Windows Analysis Report
Purchase Inquiry_002.exe

AI detected suspicious sample

Source: Yara match	File source: 14.2.xASiLfzXONGIW.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.43ad470.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.xASiLfzXONGIW.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.4337e50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.43ad470.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.4337e50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.1359604043.0000000001237000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3752310900.0000000001537000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1383390917.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1342558664.0000000004337000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1342558664.0000000003965000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Inquiry_002.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Purchase Inquiry_002.exe PID: 8184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xASiLfzXONGIW.exe PID: 1412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xASiLfzXONGIW.exe PID: 6124, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Purchase Inquiry_002.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_004315EC CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

14_2_004315EC

Source: Purchase Inquiry_002.exe, 00000000.00000002.1342558664.0000000003965000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_c06cbc74-2

Source: Purchase Inquiry_002.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Purchase Inquiry_002.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: zJGj.pdb source: Purchase Inquiry_002.exe, xASiLfzXONGIW.exe.0.dr
Source:	Binary string: zJGj.pdbSHA2567 source: Purchase Inquiry_002.exe, xASiLfzXONGIW.exe.0.dr

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0041A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	14_2_0041A01B
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0040B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	14_2_0040B28E
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0040838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	14_2_0040838E
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_004087A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	14_2_004087A0
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00407848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	14_2_00407848
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_004068CD FindFirstFileW,FindNextFileW,	14_2_004068CD
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0044BA59 FindFirstFileExA,	14_2_0044BA59
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0040AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	14_2_0040AA71
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00417AAB FindFirstFileW,FindNextFileW,FindNextFileW,	14_2_00417AAB
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0040AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	14_2_0040AC78

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_00406D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

14_2_00406D28

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Code function: 4x nop then jmp 06D95078h		0_2_06D94801
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 4x nop then jmp 074242E0h		10_2_07423A69

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.10:49749 -> 154.216.19.141:2531

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: cee.work.gd

Source: global traffic

TCP traffic: 192.168.2.10:49749 -> 154.216.19.141:2531

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: SKHT-ASShenzhenKatherineHengTechnologyInformationCo SKHT-ASShenzhenKatherineHengTechnologyInformationCo

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.10:49757 -> 178.237.33.50:80

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_0041936B InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

14_2_0041936B

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: cee.work.gd
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: Purchase Inquiry_002.exe, 00000009.00000002.3752456132.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Purchase Inquiry_002.exe, 00000009.00000002.3752310900.0000000001537000.00000004.00000020.00020000.00000000.sdmp, xASiLfzXONGIW.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: Purchase Inquiry_002.exe, 00000000.00000002.1342558664.0000000003965000.00000004.00000800.00020000.00000000.sdmp, Purchase Inquiry_002.exe, 00000000.00000002.1342558664.0000000004337000.00000004.00000800.00020000.00000000.sdmp, xASiLfzXONGIW.exe, 0000000A.00000002.1383390917.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, xASiLfzXONGIW.exe, 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: Purchase Inquiry_002.exe, 00000009.00000002.3752456132.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp7
Source: Purchase Inquiry_002.exe, 00000009.00000002.3752431492.0000000001564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: Purchase Inquiry_002.exe, 00000000.00000002.1341190098.00000000028A6000.00000004.00000800.00020000.00000000.sdmp, xASiLfzXONGIW.exe, 0000000A.00000002.1380724904.0000000002EA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Purchase Inquiry_002.exe, xASiLfzXONGIW.exe.0.dr	String found in binary or memory: http://tempuri.org/project_mgtDataSet.xsdOproject_mgt_system.Properties.Resources

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_00409340 SetWindowsHookExA 0000000D,0040932C,00000000

14_2_00409340

Installs a global keyboard hook

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Purchase Inquiry_002.exe

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_0040A65A OpenClipboard,GetClipboardData,CloseClipboard,

14_2_0040A65A

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_00414EC1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

14_2_00414EC1

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_0040A65A OpenClipboard,GetClipboardData,CloseClipboard,

14_2_0040A65A

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_00409468 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,

14_2_00409468

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 14.2.xASiLfzXONGIW.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.43ad470.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.xASiLfzXONGIW.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.4337e50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.43ad470.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.4337e50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.1359604043.0000000001237000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3752310900.0000000001537000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1383390917.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1342558664.0000000004337000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1342558664.0000000003965000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Inquiry_002.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Purchase Inquiry_002.exe PID: 8184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xASiLfzXONGIW.exe PID: 1412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xASiLfzXONGIW.exe PID: 6124, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_0041A76C SystemParametersInfoW,

14_2_0041A76C

System Summary

Malicious sample detected (through community Yara rule)

Source: 14.2.xASiLfzXONGIW.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 14.2.xASiLfzXONGIW.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.2.xASiLfzXONGIW.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.Purchase Inquiry_002.exe.43ad470.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.Purchase Inquiry_002.exe.43ad470.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.Purchase Inquiry_002.exe.43ad470.1.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 14.2.xASiLfzXONGIW.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 14.2.xASiLfzXONGIW.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.2.xASiLfzXONGIW.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.Purchase Inquiry_002.exe.4337e50.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.Purchase Inquiry_002.exe.4337e50.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.Purchase Inquiry_002.exe.4337e50.2.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.Purchase Inquiry_002.exe.43ad470.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.Purchase Inquiry_002.exe.43ad470.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.Purchase Inquiry_002.exe.4337e50.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.Purchase Inquiry_002.exe.4337e50.2.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0000000A.00000002.1383390917.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.1342558664.0000000004337000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.1342558664.0000000003965000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Purchase Inquiry_002.exe PID: 7180, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: xASiLfzXONGIW.exe PID: 1412, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: xASiLfzXONGIW.exe PID: 6124, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Purchase Inquiry_002.exe

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_00414DB4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

14_2_00414DB4

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Code function: 0_2_0281D57C	0_2_0281D57C
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Code function: 0_2_06D834B8	0_2_06D834B8
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Code function: 0_2_06D82106	0_2_06D82106
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Code function: 0_2_06D86678	0_2_06D86678
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Code function: 0_2_06D86669	0_2_06D86669
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Code function: 0_2_06D8B606	0_2_06D8B606
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Code function: 0_2_06D8F748	0_2_06D8F748
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Code function: 0_2_06D834A8	0_2_06D834A8
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Code function: 0_2_06D8F310	0_2_06D8F310
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Code function: 0_2_06D8FB80	0_2_06D8FB80
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Code function: 0_2_06D96300	0_2_06D96300
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Code function: 0_2_06D905D8	0_2_06D905D8
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 10_2_013ED57C	10_2_013ED57C
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 10_2_073534B8	10_2_073534B8
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 10_2_07352106	10_2_07352106
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 10_2_0735F748	10_2_0735F748
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 10_2_07356678	10_2_07356678
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 10_2_07356669	10_2_07356669
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 10_2_073534A8	10_2_073534A8
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 10_2_0735F310	10_2_0735F310
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 10_2_0735EED8	10_2_0735EED8
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 10_2_0735FB80	10_2_0735FB80
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 10_2_07425560	10_2_07425560
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 10_2_074205D8	10_2_074205D8
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00425152	14_2_00425152
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00435286	14_2_00435286
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_004513D4	14_2_004513D4
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0045050B	14_2_0045050B
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00436510	14_2_00436510
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_004316FB	14_2_004316FB
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0043569E	14_2_0043569E
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00443700	14_2_00443700
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_004257FB	14_2_004257FB
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_004128E3	14_2_004128E3
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00425964	14_2_00425964
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0041B917	14_2_0041B917
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0043D9CC	14_2_0043D9CC
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00435AD3	14_2_00435AD3
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00424BC3	14_2_00424BC3
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0043DBFB	14_2_0043DBFB
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0044ABA9	14_2_0044ABA9
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00433C0B	14_2_00433C0B
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00434D8A	14_2_00434D8A
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0043DE2A	14_2_0043DE2A
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0041CEAF	14_2_0041CEAF
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00435F08	14_2_00435F08

