARi5Z4DoIxW.cs	High entropy of concatenated method names: 'jjNfAAM3Md', 'ld0fR2BP1F', 'eQhfGpVEZY', 'NH3GUtldaO', 'UD8GzSuhtR', 'H0cfWPSK4l', 'El2fPajPA4', 'dqlfD3owlZ', 'N4xfbRZ3UU', 'AYWf8wL6fI'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, xLPlI3CcHciwhq420o.cs	High entropy of concatenated method names: 'Ghc39K28PP', 'NgP3Zw0oC9', 'Lyr3C3W4Pq', 'Jab3p9OFtG', 'mtk3hYLgbT', 'hcR3OxFdUf', 'TY63HhrQef', 'Fe53VwHjKa', 'ffP3eWRO4B', 'x2g3armxxw'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, sHCwVIiAwf3lvMZsky.cs	High entropy of concatenated method names: 'QHdJLGhfaP', 'JtvJ7kyOjD', 'ToString', 'DQsJAUYYsT', 'IcoJXAZllV', 'TWZJR25TfJ', 'o7ZJoAWiHn', 'FuxJGFdLMl', 'gHsJfOiAjD', 'ry3JQKVryv'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, jwm2ZIjs6AGpIaeP4u.cs	High entropy of concatenated method names: 'MUiq5TmQ3g', 'eZPqKWv1uv', 'OUvqFlgJaJ', 'sJ0qhpS0oc', 'Y47qHXY6e6', 'TpTqVp6fWE', 's3cqaLAJUH', 'QreqMflZHk', 'kNYq9WWpq5', 'OloqB3o2j8'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, vuMwaHXh3RJW2dATXx.cs	High entropy of concatenated method names: 'Dispose', 'FBMPmZRsqQ', 'XxYDh8I7jY', 'PrU0cPgTOM', 'At0PUJADdZ', 'MisPzlIkQ9', 'ProcessDialogKey', 'C2MDW59c6k', 'YtqDPyQcGH', 'MkPDDRJdoO'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, JxavqxQjqmpnLA54qd.cs	High entropy of concatenated method names: 'wOCbxUtpcB', 'GUFbAXyEnj', 'wyLbXujZ9g', 'EQnbRd1gYP', 'cTUboN4qN5', 'ztqbGFBpd0', 'mIebfSHaeT', 'gKlbQOc5BS', 'apSbYNdwrP', 'ogobLYee8v'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, jChadtPPxI8C0pfTdAQ.cs	High entropy of concatenated method names: 'bdK0UoXo1E', 'uyR0zkvo8y', 'C6xyWBE9S9', 'SOWyPj86LM', 'N3AyD77nGL', 'NZ6yby8U4F', 'fdly8snDWT', 'IuDyx4Unqb', 'xr8yAjSie0', 'NNWyX3TeDX'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, C0EbbtsfydNiIN0dNP.cs	High entropy of concatenated method names: 'cTIJ1FEUwZ', 'zW4JUY1Wnd', 'WlrSWjunmK', 'WdiSPlvE3V', 'p1mJByhoC5', 'Jk8JZnvIql', 'lsWJji0bHN', 'qRuJCjtJRH', 'kFKJpYk3eS', 'f9jJT0AI6C'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, L59c6kmUtqyQcGHMkP.cs	High entropy of concatenated method names: 'z522FT5FHa', 'J6K2hDSmlf', 'eqw2OroLpr', 'N9X2HnRGhx', 'HRD2VDPnX3', 'TLu2eeUdIF', 'bhX2aojYEa', 'il62M4iPWy', 'Bag2nuajeI', 'FR429ly2bj'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, OYIIpkKfDpsGNxxttJ.cs	High entropy of concatenated method names: 'VDvRNYC4iU', 'YvCRcykf4X', 'c8HR5ApsbB', 'eWYRK6j6xu', 'xA8R3gLxZP', 'WC7RkN1cFr', 'GuARJvd05j', 'QctRSq7raM', 'ylwR2Bw3hV', 'PPaR0q1y5a'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, SQhuDezJM10m7Opmf4.cs	High entropy of concatenated method names: 'qpV0cW21j4', 'Bxc053Ujvt', 'WNW0KyW3P7', 'z580FN3Fo0', 'BZO0hSKNNT', 'YRx0HuDT8R', 'hYq0Vik0oB', 'qo40uB4esQ', 'Maw0ddpWij', 'gTt0tmXIYX'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, qDQcgXneHl3d89VFyi.cs	High entropy of concatenated method names: 'QPlfdEVwTq', 'APxft5JPv2', 'GxdfInYThb', 'LnsfNsqbtI', 'lGmf4wdoZq', 'skrfcZqZYe', 'TlBflKuPMu', 'xEyf5cvQV7', 'YQAfKiUc6q', 'NfZfrYn569'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, cbkM15P8gTZ1OFR5M7d.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lhTE28226o', 'iZwE0v9MPU', 'TNQEy6Qarc', 'j6WEEYq4PB', 'VHhEwk8IQ4', 'WN2Eg1XlaM', 'GDVEu7w3qk'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, FTdjLT8AchGKdUXO70.cs	High entropy of concatenated method names: 'xexPfQKgF2', 'mTNPQMlXvF', 'pfDPLpsGNx', 'ettP7JP4JW', 'M24P3JHIxL', 'YJ3PkeTuJ9', 'Wyp9EndJ2CwpKu5F4p', 'FA7KOqQYAj2FRv9RJE', 'NEvPPfaA3v', 'fRePbqSspq'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, eQKgF25LTNMlXvF3Mj.cs	High entropy of concatenated method names: 'aAcXCmquDm', 'XRAXpmNekm', 'XacXTnHMMH', 'wHBXiEaYD6', 'A3mX6fMDDI', 'yTdXsrYqMW', 'j5PXvoJSNO', 'ofNX16LU12', 'l4fXmXAJqB', 'k2SXUwW0Kp'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, R31DT4D8L5hVH2wAZa.cs	High entropy of concatenated method names: 'NviIHwJ5U', 'e9eNvtqSx', 'SOAc9EDGv', 'lnklelbQ3', 'esAKMcDkk', 'A43rKZZRr', 'QC01rh9FkeiSceUtoh', 'RV3m9cTjvN4j0xCWha', 'dpNSj8IE8', 'yvn0VZGoW'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, tHQfgiPWZJmhumwjONa.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IcG0BpqVHH', 'AT40ZPpSri', 'AgB0j1JoO9', 'OZR0CMeGfK', 'TRI0pjC1uE', 'PTC0TJ1MRq', 'pVd0iMCmED'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, zxLUJ3FeTuJ98MTT82.cs	High entropy of concatenated method names: 'w66GxQMLDK', 'CC5GXSmUJX', 'zIiGoFSt9v', 'KoaGf78Bbn', 'ruSGQ1UugX', 'Sh6o6ncpha', 'RAMosfpkhV', 'IgjovLoFDT', 'z7Qo1FGSIq', 'R0Nom8cTwI'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, uLxNn2TKVZPb2cMt2Z.cs	High entropy of concatenated method names: 'ToString', 'QO0kBvxwhD', 'qO5khnAWPG', 'VYRkOgoFs5', 'UONkH6Db7k', 'uxPkV07bal', 'AybkeI0out', 'JdfkaWK8Cc', 'vMJkMiP3ZT', 'as8knFh8cH'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, hJdoOKUh4eK1WtLonc.cs	High entropy of concatenated method names: 'WQO0RVb6Yv', 'acj0oqyYBp', 'yOl0Ggc2M6', 'lxS0f8gAkO', 'R6s022t1ws', 'rKX0Q7jbst', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.tXcFA8apHU.exe.7900000.4.raw.unpack, UrkoT0v9cFBMZRsqQN.cs	High entropy of concatenated method names: 'Mq823T8qQS', 'Jo72JjQSmT', 'Bed222Lq2m', 'Rfq2ywXMgV', 'p4R2w0fPHf', 'NfG2urEQ7q', 'Dispose', 'kJUSAWWOoD', 'YsfSXaT7su', 'DIESReJjOD'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, y8Bw73aARi5Z4DoIxW.cs	High entropy of concatenated method names: 'jjNfAAM3Md', 'ld0fR2BP1F', 'eQhfGpVEZY', 'NH3GUtldaO', 'UD8GzSuhtR', 'H0cfWPSK4l', 'El2fPajPA4', 'dqlfD3owlZ', 'N4xfbRZ3UU', 'AYWf8wL6fI'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, xLPlI3CcHciwhq420o.cs	High entropy of concatenated method names: 'Ghc39K28PP', 'NgP3Zw0oC9', 'Lyr3C3W4Pq', 'Jab3p9OFtG', 'mtk3hYLgbT', 'hcR3OxFdUf', 'TY63HhrQef', 'Fe53VwHjKa', 'ffP3eWRO4B', 'x2g3armxxw'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, sHCwVIiAwf3lvMZsky.cs	High entropy of concatenated method names: 'QHdJLGhfaP', 'JtvJ7kyOjD', 'ToString', 'DQsJAUYYsT', 'IcoJXAZllV', 'TWZJR25TfJ', 'o7ZJoAWiHn', 'FuxJGFdLMl', 'gHsJfOiAjD', 'ry3JQKVryv'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, jwm2ZIjs6AGpIaeP4u.cs	High entropy of concatenated method names: 'MUiq5TmQ3g', 'eZPqKWv1uv', 'OUvqFlgJaJ', 'sJ0qhpS0oc', 'Y47qHXY6e6', 'TpTqVp6fWE', 's3cqaLAJUH', 'QreqMflZHk', 'kNYq9WWpq5', 'OloqB3o2j8'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, vuMwaHXh3RJW2dATXx.cs	High entropy of concatenated method names: 'Dispose', 'FBMPmZRsqQ', 'XxYDh8I7jY', 'PrU0cPgTOM', 'At0PUJADdZ', 'MisPzlIkQ9', 'ProcessDialogKey', 'C2MDW59c6k', 'YtqDPyQcGH', 'MkPDDRJdoO'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, JxavqxQjqmpnLA54qd.cs	High entropy of concatenated method names: 'wOCbxUtpcB', 'GUFbAXyEnj', 'wyLbXujZ9g', 'EQnbRd1gYP', 'cTUboN4qN5', 'ztqbGFBpd0', 'mIebfSHaeT', 'gKlbQOc5BS', 'apSbYNdwrP', 'ogobLYee8v'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, jChadtPPxI8C0pfTdAQ.cs	High entropy of concatenated method names: 'bdK0UoXo1E', 'uyR0zkvo8y', 'C6xyWBE9S9', 'SOWyPj86LM', 'N3AyD77nGL', 'NZ6yby8U4F', 'fdly8snDWT', 'IuDyx4Unqb', 'xr8yAjSie0', 