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: String function: 00402073 appears 51 times
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: String function: 00432B90 appears 53 times
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: String function: 00432525 appears 41 times

Source: Purchase Inquiry_002.exe, 00000000.00000002.1341190098.0000000002831000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Purchase Inquiry_002.exe
Source: Purchase Inquiry_002.exe, 00000000.00000002.1342558664.0000000003965000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Purchase Inquiry_002.exe
Source: Purchase Inquiry_002.exe, 00000000.00000002.1346439746.0000000006F30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Purchase Inquiry_002.exe
Source: Purchase Inquiry_002.exe, 00000000.00000002.1338186322.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Purchase Inquiry_002.exe
Source: Purchase Inquiry_002.exe, 00000000.00000000.1285877304.0000000000442000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamezJGj.exeP vs Purchase Inquiry_002.exe
Source: Purchase Inquiry_002.exe, 00000000.00000002.1345811797.0000000006C0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs Purchase Inquiry_002.exe
Source: Purchase Inquiry_002.exe, 00000000.00000002.1346068741.0000000006CB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Purchase Inquiry_002.exe
Source: Purchase Inquiry_002.exe	Binary or memory string: OriginalFilenamezJGj.exeP vs Purchase Inquiry_002.exe

Source: Purchase Inquiry_002.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 14.2.xASiLfzXONGIW.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 14.2.xASiLfzXONGIW.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.2.xASiLfzXONGIW.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.Purchase Inquiry_002.exe.43ad470.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.Purchase Inquiry_002.exe.43ad470.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.Purchase Inquiry_002.exe.43ad470.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 14.2.xASiLfzXONGIW.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 14.2.xASiLfzXONGIW.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.2.xASiLfzXONGIW.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.Purchase Inquiry_002.exe.4337e50.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.Purchase Inquiry_002.exe.4337e50.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.Purchase Inquiry_002.exe.4337e50.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.Purchase Inquiry_002.exe.43ad470.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.Purchase Inquiry_002.exe.43ad470.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.Purchase Inquiry_002.exe.4337e50.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.Purchase Inquiry_002.exe.4337e50.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0000000A.00000002.1383390917.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.1342558664.0000000004337000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.1342558664.0000000003965000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Purchase Inquiry_002.exe PID: 7180, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: xASiLfzXONGIW.exe PID: 1412, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: xASiLfzXONGIW.exe PID: 6124, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: Purchase Inquiry_002.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: xASiLfzXONGIW.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, oAHMyelsBlebo17c9D.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, oAHMyelsBlebo17c9D.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, oAHMyelsBlebo17c9D.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, T4r8SDCIv33WlslpT4.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, oAHMyelsBlebo17c9D.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, oAHMyelsBlebo17c9D.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, oAHMyelsBlebo17c9D.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, T4r8SDCIv33WlslpT4.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@19/17@12/2

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_00415C90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

14_2_00415C90

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_0040E2E7 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,

14_2_0040E2E7

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_00419493 FindResourceA,LoadResource,LockResource,SizeofResource,

14_2_00419493

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_00418A00 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

14_2_00418A00

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe

File created: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6024:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5896:120:WilError_03
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Mutant created: \Sessions\1\BaseNamedObjects\gig-1IH5DX
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8124:120:WilError_03
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Mutant created: \Sessions\1\BaseNamedObjects\PByueLbLyolhtCqZ
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7932:120:WilError_03

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe

File created: C:\Users\user\AppData\Local\Temp\tmp3EA3.tmp

Source: Purchase Inquiry_002.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Purchase Inquiry_002.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Purchase Inquiry_002.exe

ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe

File read: C:\Users\user\Desktop\Purchase Inquiry_002.exe

Source: unknown	Process created: C:\Users\user\Desktop\Purchase Inquiry_002.exe "C:\Users\user\Desktop\Purchase Inquiry_002.exe"
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Purchase Inquiry_002.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xASiLfzXONGIW" /XML "C:\Users\user\AppData\Local\Temp\tmp3EA3.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Users\user\Desktop\Purchase Inquiry_002.exe "C:\Users\user\Desktop\Purchase Inquiry_002.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xASiLfzXONGIW" /XML "C:\Users\user\AppData\Local\Temp\tmp4FBA.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process created: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe "C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe"
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Purchase Inquiry_002.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xASiLfzXONGIW" /XML "C:\Users\user\AppData\Local\Temp\tmp3EA3.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Users\user\Desktop\Purchase Inquiry_002.exe "C:\Users\user\Desktop\Purchase Inquiry_002.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xASiLfzXONGIW" /XML "C:\Users\user\AppData\Local\Temp\tmp4FBA.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process created: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe "C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Source: Purchase Inquiry_002.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Purchase Inquiry_002.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Purchase Inquiry_002.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: zJGj.pdb source: Purchase Inquiry_002.exe, xASiLfzXONGIW.exe.0.dr
Source:	Binary string: zJGj.pdbSHA2567 source: Purchase Inquiry_002.exe, xASiLfzXONGIW.exe.0.dr

Data Obfuscation

Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, oAHMyelsBlebo17c9D.cs	.Net Code: WPcMBjNRrc System.Reflection.Assembly.Load(byte[])
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, oAHMyelsBlebo17c9D.cs	.Net Code: WPcMBjNRrc System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_0041A8DA LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

14_2_0041A8DA

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Code function: 9_2_0314F448 push ebp; retf	9_2_0314F44A
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_004000D8 push es; iretd	14_2_004000D9
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0040008C push es; iretd	14_2_0040008D
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_004542E6 push ecx; ret	14_2_004542F9
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0045B4FD push esi; ret	14_2_0045B506
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00432BD6 push ecx; ret	14_2_00432BE9
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00454C08 push eax; ret	14_2_00454C26

Source: Purchase Inquiry_002.exe	Static PE information: section name: .text entropy: 7.966548982352114
Source: xASiLfzXONGIW.exe.0.dr	Static PE information: section name: .text entropy: 7.966548982352114

Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, KrxB0FGnmZKpkyNbXX.cs	High entropy of concatenated method names: 'vsPBtrBGW', 'xJtEdwoJR', 'yQdgnS2yA', 'ocp8OY3DT', 'rW1sYqSkA', 'PaM3cQKJf', 'Opme0mhLgXvl11dZ7F', 'MwMQuhZrXX7jyjJlPl', 'vARVc4f2M', 'Gw2Xv2ygC'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, D7aMauhAVxQYrmcyD0.cs	High entropy of concatenated method names: 's69fwNT3AD', 'bSXfW9UBry', 'pIWf0ijh5e', 'j4nfebD7F0', 'StuflnRFxY', 'mt60RljglO', 'D1g0ZNwMer', 'x3O0octTUv', 'xwv0mrWREF', 'OAL0Fqyxtl'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, q06fRr1ZQvBKjZ65oK.cs	High entropy of concatenated method names: 'J4sKQOIl62', 'aIeKIaKQOL', 'uc7K15vjlK', 'xUMKyqj2kD', 'O05KxJb5dy', 'uc1K6lWY3W', 'QW4KcGboxg', 'eYYK5ThnUg', 'OOjK9USPsd', 'STOKNx9OyD'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, T4r8SDCIv33WlslpT4.cs	High entropy of concatenated method names: 'ocVW1dFaPc', 'higWytRZIi', 'TQrWnSbhIC', 'KAaWpn9ZLG', 'LZLWRwRLhO', 'ly1WZoLlW6', 'm2iWoEmdPg', 'FmfWmF5a3k', 'bWTWFgfjtl', 'zEJWrgWUTp'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, voy5oLt5lQB891TIpt.cs	High entropy of concatenated method names: 'IkoYChHilV', 'B1TYsyrRk8', 'cSSYhQMx3d', 'kFPYxWGWFR', 'XrNYc8ROXt', 'ooVY51ADgL', 'uctYNYeS1Y', 'ss3YuBSGW1', 'E3aYQHDcL4', 'Of8YDvaFYv'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, cLlsgYs5GgOZjJJuSB.cs	High entropy of concatenated method names: 'SEcHEprBIm', 'vFuHgg3ZFW', 'AQUHCCOb7N', 'rvmHsSBsbE', 'xJIHKRmRUQ', 'STqHiaY15y', 'WvTHqQQZH3', 'WKaHVgiVI5', 'N9fH2WfIOd', 'lgiHXj4EgS'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, sq4j7xSMZiKRMXLZIsG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OiMv29tXaO', 'P7WvXH6ruU', 'ydUvAfKjOa', 'KJsvvyx2gl', 'SNbvaSSmCM', 'CV9vkOfGbW', 'z8EvOwJ96J'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, geC6IOzmlqxGb0bPnU.cs	High entropy of concatenated method names: 'joFXgtVM1f', 'YgsXCCup30', 'xkaXskxKOK', 'frAXhKG9vx', 'h0vXxMOg0Z', 'vy1XcdSIeE', 'm6xX5pgE9X', 'xfmXOHHfUv', 'uvrX7V0cHE', 'ts5Xd6QyZ5'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, maZXEQ3nDp1ljW9RCv.cs	High entropy of concatenated method names: 'WZ904CbVya', 'zx508hIuOS', 'y91H66xFOJ', 'tZYHcW6TEy', 'WiwH5ueiVQ', 'jhWH9TY2TZ', 'pXdHN4Hplk', 'YM9HueLwsO', 'bIDHL46n8u', 'wIsHQ2lVh0'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, JWCbu2STQmAFYrqZv8L.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Sv5XD5E603', 'gY0XIB7kQ7', 'A0wXt0vc4s', 'M7lX1DcW04', 'xUFXyo1PxI', 'UHaXnS9iE2', 'GCeXp7M7Wg'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, QYTZ0oovg5cvcw2BTs.cs	High entropy of concatenated method names: 'UXs2KM2jco', 'EVL2q4o6Xq', 'Fmf22FGS89', 'k4f2ADpjHr', 'lIq2aoAJIx', 'unY2OtWk80', 'Dispose', 'Ur5VjauifP', 'Ae4VWBla1T', 'li3VHmFfck'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, hQHmh5SGuePN8j0Gbyu.cs	High entropy of concatenated method names: 'ToString', 'dqmACmHWL1', 'prsAsS4YGI', 'f8oA3bQ3ZA', 'T52AhW6PjM', 'E39Ax2qPDY', 'xClA64cxKb', 'ag0AcTfi5B', 'WQmwu7WfS8tc51jNQEo', 'aGivGAWO8QlJWtVySWZ'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, mRNTsXSSyB5C1XtedV6.cs	High entropy of concatenated method names: 'enFXrmbGgD', 'Ny9XzvgyX1', 'WhUATuBBSu', 'k8RASglAh7', 'UJtAG5soYc', 'grLAbAWoMg', 'J4rAMDXoOm', 'fFYAwHlsH0', 'MoCAjuB0SC', 'dTYAWGtM3u'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, rmh2ZarBytsKoPdbuC.cs	High entropy of concatenated method names: 'H4AXH8g7yW', 'q3BX06cgV5', 'qytXfo7ZQB', 'sC2Xerb7Da', 'VboX2Da0on', 'KZnXlBDAtv', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, EvUA2UpoCgZNBBO9DW.cs	High entropy of concatenated method names: 'IVOqJ6Q61y', 'B7DqPmqbbs', 'ToString', 'wqnqjnY9Y9', 'orUqWXk7tC', 'EmlqH1WaAC', 'hBAq0XVXJa', 'Osfqfmb9sD', 'FcAqeKLg3E', 'qeoqlI5lsr'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, Dp9d0sMygJjXH0e0n6.cs	High entropy of concatenated method names: 'hDpSe4r8SD', 'Pv3Sl3Wlsl', 'o5GSJgOZjJ', 'muSSPBJaZX', 'f9RSKCvC7a', 'eauSiAVxQY', 'jTjQo4khR4aPaqNxXF', 'SEUZZlLZ9C9jUkAfmZ', 'uJOSSbksl8', 'rEaSbn3PIn'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, LmWRlEFadn72bQ25uI.cs	High entropy of concatenated method names: 'Tdb2hPs62w', 'swZ2xMwDbm', 'k1d26eqDgf', 'uFB2cb9w8C', 'CF6253dokS', 'zjN29i6ANb', 'CKV2NNJDym', 'xQW2uT0RWL', 'wX92Lw09t6', 'JaB2QvOvNn'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, MxJBTdnmkSbNwtYdT9.cs	High entropy of concatenated method names: 'ToString', 'R8YiD9L5L1', 'vJKixlI7iH', 'a4ni6JGgPG', 'WUDick8F3Y', 'SMRi5xM1N9', 'ELQi90a2j8', 'BXiiNuqFrB', 'LP2iu7y4vQ', 'mXCiLLGB78'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, oAHMyelsBlebo17c9D.cs	High entropy of concatenated method names: 'lG7bwMD3C1', 'CBjbjCENcR', 'OgBbWWLvRc', 'JMhbHn7Q6D', 'Cibb0ddesT', 'XObbfxrFSN', 'aibbenTsjF', 'pGgbljXhUJ', 'UVnbUhQ7rh', 'BZ4bJsjh1V'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, XVx5eEZqSV66eFTjYZ.cs	High entropy of concatenated method names: 'dhfqmjHUXb', 'UNgqrGWUkb', 'dfOVTWFHZI', 'BxlVSIuUPi', 'm8hqDkdfD2', 'W6mqIJTbJR', 'QxJqtGHmoA', 'P1Mq1OEmyJ', 'hEjqyGRcQE', 'rdEqnx644D'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, ixlCuvLaod7FlsCjho.cs	High entropy of concatenated method names: 'wG5e7JH6YK', 'oFyedO6XTj', 'hJreBv3P4J', 'wo6eEtWxpb', 'FVQe4eiIEU', 'cB7eg7agAt', 'Nyje8GorUV', 'sBEeCDBxcu', 'khCesgKNBS', 'qqVe3N3WFH'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, wpPir09WJs64xtIvcH.cs	High entropy of concatenated method names: 'J79fn8yfCF', 'MBWfpg66IG', 'zg9fRBuC7C', 'ToString', 'UllfZSFqnM', 'Fm2foih9eb', 'mNjqkGfglAvcstgrpZ2', 'rZAPqkf2oN9Ptr3R5Wb', 'fhGkd5flOqa7ltNg38x', 'aEE456fbE3XC8MZsNcx'