'NNWyX3TeDX'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, C0EbbtsfydNiIN0dNP.cs	High entropy of concatenated method names: 'cTIJ1FEUwZ', 'zW4JUY1Wnd', 'WlrSWjunmK', 'WdiSPlvE3V', 'p1mJByhoC5', 'Jk8JZnvIql', 'lsWJji0bHN', 'qRuJCjtJRH', 'kFKJpYk3eS', 'f9jJT0AI6C'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, L59c6kmUtqyQcGHMkP.cs	High entropy of concatenated method names: 'z522FT5FHa', 'J6K2hDSmlf', 'eqw2OroLpr', 'N9X2HnRGhx', 'HRD2VDPnX3', 'TLu2eeUdIF', 'bhX2aojYEa', 'il62M4iPWy', 'Bag2nuajeI', 'FR429ly2bj'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, OYIIpkKfDpsGNxxttJ.cs	High entropy of concatenated method names: 'VDvRNYC4iU', 'YvCRcykf4X', 'c8HR5ApsbB', 'eWYRK6j6xu', 'xA8R3gLxZP', 'WC7RkN1cFr', 'GuARJvd05j', 'QctRSq7raM', 'ylwR2Bw3hV', 'PPaR0q1y5a'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, SQhuDezJM10m7Opmf4.cs	High entropy of concatenated method names: 'qpV0cW21j4', 'Bxc053Ujvt', 'WNW0KyW3P7', 'z580FN3Fo0', 'BZO0hSKNNT', 'YRx0HuDT8R', 'hYq0Vik0oB', 'qo40uB4esQ', 'Maw0ddpWij', 'gTt0tmXIYX'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, qDQcgXneHl3d89VFyi.cs	High entropy of concatenated method names: 'QPlfdEVwTq', 'APxft5JPv2', 'GxdfInYThb', 'LnsfNsqbtI', 'lGmf4wdoZq', 'skrfcZqZYe', 'TlBflKuPMu', 'xEyf5cvQV7', 'YQAfKiUc6q', 'NfZfrYn569'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, cbkM15P8gTZ1OFR5M7d.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lhTE28226o', 'iZwE0v9MPU', 'TNQEy6Qarc', 'j6WEEYq4PB', 'VHhEwk8IQ4', 'WN2Eg1XlaM', 'GDVEu7w3qk'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, FTdjLT8AchGKdUXO70.cs	High entropy of concatenated method names: 'xexPfQKgF2', 'mTNPQMlXvF', 'pfDPLpsGNx', 'ettP7JP4JW', 'M24P3JHIxL', 'YJ3PkeTuJ9', 'Wyp9EndJ2CwpKu5F4p', 'FA7KOqQYAj2FRv9RJE', 'NEvPPfaA3v', 'fRePbqSspq'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, eQKgF25LTNMlXvF3Mj.cs	High entropy of concatenated method names: 'aAcXCmquDm', 'XRAXpmNekm', 'XacXTnHMMH', 'wHBXiEaYD6', 'A3mX6fMDDI', 'yTdXsrYqMW', 'j5PXvoJSNO', 'ofNX16LU12', 'l4fXmXAJqB', 'k2SXUwW0Kp'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, R31DT4D8L5hVH2wAZa.cs	High entropy of concatenated method names: 'NviIHwJ5U', 'e9eNvtqSx', 'SOAc9EDGv', 'lnklelbQ3', 'esAKMcDkk', 'A43rKZZRr', 'QC01rh9FkeiSceUtoh', 'RV3m9cTjvN4j0xCWha', 'dpNSj8IE8', 'yvn0VZGoW'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, tHQfgiPWZJmhumwjONa.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IcG0BpqVHH', 'AT40ZPpSri', 'AgB0j1JoO9', 'OZR0CMeGfK', 'TRI0pjC1uE', 'PTC0TJ1MRq', 'pVd0iMCmED'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, zxLUJ3FeTuJ98MTT82.cs	High entropy of concatenated method names: 'w66GxQMLDK', 'CC5GXSmUJX', 'zIiGoFSt9v', 'KoaGf78Bbn', 'ruSGQ1UugX', 'Sh6o6ncpha', 'RAMosfpkhV', 'IgjovLoFDT', 'z7Qo1FGSIq', 'R0Nom8cTwI'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, uLxNn2TKVZPb2cMt2Z.cs	High entropy of concatenated method names: 'ToString', 'QO0kBvxwhD', 'qO5khnAWPG', 'VYRkOgoFs5', 'UONkH6Db7k', 'uxPkV07bal', 'AybkeI0out', 'JdfkaWK8Cc', 'vMJkMiP3ZT', 'as8knFh8cH'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, hJdoOKUh4eK1WtLonc.cs	High entropy of concatenated method names: 'WQO0RVb6Yv', 'acj0oqyYBp', 'yOl0Ggc2M6', 'lxS0f8gAkO', 'R6s022t1ws', 'rKX0Q7jbst', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.tXcFA8apHU.exe.3d29410.2.raw.unpack, UrkoT0v9cFBMZRsqQN.cs	High entropy of concatenated method names: 'Mq823T8qQS', 'Jo72JjQSmT', 'Bed222Lq2m', 'Rfq2ywXMgV', 'p4R2w0fPHf', 'NfG2urEQ7q', 'Dispose', 'kJUSAWWOoD', 'YsfSXaT7su', 'DIESReJjOD'