Source: 0.2.Purchase Inquiry_002.exe.39b85e0.3.raw.unpack, GsiYJWW6oOdgKdhTNl.cs	High entropy of concatenated method names: 'Dispose', 'JcvSFcw2BT', 'AYpGx6xmDc', 'r3WdwykwiV', 'EhQSr92JaW', 'OTYSzPsVw3', 'ProcessDialogKey', 'FfNGTmWRlE', 'vdnGS72bQ2', 'JuIGG2mh2Z'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, KrxB0FGnmZKpkyNbXX.cs	High entropy of concatenated method names: 'vsPBtrBGW', 'xJtEdwoJR', 'yQdgnS2yA', 'ocp8OY3DT', 'rW1sYqSkA', 'PaM3cQKJf', 'Opme0mhLgXvl11dZ7F', 'MwMQuhZrXX7jyjJlPl', 'vARVc4f2M', 'Gw2Xv2ygC'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, D7aMauhAVxQYrmcyD0.cs	High entropy of concatenated method names: 's69fwNT3AD', 'bSXfW9UBry', 'pIWf0ijh5e', 'j4nfebD7F0', 'StuflnRFxY', 'mt60RljglO', 'D1g0ZNwMer', 'x3O0octTUv', 'xwv0mrWREF', 'OAL0Fqyxtl'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, q06fRr1ZQvBKjZ65oK.cs	High entropy of concatenated method names: 'J4sKQOIl62', 'aIeKIaKQOL', 'uc7K15vjlK', 'xUMKyqj2kD', 'O05KxJb5dy', 'uc1K6lWY3W', 'QW4KcGboxg', 'eYYK5ThnUg', 'OOjK9USPsd', 'STOKNx9OyD'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, T4r8SDCIv33WlslpT4.cs	High entropy of concatenated method names: 'ocVW1dFaPc', 'higWytRZIi', 'TQrWnSbhIC', 'KAaWpn9ZLG', 'LZLWRwRLhO', 'ly1WZoLlW6', 'm2iWoEmdPg', 'FmfWmF5a3k', 'bWTWFgfjtl', 'zEJWrgWUTp'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, voy5oLt5lQB891TIpt.cs	High entropy of concatenated method names: 'IkoYChHilV', 'B1TYsyrRk8', 'cSSYhQMx3d', 'kFPYxWGWFR', 'XrNYc8ROXt', 'ooVY51ADgL', 'uctYNYeS1Y', 'ss3YuBSGW1', 'E3aYQHDcL4', 'Of8YDvaFYv'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, cLlsgYs5GgOZjJJuSB.cs	High entropy of concatenated method names: 'SEcHEprBIm', 'vFuHgg3ZFW', 'AQUHCCOb7N', 'rvmHsSBsbE', 'xJIHKRmRUQ', 'STqHiaY15y', 'WvTHqQQZH3', 'WKaHVgiVI5', 'N9fH2WfIOd', 'lgiHXj4EgS'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, sq4j7xSMZiKRMXLZIsG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OiMv29tXaO', 'P7WvXH6ruU', 'ydUvAfKjOa', 'KJsvvyx2gl', 'SNbvaSSmCM', 'CV9vkOfGbW', 'z8EvOwJ96J'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, geC6IOzmlqxGb0bPnU.cs	High entropy of concatenated method names: 'joFXgtVM1f', 'YgsXCCup30', 'xkaXskxKOK', 'frAXhKG9vx', 'h0vXxMOg0Z', 'vy1XcdSIeE', 'm6xX5pgE9X', 'xfmXOHHfUv', 'uvrX7V0cHE', 'ts5Xd6QyZ5'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, maZXEQ3nDp1ljW9RCv.cs	High entropy of concatenated method names: 'WZ904CbVya', 'zx508hIuOS', 'y91H66xFOJ', 'tZYHcW6TEy', 'WiwH5ueiVQ', 'jhWH9TY2TZ', 'pXdHN4Hplk', 'YM9HueLwsO', 'bIDHL46n8u', 'wIsHQ2lVh0'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, JWCbu2STQmAFYrqZv8L.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Sv5XD5E603', 'gY0XIB7kQ7', 'A0wXt0vc4s', 'M7lX1DcW04', 'xUFXyo1PxI', 'UHaXnS9iE2', 'GCeXp7M7Wg'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, QYTZ0oovg5cvcw2BTs.cs	High entropy of concatenated method names: 'UXs2KM2jco', 'EVL2q4o6Xq', 'Fmf22FGS89', 'k4f2ADpjHr', 'lIq2aoAJIx', 'unY2OtWk80', 'Dispose', 'Ur5VjauifP', 'Ae4VWBla1T', 'li3VHmFfck'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, hQHmh5SGuePN8j0Gbyu.cs	High entropy of concatenated method names: 'ToString', 'dqmACmHWL1', 'prsAsS4YGI', 'f8oA3bQ3ZA', 'T52AhW6PjM', 'E39Ax2qPDY', 'xClA64cxKb', 'ag0AcTfi5B', 'WQmwu7WfS8tc51jNQEo', 'aGivGAWO8QlJWtVySWZ'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, mRNTsXSSyB5C1XtedV6.cs	High entropy of concatenated method names: 'enFXrmbGgD', 'Ny9XzvgyX1', 'WhUATuBBSu', 'k8RASglAh7', 'UJtAG5soYc', 'grLAbAWoMg', 'J4rAMDXoOm', 'fFYAwHlsH0', 'MoCAjuB0SC', 'dTYAWGtM3u'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, rmh2ZarBytsKoPdbuC.cs	High entropy of concatenated method names: 'H4AXH8g7yW', 'q3BX06cgV5', 'qytXfo7ZQB', 'sC2Xerb7Da', 'VboX2Da0on', 'KZnXlBDAtv', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, EvUA2UpoCgZNBBO9DW.cs	High entropy of concatenated method names: 'IVOqJ6Q61y', 'B7DqPmqbbs', 'ToString', 'wqnqjnY9Y9', 'orUqWXk7tC', 'EmlqH1WaAC', 'hBAq0XVXJa', 'Osfqfmb9sD', 'FcAqeKLg3E', 'qeoqlI5lsr'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, Dp9d0sMygJjXH0e0n6.cs	High entropy of concatenated method names: 'hDpSe4r8SD', 'Pv3Sl3Wlsl', 'o5GSJgOZjJ', 'muSSPBJaZX', 'f9RSKCvC7a', 'eauSiAVxQY', 'jTjQo4khR4aPaqNxXF', 'SEUZZlLZ9C9jUkAfmZ', 'uJOSSbksl8', 'rEaSbn3PIn'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, LmWRlEFadn72bQ25uI.cs	High entropy of concatenated method names: 'Tdb2hPs62w', 'swZ2xMwDbm', 'k1d26eqDgf', 'uFB2cb9w8C', 'CF6253dokS', 'zjN29i6ANb', 'CKV2NNJDym', 'xQW2uT0RWL', 'wX92Lw09t6', 'JaB2QvOvNn'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, MxJBTdnmkSbNwtYdT9.cs	High entropy of concatenated method names: 'ToString', 'R8YiD9L5L1', 'vJKixlI7iH', 'a4ni6JGgPG', 'WUDick8F3Y', 'SMRi5xM1N9', 'ELQi90a2j8', 'BXiiNuqFrB', 'LP2iu7y4vQ', 'mXCiLLGB78'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, oAHMyelsBlebo17c9D.cs	High entropy of concatenated method names: 'lG7bwMD3C1', 'CBjbjCENcR', 'OgBbWWLvRc', 'JMhbHn7Q6D', 'Cibb0ddesT', 'XObbfxrFSN', 'aibbenTsjF', 'pGgbljXhUJ', 'UVnbUhQ7rh', 'BZ4bJsjh1V'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, XVx5eEZqSV66eFTjYZ.cs	High entropy of concatenated method names: 'dhfqmjHUXb', 'UNgqrGWUkb', 'dfOVTWFHZI', 'BxlVSIuUPi', 'm8hqDkdfD2', 'W6mqIJTbJR', 'QxJqtGHmoA', 'P1Mq1OEmyJ', 'hEjqyGRcQE', 'rdEqnx644D'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, ixlCuvLaod7FlsCjho.cs	High entropy of concatenated method names: 'wG5e7JH6YK', 'oFyedO6XTj', 'hJreBv3P4J', 'wo6eEtWxpb', 'FVQe4eiIEU', 'cB7eg7agAt', 'Nyje8GorUV', 'sBEeCDBxcu', 'khCesgKNBS', 'qqVe3N3WFH'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, wpPir09WJs64xtIvcH.cs	High entropy of concatenated method names: 'J79fn8yfCF', 'MBWfpg66IG', 'zg9fRBuC7C', 'ToString', 'UllfZSFqnM', 'Fm2foih9eb', 'mNjqkGfglAvcstgrpZ2', 'rZAPqkf2oN9Ptr3R5Wb', 'fhGkd5flOqa7ltNg38x', 'aEE456fbE3XC8MZsNcx'
Source: 0.2.Purchase Inquiry_002.exe.6f30000.5.raw.unpack, GsiYJWW6oOdgKdhTNl.cs	High entropy of concatenated method names: 'Dispose', 'JcvSFcw2BT', 'AYpGx6xmDc', 'r3WdwykwiV', 'EhQSr92JaW', 'OTYSzPsVw3', 'ProcessDialogKey', 'FfNGTmWRlE', 'vdnGS72bQ2', 'JuIGG2mh2Z'

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_004063C6 ShellExecuteW,URLDownloadToFileW,

14_2_004063C6

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe

File created: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xASiLfzXONGIW" /XML "C:\Users\user\AppData\Local\Temp\tmp3EA3.tmp"

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_00418A00 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

14_2_00418A00

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

14_2_0041A8DA

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Purchase Inquiry_002.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xASiLfzXONGIW.exe PID: 1412, type: MEMORYSTR

Delayed program exit found

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_0040E18D Sleep,ExitProcess,

14_2_0040E18D

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Memory allocated: 27A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Memory allocated: 2830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Memory allocated: 4830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Memory allocated: 8B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Memory allocated: 9B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Memory allocated: 9D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Memory allocated: AD90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Memory allocated: 13E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Memory allocated: 2E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Memory allocated: 1460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Memory allocated: 8AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Memory allocated: 9AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Memory allocated: 9CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Memory allocated: ACC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

14_2_004186FE

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6373	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7235	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Window / User API: threadDelayed 398	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Window / User API: threadDelayed 9104	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Window / User API: foregroundWindowGot 1771	Jump to behavior

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

API coverage: 5.0 %

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe TID: 7248	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7644	Thread sleep count: 6373 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 920	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1672	Thread sleep count: 173 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5948	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8008	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1516	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe TID: 7612	Thread sleep count: 222 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe TID: 7612	Thread sleep time: -111000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe TID: 3276	Thread sleep count: 398 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe TID: 3276	Thread sleep time: -1194000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe TID: 3276	Thread sleep count: 9104 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe TID: 3276	Thread sleep time: -27312000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe TID: 8060	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0041A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	14_2_0041A01B
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0040B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	14_2_0040B28E
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0040838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	14_2_0040838E
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_004087A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	14_2_004087A0
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00407848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	14_2_00407848
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_004068CD FindFirstFileW,FindNextFileW,	14_2_004068CD
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0044BA59 FindFirstFileExA,	14_2_0044BA59
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0040AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	14_2_0040AA71
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00417AAB FindFirstFileW,FindNextFileW,FindNextFileW,	14_2_00417AAB
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_0040AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	14_2_0040AC78

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_00406D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

14_2_00406D28

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Purchase Inquiry_002.exe, 00000009.00000002.3752310900.0000000001537000.00000004.00000020.00020000.00000000.sdmp, Purchase Inquiry_002.exe, 00000009.00000002.3752688490.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, Purchase Inquiry_002.exe, 00000009.00000002.3752688490.00000000015B0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_004327AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

14_2_004327AE

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

14_2_0041A8DA

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_004407B5 mov eax, dword ptr fs:[00000030h]

14_2_004407B5

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_00410763 SetLastError,GetNativeSystemInfo,SetLastError,GetProcessHeap,HeapAlloc,SetLastError,

14_2_00410763

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_004327AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_004327AE
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_004328FC SetUnhandledExceptionFilter,	14_2_004328FC
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_004398AC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_004398AC
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: 14_2_00432D5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_00432D5C

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Purchase Inquiry_002.exe"
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe"
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Purchase Inquiry_002.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Memory written: C:\Users\user\Desktop\Purchase Inquiry_002.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Memory written: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

14_2_00410B5C

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_004175E1 mouse_event,

14_2_004175E1

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Purchase Inquiry_002.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xASiLfzXONGIW" /XML "C:\Users\user\AppData\Local\Temp\tmp3EA3.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Process created: C:\Users\user\Desktop\Purchase Inquiry_002.exe "C:\Users\user\Desktop\Purchase Inquiry_002.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xASiLfzXONGIW" /XML "C:\Users\user\AppData\Local\Temp\tmp4FBA.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Process created: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe "C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe"	Jump to behavior

Source: Purchase Inquiry_002.exe, 00000009.00000002.3752456132.0000000001578000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerh
Source: Purchase Inquiry_002.exe, 00000009.00000002.3752456132.0000000001578000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Purchase Inquiry_002.exe, 00000009.00000002.3752310900.0000000001537000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerckets
Source: Purchase Inquiry_002.exe, 00000009.00000002.3752310900.0000000001537000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerDX\53
Source: Purchase Inquiry_002.exe, 00000009.00000002.3752310900.0000000001537000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerDX\
Source: Purchase Inquiry_002.exe, 00000009.00000002.3752431492.0000000001564000.00000004.00000020.00020000.00000000.sdmp, Purchase Inquiry_002.exe, 00000009.00000002.3752456132.0000000001578000.00000004.00000020.00020000.00000000.sdmp, Purchase Inquiry_002.exe, 00000009.00000002.3752688490.000000000159C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: Purchase Inquiry_002.exe, 00000009.00000002.3752310900.0000000001537000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerDX\5
Source: Purchase Inquiry_002.exe, 00000009.00000002.3752456132.0000000001596000.00000004.00000020.00020000.00000000.sdmp, Purchase Inquiry_002.exe, 00000009.00000002.3752310900.0000000001537000.00000004.00000020.00020000.00000000.sdmp, Purchase Inquiry_002.exe, 00000009.00000002.3752688490.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Program Manager]

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_004329DA cpuid

14_2_004329DA

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: EnumSystemLocalesW,	14_2_0044F17B
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: EnumSystemLocalesW,	14_2_0044F130
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: EnumSystemLocalesW,	14_2_0044F216
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_0044F2A3
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: GetLocaleInfoA,	14_2_0040E2BB
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: GetLocaleInfoW,	14_2_0044F4F3
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_0044F61C
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: GetLocaleInfoW,	14_2_0044F723
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_0044F7F0
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: EnumSystemLocalesW,	14_2_00445914
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: GetLocaleInfoW,	14_2_00445E1C
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	14_2_0044EEB8

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Queries volume information: C:\Users\user\Desktop\Purchase Inquiry_002.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Queries volume information: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_0040A0B0 GetLocalTime,wsprintfW,

14_2_0040A0B0

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_004195F8 GetUserNameW,

14_2_004195F8

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: 14_2_004466BF _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

14_2_004466BF

Source: C:\Users\user\Desktop\Purchase Inquiry_002.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 14.2.xASiLfzXONGIW.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.43ad470.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.xASiLfzXONGIW.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.4337e50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.43ad470.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.4337e50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.1359604043.0000000001237000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3752310900.0000000001537000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1383390917.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1342558664.0000000004337000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1342558664.0000000003965000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Inquiry_002.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Purchase Inquiry_002.exe PID: 8184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xASiLfzXONGIW.exe PID: 1412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xASiLfzXONGIW.exe PID: 6124, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

14_2_0040A953

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		14_2_0040AA71
Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	Code function: \key3.db		14_2_0040AA71

Remote Access Functionality

Source: Yara match	File source: 14.2.xASiLfzXONGIW.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.43ad470.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.xASiLfzXONGIW.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.4337e50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.43ad470.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_002.exe.4337e50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.1359604043.0000000001237000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3752310900.0000000001537000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1383390917.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1342558664.0000000004337000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1342558664.0000000003965000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Inquiry_002.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Purchase Inquiry_002.exe PID: 8184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xASiLfzXONGIW.exe PID: 1412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xASiLfzXONGIW.exe PID: 6124, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Code function: cmd.exe