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_004063C6 ShellExecuteW,URLDownloadToFileW,

20_2_004063C6

Source: C:\Users\user\Desktop\tXcFA8apHU.exe

File created: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\tXcFA8apHU.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\njEnUdtKgG" /XML "C:\Users\user\AppData\Local\Temp\tmp4537.tmp"

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_00418A00 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

20_2_00418A00

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

20_2_0041A8DA

Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: tXcFA8apHU.exe PID: 7880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: njEnUdtKgG.exe PID: 7500, type: MEMORYSTR

Delayed program exit found

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_0040E18D Sleep,ExitProcess,

20_2_0040E18D

Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Memory allocated: 2980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Memory allocated: 29A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Memory allocated: 8EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Memory allocated: 9EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Memory allocated: A0D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Memory allocated: B0D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Memory allocated: C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Memory allocated: 25B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Memory allocated: 45B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Memory allocated: 8420000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Memory allocated: 9420000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Memory allocated: 9620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Memory allocated: A620000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

20_2_004186FE

Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7631	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1480	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8261	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1344	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Window / User API: threadDelayed 3806	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Window / User API: threadDelayed 5675	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Window / User API: foregroundWindowGot 1770	Jump to behavior

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

API coverage: 5.0 %

Source: C:\Users\user\Desktop\tXcFA8apHU.exe TID: 7992	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5832	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5980	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1016	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe TID: 6252	Thread sleep count: 233 > 30	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe TID: 6252	Thread sleep time: -116500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe TID: 6156	Thread sleep count: 3806 > 30	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe TID: 6156	Thread sleep time: -11418000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe TID: 6156	Thread sleep count: 5675 > 30	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe TID: 6156	Thread sleep time: -17025000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe TID: 7048	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0041A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	20_2_0041A01B
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0040B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	20_2_0040B28E
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0040838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	20_2_0040838E
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_004087A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	20_2_004087A0
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00407848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	20_2_00407848
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_004068CD FindFirstFileW,FindNextFileW,	20_2_004068CD
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0044BA59 FindFirstFileExA,	20_2_0044BA59
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0040AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	20_2_0040AA71
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00417AAB FindFirstFileW,FindNextFileW,FindNextFileW,	20_2_00417AAB
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_0040AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	20_2_0040AC78

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_00406D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

20_2_00406D28

Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000D13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Users\user\Desktop\tXcFA8apHU.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_004327AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

20_2_004327AE

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

20_2_0041A8DA

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_004407B5 mov eax, dword ptr fs:[00000030h]

20_2_004407B5

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_00410763 SetLastError,GetNativeSystemInfo,SetLastError,GetProcessHeap,HeapAlloc,SetLastError,

20_2_00410763

Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_004327AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_004327AE
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_004328FC SetUnhandledExceptionFilter,	20_2_004328FC
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_004398AC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_004398AC
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: 20_2_00432D5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_00432D5C

Source: C:\Users\user\Desktop\tXcFA8apHU.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\tXcFA8apHU.exe"
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\njEnUdtKgG.exe"
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\tXcFA8apHU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\njEnUdtKgG.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Memory written: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

20_2_00410B5C

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_004175E1 mouse_event,

20_2_004175E1

Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\tXcFA8apHU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\njEnUdtKgG.exe"	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\njEnUdtKgG" /XML "C:\Users\user\AppData\Local\Temp\tmp4537.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Process created: C:\Users\user\Desktop\tXcFA8apHU.exe "C:\Users\user\Desktop\tXcFA8apHU.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\njEnUdtKgG" /XML "C:\Users\user\AppData\Local\Temp\tmp567D.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Process created: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe "C:\Users\user\AppData\Roaming\njEnUdtKgG.exe"	Jump to behavior

Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerNS\&
Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerNS\
Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerm
Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagersInfor
Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerNS\y
Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager`
Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager^
Source: tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Program Manager]

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_004329DA cpuid

20_2_004329DA

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: EnumSystemLocalesW,	20_2_0044F17B
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: EnumSystemLocalesW,	20_2_0044F130
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: EnumSystemLocalesW,	20_2_0044F216
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	20_2_0044F2A3
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: GetLocaleInfoA,	20_2_0040E2BB
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: GetLocaleInfoW,	20_2_0044F4F3
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	20_2_0044F61C
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: GetLocaleInfoW,	20_2_0044F723
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	20_2_0044F7F0
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: EnumSystemLocalesW,	20_2_00445914
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: GetLocaleInfoW,	20_2_00445E1C
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	20_2_0044EEB8

Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Queries volume information: C:\Users\user\Desktop\tXcFA8apHU.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tXcFA8apHU.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Queries volume information: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_0040A0B0 GetLocalTime,wsprintfW,

20_2_0040A0B0

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_004195F8 GetUserNameW,

20_2_004195F8

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: 20_2_004466BF _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

20_2_004466BF

Source: C:\Users\user\Desktop\tXcFA8apHU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 5.2.tXcFA8apHU.exe.46a9cb0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.njEnUdtKgG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.njEnUdtKgG.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.tXcFA8apHU.exe.471f2d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.tXcFA8apHU.exe.471f2d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.tXcFA8apHU.exe.46a9cb0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.3725647810.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1351775759.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1374108041.00000000036E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1325620534.00000000046A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tXcFA8apHU.exe PID: 7880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tXcFA8apHU.exe PID: 4620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: njEnUdtKgG.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: njEnUdtKgG.exe PID: 6836, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

20_2_0040A953

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		20_2_0040AA71
Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	Code function: \key3.db		20_2_0040AA71