14_2_0040567A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Windows Service	4 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	122 Process Injection	12 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	33 System Information Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	122 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Purchase Inquiry_002.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
Purchase Inquiry_002.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Source	Detection	Scanner	Label	Link
cee.work.gd	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false		high
cee.work.gd	154.216.19.141	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false		high
cee.work.gd	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://geoplugin.net/json.gp7	Purchase Inquiry_002.exe, 00000009.00000002.3752456132.0000000001578000.00000004.00000020.00020000.00000000.sdmp	false	high
http://geoplugin.net/json.gp/C	Purchase Inquiry_002.exe, 00000000.00000002.1342558664.0000000003965000.00000004.00000800.00020000.00000000.sdmp, Purchase Inquiry_002.exe, 00000000.00000002.1342558664.0000000004337000.00000004.00000800.00020000.00000000.sdmp, xASiLfzXONGIW.exe, 0000000A.00000002.1383390917.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, xASiLfzXONGIW.exe, 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Purchase Inquiry_002.exe, 00000000.00000002.1341190098.00000000028A6000.00000004.00000800.00020000.00000000.sdmp, xASiLfzXONGIW.exe, 0000000A.00000002.1380724904.0000000002EA6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/project_mgtDataSet.xsdOproject_mgt_system.Properties.Resources	Purchase Inquiry_002.exe, xASiLfzXONGIW.exe.0.dr	false	high
http://geoplugin.net/json.gpSystem32	Purchase Inquiry_002.exe, 00000009.00000002.3752431492.0000000001564000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.216.19.141	cee.work.gd	Seychelles		135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	true
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560114
Start date and time:	2024-11-21 12:20:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Purchase Inquiry_002.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@19/17@12/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 96% Number of executed functions: 212 Number of non-executed functions: 192
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Purchase Inquiry_002.exe, PID 8184 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Purchase Inquiry_002.exe

Simulations

Behavior and APIs

Time	Type	Description
06:21:44	API Interceptor	6220044x Sleep call for process: Purchase Inquiry_002.exe modified
06:21:47	API Interceptor	35x Sleep call for process: powershell.exe modified
06:21:49	API Interceptor	3x Sleep call for process: xASiLfzXONGIW.exe modified
12:21:47	Task Scheduler	Run new task: xASiLfzXONGIW path: C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
154.216.19.141	1732086011ea45d03916726c55fa40ae0b8f39b9a24a40da5a5e79d29c703a7fb444bdeb31407.dat-decoded.exe	Get hash	malicious	Remcos	Browse
178.237.33.50	APPENDIX FORM_N#U00b045013-20241120.com.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	geoplugin.net/json.gp
	ORDER AND SPECIFICATIONS.scr.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1732147507ac10953a908ae794c5ee180add9124a78c69705135688e502bb56ce4453da749198.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1732143786cec792bea7f8ce7f818c031173ce52fabd19dde842f74b07fc234dc9f3fa1dcf839.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	seethebestthignswhichgivingbestopportunities.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	geoplugin.net/json.gp
	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	geoplugin.net/json.gp
	sostener.vbs	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1732086011ea45d03916726c55fa40ae0b8f39b9a24a40da5a5e79d29c703a7fb444bdeb31407.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	USD470900_COPY_800BLHSBC882001_NOV202024.PDF.exe	Get hash	malicious	Remcos, DBatLoader	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cee.work.gd	1732086011ea45d03916726c55fa40ae0b8f39b9a24a40da5a5e79d29c703a7fb444bdeb31407.dat-decoded.exe	Get hash	malicious	Remcos	Browse	154.216.19.141
geoplugin.net	APPENDIX FORM_N#U00b045013-20241120.com.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	178.237.33.50
	ORDER AND SPECIFICATIONS.scr.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1732147507ac10953a908ae794c5ee180add9124a78c69705135688e502bb56ce4453da749198.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1732143786cec792bea7f8ce7f818c031173ce52fabd19dde842f74b07fc234dc9f3fa1dcf839.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	seethebestthignswhichgivingbestopportunities.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	178.237.33.50
	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	178.237.33.50
	sostener.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	1732086011ea45d03916726c55fa40ae0b8f39b9a24a40da5a5e79d29c703a7fb444bdeb31407.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	USD470900_COPY_800BLHSBC882001_NOV202024.PDF.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	dlr.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.18.25
	dlr.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.18.25
	dlr.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.18.25
	ORDER AND SPECIFICATIONS.scr.exe	Get hash	malicious	Remcos	Browse	154.216.16.54
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	154.216.19.129
	file.exe	Get hash	malicious	Unknown	Browse	154.216.19.129
	file.exe	Get hash	malicious	Unknown	Browse	154.216.19.129
	1732086011ea45d03916726c55fa40ae0b8f39b9a24a40da5a5e79d29c703a7fb444bdeb31407.dat-decoded.exe	Get hash	malicious	Remcos	Browse	154.216.19.141
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	http://www.dvdcollections.co.uk/search/redirect.php?deeplink=https://lp-engenharia.com/zerooo/?email=mwright@burbankca.gov	Get hash	malicious	HTMLPhisher	Browse	154.216.17.193
ATOM86-ASATOM86NL	APPENDIX FORM_N#U00b045013-20241120.com.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	178.237.33.50
	ORDER AND SPECIFICATIONS.scr.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1732147507ac10953a908ae794c5ee180add9124a78c69705135688e502bb56ce4453da749198.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1732143786cec792bea7f8ce7f818c031173ce52fabd19dde842f74b07fc234dc9f3fa1dcf839.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	seethebestthignswhichgivingbestopportunities.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	178.237.33.50
	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	178.237.33.50
	sostener.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	1732086011ea45d03916726c55fa40ae0b8f39b9a24a40da5a5e79d29c703a7fb444bdeb31407.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	USD470900_COPY_800BLHSBC882001_NOV202024.PDF.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50

Process:	C:\Users\user\Desktop\Purchase Inquiry_002.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	7.152598493007967
Encrypted:	false
SSDEEP:	6:dHfjAxrbum1JZjKPT4JwpJC5d/RtnEbuJHQA:dHcFum1J9KPT/r67VtwA
MD5:	459A5E89661B24D260FE10EB0A81154D
SHA1:	5D77694CFA99D47CF0F35A47B2CAD30FDEC4C393
SHA-256:	E4D708AD5AE3ADDC025EC3AB2E48596D13666114C195349F0B2019D2B4C1949F
SHA-512:	AFD2827E4FF1F23656E9C6C5A9D496B4D7EAFE4A9869134158EA257126F308E3417BBA8BAF19DE0BD874E5FCBACE88A53FBA023984ECA342E5FF96DBC08D1162
Malicious:	false
Reputation:	low
Preview:	. .w....s.G.w.Lj..)m.........w.Zpy.p.8<....2.P:..CU...?$...$w.....f..E.R.6"}.....z$,.].\.p.H...G.....Ma{...O]...".t-....{.1..0>..5xu...o.@...bh.m.tO.Ke..>..{.^Y]..zIQ..eEB.#......L.U.....U].....!...Uw.[.3n..>.-*.[X.Hk....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Inquiry_002.exe.log

Process:	C:\Users\user\Desktop\Purchase Inquiry_002.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xASiLfzXONGIW.exe.log

Process:	C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\json[1].json

Process:	C:\Users\user\Desktop\Purchase Inquiry_002.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.015105568788186
Encrypted:	false
SSDEEP:	12:tkluQ+nd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qluQydRNuKyGX85jvXhNlT3/7AcV9Wro
MD5:	8937B63DC0B37E949F38E7874886D999
SHA1:	62FD17BF5A029DDD3A5CFB4F5FC9FE83A346FFFC
SHA-256:	AB2F31E4512913B1E7F7ACAB4B72D6E741C960D0A482F09EA6F9D96FED842A66
SHA-512:	077176C51DC10F155EE08326270C1FE3E6CF36C7ABA75611BDB3CCDA2526D6F0360DBC2FBF4A9963051F0F01658017389FD898980ACF7BB3B29B287F188EE7B9
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.75",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.379460230152629
Encrypted:	false
SSDEEP:	48:fWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//ZPUyxs:fLHyIFKL3IZ2KRH9OugYs
MD5:	DEB5A9A8979B751F817ECBC2841F644A
SHA1:	24CA1EF1CAA9B1E458C2B0A2504A606A1D3F1919
SHA-256:	94CEDFEA0D52A603FC2D814442996EA37098FC221B2927828ECB986617FC5EEF
SHA-512:	FE33FD74F0836ED81018ABF53D4451502DC4B3ED6A2CCD14F86B98FD46B63651E4425AC1EC34D91BA5875D82C979CFC7DF585763BAF0B132FC310D9530784018
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_33v4kdys.yge.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ryrwtse.3j2.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_43yswqfg.a4e.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u1iadovm.elz.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ul5pcprh.0rg.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_un2hzs0q.jig.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xb5laily.wjp.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xgkyn1bq.i3f.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp3EA3.tmp

Process:	C:\Users\user\Desktop\Purchase Inquiry_002.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	5.1204644578053955
Encrypted:	false
SSDEEP:	48:cge7XQBBYrFdOFzOzN33ODOiDdKrsuTSv:He7XQBBYrFdOFzOz6dKrsu0
MD5:	137FC4F37CB038A17A4ED8E307485BA6
SHA1:	C12679A1644AE594A72FD0FA3892C3DC4A0EB396
SHA-256:	D959E53F5DBDC228656D801E3D2013EB9BD0140608EB6A07CDC50CB119C59C5C
SHA-512:	6F75E96A1F503E44F08DDEBB953D1A198D7FCBB36D43FC0EC8275C6BE8B64EA5621A0F42E28B754C217318CB55B3C6ED0CB84DDE5B37C756F13977A3ACC97BCE
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Local\Temp\tmp4FBA.tmp

Process:	C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	5.1204644578053955
Encrypted:	false
SSDEEP:	48:cge7XQBBYrFdOFzOzN33ODOiDdKrsuTSv:He7XQBBYrFdOFzOz6dKrsu0
MD5:	137FC4F37CB038A17A4ED8E307485BA6
SHA1:	C12679A1644AE594A72FD0FA3892C3DC4A0EB396
SHA-256:	D959E53F5DBDC228656D801E3D2013EB9BD0140608EB6A07CDC50CB119C59C5C
SHA-512:	6F75E96A1F503E44F08DDEBB953D1A198D7FCBB36D43FC0EC8275C6BE8B64EA5621A0F42E28B754C217318CB55B3C6ED0CB84DDE5B37C756F13977A3ACC97BCE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe

Process:	C:\Users\user\Desktop\Purchase Inquiry_002.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	914432
Entropy (8bit):	7.9612048561210855
Encrypted:	false
SSDEEP:	24576:WNo7gN9rqhq/5UqutCi1BDUTskujqA5pd6p3MFHdIvYV:QL2hq/6q1i1h4v3A5pdSOWvY
MD5:	C016B06A4942455DF9CE8A58B72BCC90
SHA1:	DBA52AFE33451C444FD5CF3C6ACA9D2CED768D2C
SHA-256:	E115D3BD2903D9D663A7A69EDD08B0BA5F2528C831D17530BBF621648B44894C
SHA-512:	961475A98CFDC14A29725B43C1807A3EDA08A2257F50D216375FAF262880CE39CF7847D00263D00FD1CE032AD14FBB003B3AB1E78BBD25B3A644F3D6746168FE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U7<g..............0.................. ... ....@.. .......................`............@.................................7...O.... ..L....................@......8...T............................................ ............... ..H............text........ ...................... ..`.rsrc...L.... ......................@..@.reloc.......@......................@..B................k.......H........}...O......i.......0............................................0..$..........s......s.....s ......o!...&..+...0..)........s\....s.......o[...s......o".......+.......0..+........s\....r...p.(#......o[...s......o$....+....0..0........s\....rC..p.r...p(%......o[...s......o$....+...0...........s\.......O...%.r...p.%...%.r...p.%...%.r...p.%....%.r!..p.%....%.r;..p.%.....%..rU..p.%.....%..ry..p.%....%..r...p.(&......o[...s.......o$...&r...p('...&......o(...('...&...*.