Remote Access Functionality

Source: Yara match	File source: 5.2.tXcFA8apHU.exe.46a9cb0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.njEnUdtKgG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.njEnUdtKgG.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.tXcFA8apHU.exe.471f2d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.tXcFA8apHU.exe.471f2d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.tXcFA8apHU.exe.46a9cb0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.3725647810.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1351775759.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1374108041.00000000036E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1325620534.00000000046A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tXcFA8apHU.exe PID: 7880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tXcFA8apHU.exe PID: 4620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: njEnUdtKgG.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: njEnUdtKgG.exe PID: 6836, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Code function: cmd.exe

20_2_0040567A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Windows Service	3 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	122 Process Injection	12 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	33 System Information Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	122 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
tXcFA8apHU.exe	66%	ReversingLabs	Win32.Backdoor.Remcos
tXcFA8apHU.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\njEnUdtKgG.exe	66%	ReversingLabs	Win32.Backdoor.Remcos

Source	Detection	Scanner	Label	Link
lack.work.gd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
lack.work.gd	154.216.19.139	true	true		unknown
geoplugin.net	178.237.33.50	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false		high
lack.work.gd	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://geoplugin.net/json.gp/C	tXcFA8apHU.exe, 00000005.00000002.1325620534.00000000046A9000.00000004.00000800.00020000.00000000.sdmp, njEnUdtKgG.exe, 00000010.00000002.1374108041.00000000036E5000.00000004.00000800.00020000.00000000.sdmp, njEnUdtKgG.exe, 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	high
http://geoplugin.net/json.gpl	tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	false	high
http://geoplugin.net/json.gpwk	tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	tXcFA8apHU.exe, 00000005.00000002.1324653197.0000000002C10000.00000004.00000800.00020000.00000000.sdmp, njEnUdtKgG.exe, 00000010.00000002.1371530809.0000000002620000.00000004.00000800.00020000.00000000.sdmp	false	high
http://geoplugin.net/json.gpSystem32	tXcFA8apHU.exe, 0000000E.00000002.3725647810.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.216.19.139	lack.work.gd	Seychelles		135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	true
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569310
Start date and time:	2024-12-05 17:53:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	tXcFA8apHU.exe renamed because original name is a hash value
Original Sample Name:	7943aab15dc5804448102c5c1fc5341b65708bff970773e25f0f27d807e90d29.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@19/17@3/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 96% Number of executed functions: 51 Number of non-executed functions: 184
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target tXcFA8apHU.exe, PID 4620 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: tXcFA8apHU.exe

Simulations

Behavior and APIs

Time	Type	Description
11:54:09	API Interceptor	6207617x Sleep call for process: tXcFA8apHU.exe modified
11:54:11	API Interceptor	28x Sleep call for process: powershell.exe modified
11:54:14	API Interceptor	3x Sleep call for process: njEnUdtKgG.exe modified
17:54:13	Task Scheduler	Run new task: njEnUdtKgG path: C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
154.216.19.139	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
178.237.33.50	f5TWdT5EAc.exe	Get hash	malicious	Phorpiex, RHADAMANTHYS, Xmrig	Browse	www.geoplugin.net/json.gp?ip=
	17333253674c71ac3d5875ca830e11f4630bf65d3b8b7e2686361e216df980d330c80afb30623.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	togiveme.doc	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	greatnew.doc	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	cUxXrdUvYR.rtf	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Amoxycillin Trihydrate Powder.docx.doc	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Order_DEC2024.wsf	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	#U041f#U043b#U0430#U0449#U0430#U043d#U0435.docx	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	7a67aa0f4b0c33b1bd9acf18ea4e96d357e8198c5eaaab2404e9f6802db3fb87_d.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geoplugin.net	17333253674c71ac3d5875ca830e11f4630bf65d3b8b7e2686361e216df980d330c80afb30623.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	togiveme.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	greatnew.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	cUxXrdUvYR.rtf	Get hash	malicious	Remcos	Browse	178.237.33.50
	Amoxycillin Trihydrate Powder.docx.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	Order_DEC2024.wsf	Get hash	malicious	Remcos	Browse	178.237.33.50
	#U041f#U043b#U0430#U0449#U0430#U043d#U0435.docx	Get hash	malicious	Remcos	Browse	178.237.33.50
	7a67aa0f4b0c33b1bd9acf18ea4e96d357e8198c5eaaab2404e9f6802db3fb87_d.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.19.139
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.19.139
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	45.207.215.90
	zmap.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.18.131
	zmap.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.18.131
	zmap.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.18.131
	armv7l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.241.11.68
	zmap.x86.elf	Get hash	malicious	Okiru	Browse	154.216.18.131
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.230.19.162
	zmap.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.18.131
ATOM86-ASATOM86NL	f5TWdT5EAc.exe	Get hash	malicious	Phorpiex, RHADAMANTHYS, Xmrig	Browse	178.237.33.50
	17333253674c71ac3d5875ca830e11f4630bf65d3b8b7e2686361e216df980d330c80afb30623.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	togiveme.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	greatnew.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	cUxXrdUvYR.rtf	Get hash	malicious	Remcos	Browse	178.237.33.50
	Amoxycillin Trihydrate Powder.docx.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	Order_DEC2024.wsf	Get hash	malicious	Remcos	Browse	178.237.33.50
	#U041f#U043b#U0430#U0449#U0430#U043d#U0435.docx	Get hash	malicious	Remcos	Browse	178.237.33.50
	7a67aa0f4b0c33b1bd9acf18ea4e96d357e8198c5eaaab2404e9f6802db3fb87_d.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

Process:	C:\Users\user\Desktop\tXcFA8apHU.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	7.135787568310166
Encrypted:	false
SSDEEP:	6:qEyO5oVLFlZQ0qkZ0XpfpjRJzSuxyNnq7o21e5Y:rCXo+0ZhjRJzJxhr1eq
MD5:	64F98EA0A57F0E44575E8C283E867DCB
SHA1:	2620C456325858FD11381921D24DA5048941A5B1
SHA-256:	54897B591E9F67F6DE722DFEEDED4A901346127EE8556E0DF86D229421C2C5C3
SHA-512:	44F560346185E9B1A1DC98A6FEB85A2202DB1A196BF57123AF3565683F68733962E5E36D91DEA7DF37E103C95957F86DC32EFA44A80FF1CC4127AD73BDBB7AEE
Malicious:	false
Preview:	..U.IX2..U.F.n'.....[.N../x.B.\_.0.c.Pvs......V.q..=..a4..\Fl..).e`.W.u.'E.J..F....!...K.,k~5O.Z.>G.x......?\.4.Lx..{.].#..}\|a..}..>b.+n.C..v..........O.Q;-.c.....N.Rv.sI.2....d{:/;....F..x...u..<.>KJ.!...eq.<.{O...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\njEnUdtKgG.exe.log

Process:	C:\Users\user\AppData\Roaming\njEnUdtKgG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhg84qXKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3ogvitHo6hAHKzea
MD5:	E193AFF55D4BDD9951CB4287A7D79653
SHA1:	F94AD920B9E0EB43B5005D74552AB84EAA38E985
SHA-256:	08DD5825B4EDCC256AEB08525DCBCDA342252A9C9746BE23FBC70A801F5A596E
SHA-512:	86F6ECDB47C1A7FFA460F3BC6038ACAFC9D4DED4D1E8D1FB7B8FE9145D9D384AB4EE7A7C3BE959A25B265AFEDB8FD31BA10073EC116B65BFE3326EF2C53394E6
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tXcFA8apHU.exe.log

Process:	C:\Users\user\Desktop\tXcFA8apHU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhg84qXKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3ogvitHo6hAHKzea
MD5:	E193AFF55D4BDD9951CB4287A7D79653
SHA1:	F94AD920B9E0EB43B5005D74552AB84EAA38E985
SHA-256:	08DD5825B4EDCC256AEB08525DCBCDA342252A9C9746BE23FBC70A801F5A596E
SHA-512:	86F6ECDB47C1A7FFA460F3BC6038ACAFC9D4DED4D1E8D1FB7B8FE9145D9D384AB4EE7A7C3BE959A25B265AFEDB8FD31BA10073EC116B65BFE3326EF2C53394E6
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\json[1].json

Process:	C:\Users\user\Desktop\tXcFA8apHU.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	5.014904284428935
Encrypted:	false
SSDEEP:	12:tkluJnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkwV:qluNdRNuKyGX85jvXhNlT3/7AcV9Wro
MD5:	B66CFB6461E507BB577CDE91F270844E
SHA1:	6D952DE48032731679F8718D1F1C3F08202507C3
SHA-256:	E231BBC873E9B30CCA58297CAA3E8945A4FC61556F378F2C5013B0DDCB7035BE
SHA-512:	B5C1C188F10C9134EF38D0C5296E7AE95A7A486F858BE977F9A36D63CBE5790592881F3B8D12FEBBF1E555D0A9868632D9E590777E2D3143E74FD3A44C55575F
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.228",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.3810236212315665
Encrypted:	false
SSDEEP:	48:lylWSU4xympgv4RIoUP7gZ9tK8NPZHUx7u1iMugeoPUyus:lGLHxv2IfLZ2KRH6OugYs
MD5:	CF67394596448ACE4EF5F912410BAA2D
SHA1:	4EDB87B6EC25C392290AAE60DEE946AAC603DC68
SHA-256:	1B0BCE6991D6BF482FD79B73CD522D16C9837C7B3C54065B8177B305E3114253
SHA-512:	0B1A283BFD4D65C2B144A9BC74D555C4742F183ABE1340351EC4C8A504EE439C251C87BE01E3002A9A67892E60F42DACE7B4FFED8C4210A5FB82D5CBF5CB514B
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5s1qqder.zv2.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dbsqu42i.vio.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gcdvkeoo.ele.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hgovraet.xnn.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qddpywou.dnd.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_smrffnk4.th0.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ueitrzuw.dme.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vf3ue2j0.p2g.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp4537.tmp

Process:	C:\Users\user\Desktop\tXcFA8apHU.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1569
Entropy (8bit):	5.108999483360095
Encrypted:	false
SSDEEP:	48:cge7XQBBYrFdOFzOzN33ODOiDdKrsuTWv:He7XQBBYrFdOFzOz6dKrsuo
MD5:	D77A4DBFE38DC5761C9AC6F8478D237E
SHA1:	6B3D9A9CEF3FA0F2AFE3E02BCB3800A10FEFEA6E
SHA-256:	F517C94CBBE019596F5E7DF01C909EC186A3653A76660CFA063FF349AF5DCA18
SHA-512:	A5AC32E17DEB3ADE5BD7F94961944148F0601F1D70ECA40F622DBD4C9F6E5CD2CF370E1720E893E3022E6A882F294F3F00880187F8B105F92B3D3739FEFC71D3
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Local\Temp\tmp567D.tmp