C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\Purchase Inquiry_002.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9612048561210855
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Purchase Inquiry_002.exe
File size:	914'432 bytes
MD5:	c016b06a4942455df9ce8a58b72bcc90
SHA1:	dba52afe33451c444fd5cf3c6aca9d2ced768d2c
SHA256:	e115d3bd2903d9d663a7a69edd08b0ba5f2528c831d17530bbf621648b44894c
SHA512:	961475a98cfdc14a29725b43c1807a3eda08a2257f50d216375faf262880ce39cf7847d00263d00fd1ce032ad14fbb003b3ab1e78bbd25b3a644f3d6746168fe
SSDEEP:	24576:WNo7gN9rqhq/5UqutCi1BDUTskujqA5pd6p3MFHdIvYV:QL2hq/6q1i1h4v3A5pdSOWvY
TLSH:	2415234223B88B9BD5BE4BF492B2709153F1726B6A31F32C4EE294DD6055F90A79130F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U7<g..............0.................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4e078a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x673C3755 [Tue Nov 19 06:59:33 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe0737	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe2000	0x64c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xde638	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xde790	0xde800	139320dbfdddfe7038379597a52bf952	False	0.967504608497191	data	7.966548982352114	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe2000	0x64c	0x800	9ad2be29f34795eac2e6526b507cdbe1	False	0.34228515625	data	3.5221250481585593	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe4000	0xc	0x200	bb53d9c3eb206652af52fbd23d9d7155	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe2090	0x3bc	data			0.41527196652719667
RT_MANIFEST	0xe245c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-21T12:22:03.765320+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.10	49749	154.216.19.141	2531	TCP
2024-11-21T12:22:07.045321+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.10	49757	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 12:22:02.200669050 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:22:02.320832014 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:22:02.321149111 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:22:02.326456070 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:22:02.446472883 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:22:03.716294050 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:22:03.765320063 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:22:03.967907906 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:22:04.008040905 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:22:04.010598898 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:22:04.130064964 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:22:04.130129099 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:22:04.250155926 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:22:04.693664074 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:22:04.694988012 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:22:04.814821959 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:22:04.903795004 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:22:04.952790976 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:22:05.679328918 CET	49757	80	192.168.2.10	178.237.33.50
Nov 21, 2024 12:22:05.798876047 CET	80	49757	178.237.33.50	192.168.2.10
Nov 21, 2024 12:22:05.799037933 CET	49757	80	192.168.2.10	178.237.33.50
Nov 21, 2024 12:22:05.799211025 CET	49757	80	192.168.2.10	178.237.33.50
Nov 21, 2024 12:22:05.919533968 CET	80	49757	178.237.33.50	192.168.2.10
Nov 21, 2024 12:22:07.045173883 CET	80	49757	178.237.33.50	192.168.2.10
Nov 21, 2024 12:22:07.045320988 CET	49757	80	192.168.2.10	178.237.33.50
Nov 21, 2024 12:22:07.057647943 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:22:07.179143906 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:22:08.049088001 CET	80	49757	178.237.33.50	192.168.2.10
Nov 21, 2024 12:22:08.049151897 CET	49757	80	192.168.2.10	178.237.33.50
Nov 21, 2024 12:22:35.152904034 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:22:35.157516956 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:22:35.277152061 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:23:05.621078014 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:23:05.622374058 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:23:05.741914034 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:23:36.090356112 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:23:36.092118025 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:23:36.211793900 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:23:55.437576056 CET	49757	80	192.168.2.10	178.237.33.50
Nov 21, 2024 12:23:55.861006975 CET	49757	80	192.168.2.10	178.237.33.50
Nov 21, 2024 12:23:56.562330961 CET	49757	80	192.168.2.10	178.237.33.50
Nov 21, 2024 12:23:57.860974073 CET	49757	80	192.168.2.10	178.237.33.50
Nov 21, 2024 12:24:00.547007084 CET	49757	80	192.168.2.10	178.237.33.50
Nov 21, 2024 12:24:05.656444073 CET	49757	80	192.168.2.10	178.237.33.50
Nov 21, 2024 12:24:06.566520929 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:24:06.567789078 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:24:06.688178062 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:24:15.761326075 CET	49757	80	192.168.2.10	178.237.33.50
Nov 21, 2024 12:24:37.028301001 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:24:37.029489040 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:24:37.149267912 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:25:07.497009039 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:25:07.498631001 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:25:07.619234085 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:25:37.950030088 CET	2531	49749	154.216.19.141	192.168.2.10
Nov 21, 2024 12:25:37.951174021 CET	49749	2531	192.168.2.10	154.216.19.141
Nov 21, 2024 12:25:38.070732117 CET	2531	49749	154.216.19.141	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 12:21:48.173746109 CET	60467	53	192.168.2.10	1.1.1.1
Nov 21, 2024 12:21:49.197150946 CET	60467	53	192.168.2.10	1.1.1.1
Nov 21, 2024 12:21:50.197642088 CET	60467	53	192.168.2.10	1.1.1.1
Nov 21, 2024 12:21:52.236526012 CET	60467	53	192.168.2.10	1.1.1.1
Nov 21, 2024 12:21:52.353193998 CET	53	60467	1.1.1.1	192.168.2.10
Nov 21, 2024 12:21:52.353215933 CET	53	60467	1.1.1.1	192.168.2.10
Nov 21, 2024 12:21:52.353229046 CET	53	60467	1.1.1.1	192.168.2.10
Nov 21, 2024 12:21:52.464458942 CET	53	60467	1.1.1.1	192.168.2.10
Nov 21, 2024 12:21:55.390942097 CET	57557	53	192.168.2.10	1.1.1.1
Nov 21, 2024 12:21:56.390590906 CET	57557	53	192.168.2.10	1.1.1.1
Nov 21, 2024 12:21:57.406150103 CET	57557	53	192.168.2.10	1.1.1.1
Nov 21, 2024 12:21:59.406851053 CET	57557	53	192.168.2.10	1.1.1.1
Nov 21, 2024 12:21:59.580117941 CET	53	57557	1.1.1.1	192.168.2.10
Nov 21, 2024 12:21:59.580132961 CET	53	57557	1.1.1.1	192.168.2.10
Nov 21, 2024 12:21:59.580142975 CET	53	57557	1.1.1.1	192.168.2.10
Nov 21, 2024 12:21:59.633011103 CET	53	57557	1.1.1.1	192.168.2.10
Nov 21, 2024 12:22:00.594325066 CET	53035	53	192.168.2.10	1.1.1.1
Nov 21, 2024 12:22:01.593626976 CET	53035	53	192.168.2.10	1.1.1.1
Nov 21, 2024 12:22:02.189199924 CET	53	53035	1.1.1.1	192.168.2.10
Nov 21, 2024 12:22:02.189265966 CET	53	53035	1.1.1.1	192.168.2.10
Nov 21, 2024 12:22:05.437208891 CET	51837	53	192.168.2.10	1.1.1.1
Nov 21, 2024 12:22:05.674540043 CET	53	51837	1.1.1.1	192.168.2.10
Nov 21, 2024 12:22:19.328787088 CET	50897	53	192.168.2.10	1.1.1.1
Nov 21, 2024 12:22:19.555680990 CET	53	50897	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 12:21:48.173746109 CET	192.168.2.10	1.1.1.1	0x6c79	Standard query (0)	cee.work.gd	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:21:49.197150946 CET	192.168.2.10	1.1.1.1	0x6c79	Standard query (0)	cee.work.gd	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:21:50.197642088 CET	192.168.2.10	1.1.1.1	0x6c79	Standard query (0)	cee.work.gd	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:21:52.236526012 CET	192.168.2.10	1.1.1.1	0x6c79	Standard query (0)	cee.work.gd	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:21:55.390942097 CET	192.168.2.10	1.1.1.1	0xf6fa	Standard query (0)	cee.work.gd	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:21:56.390590906 CET	192.168.2.10	1.1.1.1	0xf6fa	Standard query (0)	cee.work.gd	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:21:57.406150103 CET	192.168.2.10	1.1.1.1	0xf6fa	Standard query (0)	cee.work.gd	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:21:59.406851053 CET	192.168.2.10	1.1.1.1	0xf6fa	Standard query (0)	cee.work.gd	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:22:00.594325066 CET	192.168.2.10	1.1.1.1	0xc6de	Standard query (0)	cee.work.gd	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:22:01.593626976 CET	192.168.2.10	1.1.1.1	0xc6de	Standard query (0)	cee.work.gd	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:22:05.437208891 CET	192.168.2.10	1.1.1.1	0xf662	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:22:19.328787088 CET	192.168.2.10	1.1.1.1	0x8fd	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 12:21:52.353193998 CET	1.1.1.1	192.168.2.10	0x6c79	Server failure (2)	cee.work.gd	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:21:52.353215933 CET	1.1.1.1	192.168.2.10	0x6c79	Server failure (2)	cee.work.gd	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:21:52.353229046 CET	1.1.1.1	192.168.2.10	0x6c79	Server failure (2)	cee.work.gd	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:21:52.464458942 CET	1.1.1.1	192.168.2.10	0x6c79	Server failure (2)	cee.work.gd	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:21:59.580117941 CET	1.1.1.1	192.168.2.10	0xf6fa	Server failure (2)	cee.work.gd	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:21:59.580132961 CET	1.1.1.1	192.168.2.10	0xf6fa	Server failure (2)	cee.work.gd	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:21:59.580142975 CET	1.1.1.1	192.168.2.10	0xf6fa	Server failure (2)	cee.work.gd	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:21:59.633011103 CET	1.1.1.1	192.168.2.10	0xf6fa	Server failure (2)	cee.work.gd	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:22:02.189199924 CET	1.1.1.1	192.168.2.10	0xc6de	No error (0)	cee.work.gd		154.216.19.141	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:22:02.189265966 CET	1.1.1.1	192.168.2.10	0xc6de	No error (0)	cee.work.gd		154.216.19.141	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:22:05.674540043 CET	1.1.1.1	192.168.2.10	0xf662	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false
Nov 21, 2024 12:22:19.555680990 CET	1.1.1.1	192.168.2.10	0x8fd	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49757	178.237.33.50	80	8184	C:\Users\user\Desktop\Purchase Inquiry_002.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 12:22:05.799211025 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Nov 21, 2024 12:22:07.045173883 CET	1170	IN	HTTP/1.1 200 OK date: Thu, 21 Nov 2024 11:22:06 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.75", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	06:21:43
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\Purchase Inquiry_002.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Purchase Inquiry_002.exe"
Imagebase:	0x360000
File size:	914'432 bytes
MD5 hash:	C016B06A4942455DF9CE8A58B72BCC90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1342558664.0000000004337000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1342558664.0000000004337000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1342558664.0000000003965000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1342558664.0000000003965000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	06:21:46
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Purchase Inquiry_002.exe"
Imagebase:	0x6e0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	06:21:46
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	06:21:46
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe"
Imagebase:	0x6e0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	06:21:46
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	06:21:46
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xASiLfzXONGIW" /XML "C:\Users\user\AppData\Local\Temp\tmp3EA3.tmp"
Imagebase:	0xdf0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	06:21:46
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	06:21:46
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\Purchase Inquiry_002.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Purchase Inquiry_002.exe"
Imagebase:	0xd70000
File size:	914'432 bytes
MD5 hash:	C016B06A4942455DF9CE8A58B72BCC90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000009.00000002.3752310900.0000000001537000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	10
Start time:	06:21:47
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe
Imagebase:	0x9d0000
File size:	914'432 bytes
MD5 hash:	C016B06A4942455DF9CE8A58B72BCC90
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.1383390917.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.1383390917.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	06:21:49
Start date:	21/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6616b0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	06:21:50
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xASiLfzXONGIW" /XML "C:\Users\user\AppData\Local\Temp\tmp4FBA.tmp"
Imagebase:	0xdf0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	06:21:50
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	06:21:51
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\xASiLfzXONGIW.exe"
Imagebase:	0xcc0000
File size:	914'432 bytes
MD5 hash:	C016B06A4942455DF9CE8A58B72BCC90
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.1359604043.0000000001237000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 0000000E.00000002.1357241018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true