Process:	C:\Users\user\AppData\Roaming\njEnUdtKgG.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1569
Entropy (8bit):	5.108999483360095
Encrypted:	false
SSDEEP:	48:cge7XQBBYrFdOFzOzN33ODOiDdKrsuTWv:He7XQBBYrFdOFzOz6dKrsuo
MD5:	D77A4DBFE38DC5761C9AC6F8478D237E
SHA1:	6B3D9A9CEF3FA0F2AFE3E02BCB3800A10FEFEA6E
SHA-256:	F517C94CBBE019596F5E7DF01C909EC186A3653A76660CFA063FF349AF5DCA18
SHA-512:	A5AC32E17DEB3ADE5BD7F94961944148F0601F1D70ECA40F622DBD4C9F6E5CD2CF370E1720E893E3022E6A882F294F3F00880187F8B105F92B3D3739FEFC71D3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Roaming\njEnUdtKgG.exe

Process:	C:\Users\user\Desktop\tXcFA8apHU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	7.908751468566825
Encrypted:	false
SSDEEP:	24576:QHIlObe6kDOI8hCMghsuN3OqyDzORPW3fa:FciJ2N4spU+i
MD5:	C9D033467BD4405DB131E2DB7DD8ABBF
SHA1:	31A47EBB0A372CE4DEA8F9AD0D7E547816FF7103
SHA-256:	7943AAB15DC5804448102C5C1FC5341B65708BFF970773E25F0F27D807E90D29
SHA-512:	08B643C8ED42B6F59D9879EFF287F9CF1F11696794C084DCC337F4D893CC759868457D8EF2FC095B73AA43DEEC5527D12DFFBBDCE528A71F758E8C0AF335FFC2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6g..............0.................. ... ....@.. .......................`............`.....................................O.... ..l....................@......h...T............................................ ............... ..H............text...$.... ...................... ..`.rsrc...l.... ......................@..@.reloc.......@......................@..B........................H........=..PC..........@...({...........................................0...........(.....(.....{...........%.r...p(....s.....%.r...p(....s.....%.r!..p(....s.......{....o.......(...+...rC..p......%...W....%.....(......(....}.....(.....{....o ...,..(.....(......0..H........{.....o!....{.....o!....{.....o!.....{....o"...(#...}.....(......}.....0..~........{....o$...o%.....+`s&.......X...('...o(....o)...rQ..po...&.o)...ra..po...&.o)...ra..po*...&.{....o$....o+...&..X...{.

C:\Users\user\AppData\Roaming\njEnUdtKgG.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\tXcFA8apHU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.908751468566825
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	tXcFA8apHU.exe
File size:	922'112 bytes
MD5:	c9d033467bd4405db131e2db7dd8abbf
SHA1:	31a47ebb0a372ce4dea8f9ad0d7e547816ff7103
SHA256:	7943aab15dc5804448102c5c1fc5341b65708bff970773e25f0f27d807e90d29
SHA512:	08b643c8ed42b6f59d9879eff287f9cf1f11696794c084dcc337f4d893cc759868457d8ef2fc095b73aa43deec5527d12dffbbdce528a71f758e8c0af335ffc2
SSDEEP:	24576:QHIlObe6kDOI8hCMghsuN3OqyDzORPW3fa:FciJ2N4spU+i
TLSH:	D8151291F935D863DAE887B49271D77E0A328E4CE900D25B8BFEDCE778477167904282
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6g..............0.................. ... ....@.. .......................`............`................................

File Icon


Icon Hash:	69723d9b2653b169

Static PE Info

General

Entrypoint:	0x4e141e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6736B595 [Fri Nov 15 02:44:37 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe13cc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe2000	0x176c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xdfc68	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xdf424	0xdf600	127d80c20cba801d437b4c696bf36c74	False	0.9526965584778959	data	7.913890207128523	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe2000	0x176c	0x1800	bc971f67ee06cf00907423ad7d3b873c	False	0.8448893229166666	data	7.181367202693059	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe4000	0xc	0x200	d47c04ed731e76733cfcd22f0c7d875a	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xe20c8	0x133a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9553027224705404
RT_GROUP_ICON	0xe3414	0x14	data	1.05
RT_VERSION	0xe3438	0x330	data	0.4424019607843137

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-05T17:54:15.573901+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49711	154.216.19.139	3124	TCP
2024-12-05T17:54:19.562581+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.10	49724	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 17:54:14.040163994 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:54:14.159956932 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:54:14.160217047 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:54:14.170614958 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:54:14.290572882 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:54:15.464282036 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:54:15.573900938 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:54:15.698194981 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:54:15.702816963 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:54:15.823479891 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:54:15.823571920 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:54:15.943429947 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:54:16.552875042 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:54:16.554054022 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:54:16.674585104 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:54:16.744885921 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:54:16.882503986 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:54:18.199254990 CET	49724	80	192.168.2.10	178.237.33.50
Dec 5, 2024 17:54:18.319062948 CET	80	49724	178.237.33.50	192.168.2.10
Dec 5, 2024 17:54:18.319289923 CET	49724	80	192.168.2.10	178.237.33.50
Dec 5, 2024 17:54:18.331248999 CET	49724	80	192.168.2.10	178.237.33.50
Dec 5, 2024 17:54:18.451421976 CET	80	49724	178.237.33.50	192.168.2.10
Dec 5, 2024 17:54:19.562427998 CET	80	49724	178.237.33.50	192.168.2.10
Dec 5, 2024 17:54:19.562581062 CET	49724	80	192.168.2.10	178.237.33.50
Dec 5, 2024 17:54:19.572278023 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:54:19.692107916 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:54:20.563124895 CET	80	49724	178.237.33.50	192.168.2.10
Dec 5, 2024 17:54:20.563261032 CET	49724	80	192.168.2.10	178.237.33.50
Dec 5, 2024 17:54:52.144567013 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:54:52.146322966 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:54:52.269588947 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:55:24.163340092 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:55:24.167207003 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:55:24.287734985 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:55:56.000452995 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:55:56.002105951 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:55:56.123356104 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:56:08.052247047 CET	49724	80	192.168.2.10	178.237.33.50
Dec 5, 2024 17:56:08.489311934 CET	49724	80	192.168.2.10	178.237.33.50
Dec 5, 2024 17:56:09.301821947 CET	49724	80	192.168.2.10	178.237.33.50
Dec 5, 2024 17:56:10.598973036 CET	49724	80	192.168.2.10	178.237.33.50
Dec 5, 2024 17:56:13.286283970 CET	49724	80	192.168.2.10	178.237.33.50
Dec 5, 2024 17:56:18.489350080 CET	49724	80	192.168.2.10	178.237.33.50
Dec 5, 2024 17:56:28.116638899 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:56:28.118010044 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:56:28.239887953 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:56:28.598702908 CET	49724	80	192.168.2.10	178.237.33.50
Dec 5, 2024 17:56:58.748135090 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:56:58.749360085 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:56:58.869213104 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:57:30.269046068 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:57:30.271034956 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:57:30.390883923 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:58:01.580861092 CET	3124	49711	154.216.19.139	192.168.2.10
Dec 5, 2024 17:58:01.582129002 CET	49711	3124	192.168.2.10	154.216.19.139
Dec 5, 2024 17:58:01.701980114 CET	3124	49711	154.216.19.139	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 17:54:12.869467020 CET	64951	53	192.168.2.10	1.1.1.1
Dec 5, 2024 17:54:13.868025064 CET	64951	53	192.168.2.10	1.1.1.1
Dec 5, 2024 17:54:14.035999060 CET	53	64951	1.1.1.1	192.168.2.10
Dec 5, 2024 17:54:14.036011934 CET	53	64951	1.1.1.1	192.168.2.10
Dec 5, 2024 17:54:18.054930925 CET	63360	53	192.168.2.10	1.1.1.1
Dec 5, 2024 17:54:18.195272923 CET	53	63360	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 5, 2024 17:54:12.869467020 CET	192.168.2.10	1.1.1.1	0x40f9	Standard query (0)	lack.work.gd	A (IP address)	IN (0x0001)	false
Dec 5, 2024 17:54:13.868025064 CET	192.168.2.10	1.1.1.1	0x40f9	Standard query (0)	lack.work.gd	A (IP address)	IN (0x0001)	false
Dec 5, 2024 17:54:18.054930925 CET	192.168.2.10	1.1.1.1	0x89ea	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 5, 2024 17:54:14.035999060 CET	1.1.1.1	192.168.2.10	0x40f9	No error (0)	lack.work.gd	154.216.19.139	A (IP address)	IN (0x0001)	false
Dec 5, 2024 17:54:14.036011934 CET	1.1.1.1	192.168.2.10	0x40f9	No error (0)	lack.work.gd	154.216.19.139	A (IP address)	IN (0x0001)	false
Dec 5, 2024 17:54:18.195272923 CET	1.1.1.1	192.168.2.10	0x89ea	No error (0)	geoplugin.net	178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49724	178.237.33.50	80	4620	C:\Users\user\Desktop\tXcFA8apHU.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 17:54:18.331248999 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Dec 5, 2024 17:54:19.562427998 CET	1171	IN	HTTP/1.1 200 OK date: Thu, 05 Dec 2024 16:54:19 GMT server: Apache content-length: 963 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.228", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	5
Start time:	11:54:08
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\tXcFA8apHU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\tXcFA8apHU.exe"
Imagebase:	0x670000
File size:	922'112 bytes
MD5 hash:	C9D033467BD4405DB131E2DB7DD8ABBF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.1325620534.00000000046A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000005.00000002.1325620534.00000000046A9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	11:54:10
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\tXcFA8apHU.exe"
Imagebase:	0xbb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	11:54:10
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	11:54:10
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\njEnUdtKgG.exe"
Imagebase:	0xbb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	11:54:10
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	11:54:10
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\njEnUdtKgG" /XML "C:\Users\user\AppData\Local\Temp\tmp4537.tmp"
Imagebase:	0x860000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	11:54:11
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	11:54:11
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\tXcFA8apHU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\tXcFA8apHU.exe"
Imagebase:	0x770000
File size:	922'112 bytes
MD5 hash:	C9D033467BD4405DB131E2DB7DD8ABBF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.3725647810.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	15
Start time:	11:54:13
Start date:	05/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6616b0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	11:54:13
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\njEnUdtKgG.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\njEnUdtKgG.exe
Imagebase:	0x200000
File size:	922'112 bytes
MD5 hash:	C9D033467BD4405DB131E2DB7DD8ABBF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000002.1374108041.00000000036E5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000010.00000002.1374108041.00000000036E5000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	18
Start time:	11:54:15
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\njEnUdtKgG" /XML "C:\Users\user\AppData\Local\Temp\tmp567D.tmp"
Imagebase:	0x860000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	19
Start time:	11:54:15
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	20
Start time:	11:54:16
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\njEnUdtKgG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\njEnUdtKgG.exe"
Imagebase:	0x580000
File size:	922'112 bytes
MD5 hash:	C9D033467BD4405DB131E2DB7DD8ABBF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000014.00000002.1351775759.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 00000014.00000002.1351040252.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true