Windows Analysis Report
Payment Transfer Request Form.bat.exe

Overview

General Information

Sample name: Payment Transfer Request Form.bat.exe
Analysis ID: 1561752
MD5: fc5a80adf45d78ffa834283d0a78f9f6
SHA1: 6865dec6f71546ea01420295b7175038c3a81ec4
SHA256: e588a098e9ceb33f2616e11a3faf28162e5f4b7f3800b22ab3023bc376aeb18c
Tags: batexeuser-abuse_ch
Infos:

Detection

Remcos
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Sigma detected: Scheduled temp file as task from temp location
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected Remcos RAT
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evaded block containing many API calls
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Remcos, RemcosRAT Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
 https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

AV Detection
barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\install.vbs Avira: detection malicious, Label: VBS/Runner.VPD
Found malware configuration
Source: 00000024.00000002.1736773927.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Remcos {"Host:Port:Password": ["149.226:9285:1"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "AppUpdate", "Hide file": "Disable", "Mutex": "Rmc-VCJ8ZS", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "AppUpdate", "Keylog folder": "remcos", "Keylog file max size": "100"}
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\AppUpdate\remcos.exe ReversingLabs: Detection: 52%
Source: C:\ProgramData\AppUpdate\remcos.exe Virustotal: Detection: 61% Perma Link
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe ReversingLabs: Detection: 52%
Multi AV Scanner detection for submitted file
Source: Payment Transfer Request Form.bat.exe ReversingLabs: Detection: 52%
Source: Payment Transfer Request Form.bat.exe Virustotal: Detection: 61% Perma Link
Yara detected Remcos RAT
Source: Yara match File source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000024.00000002.1736773927.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.1656887776.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.3782308386.00000000014FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1405698672.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1407344012.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.1574639451.000000000117A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1417981546.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Payment Transfer Request Form.bat.exe PID: 4072, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Payment Transfer Request Form.bat.exe PID: 7380, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 8156, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 2508, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 3248, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 7388, type: MEMORYSTR
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\ProgramData\AppUpdate\remcos.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: Payment Transfer Request Form.bat.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004315EC CryptAcquireContextA,CryptGenRandom,CryptReleaseContext, 9_2_004315EC
Source: Payment Transfer Request Form.bat.exe, 00000000.00000002.1417981546.00000000042D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_a0eb0d4b-5
Uses 32bit PE files
Source: Payment Transfer Request Form.bat.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Payment Transfer Request Form.bat.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0041A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, 9_2_0041A01B
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0040B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, 9_2_0040B28E
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0040838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, 9_2_0040838E
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004087A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, 9_2_004087A0
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00407848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, 9_2_00407848
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004068CD FindFirstFileW,FindNextFileW, 9_2_004068CD
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0044BA59 FindFirstFileExA, 9_2_0044BA59
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0040AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, 9_2_0040AA71
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00417AAB FindFirstFileW,FindNextFileW,FindNextFileW, 9_2_00417AAB
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0040AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, 9_2_0040AC78
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00406D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW, 9_2_00406D28

Software Vulnerabilities
barindex
Suspicious execution chain found
Source: C:\Windows\SysWOW64\wscript.exe Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 4x nop then jmp 06A9AE4Eh 0_2_06A9B437
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 4x nop then jmp 0776A3DEh 15_2_0776A9C7
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 4x nop then jmp 074CA0E6h 24_2_074CA6CF
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 4x nop then jmp 0721A0E6h 29_2_0721A6CF
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 4x nop then jmp 074EA0E6h 33_2_074EA6CF

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49754 -> 212.162.149.226:9285
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 149.226
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.9:49754 -> 212.162.149.226:9285
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 178.237.33.50 178.237.33.50
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UNREAL-SERVERSUS UNREAL-SERVERSUS
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49761 -> 178.237.33.50:80
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.162.149.226
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0041936B InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 9_2_0041936B
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: geoplugin.net
Source: Payment Transfer Request Form.bat.exe, remcos.exe.9.dr, iKgKaogJ.exe.0.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Payment Transfer Request Form.bat.exe, remcos.exe.9.dr, iKgKaogJ.exe.0.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: remcos.exe, 00000017.00000002.3782308386.000000000151F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/PU
Source: remcos.exe, 00000017.00000002.3782308386.000000000151F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/_IDENTIFIER=Intel64
Source: remcos.exe, 00000017.00000002.3782308386.000000000151F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/iv
Source: remcos.exe, 00000017.00000002.3782308386.000000000151F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gp
Source: Payment Transfer Request Form.bat.exe, 00000000.00000002.1417981546.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, Payment Transfer Request Form.bat.exe, 00000009.00000002.1405698672.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gp/C
Source: remcos.exe, 00000017.00000002.3782308386.00000000014FA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: remcos.exe, 00000017.00000002.3782308386.000000000151F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gpal
Source: Payment Transfer Request Form.bat.exe, remcos.exe.9.dr, iKgKaogJ.exe.0.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: Payment Transfer Request Form.bat.exe, 00000000.00000002.1414846976.000000000282C000.00000004.00000800.00020000.00000000.sdmp, remcos.exe, 0000000F.00000002.1535563914.0000000002E03000.00000004.00000800.00020000.00000000.sdmp, remcos.exe, 00000018.00000002.1598556738.000000000319F000.00000004.00000800.00020000.00000000.sdmp, remcos.exe, 0000001D.00000002.1679679015.0000000002F1F000.00000004.00000800.00020000.00000000.sdmp, remcos.exe, 00000021.00000002.1760390363.00000000030DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Payment Transfer Request Form.bat.exe, remcos.exe.9.dr, iKgKaogJ.exe.0.dr String found in binary or memory: http://tempuri.org/ianiDataSet.xsd
Source: Payment Transfer Request Form.bat.exe, remcos.exe.9.dr, iKgKaogJ.exe.0.dr String found in binary or memory: http://tempuri.org/ianiDataSet1.xsd
Source: Payment Transfer Request Form.bat.exe, remcos.exe.9.dr, iKgKaogJ.exe.0.dr String found in binary or memory: http://tempuri.org/ianiDataSet2.xsdM
Source: Payment Transfer Request Form.bat.exe, remcos.exe.9.dr, iKgKaogJ.exe.0.dr String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to register a low level keyboard hook
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00409340 SetWindowsHookExA 0000000D,0040932C,00000000 9_2_00409340
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0040A65A OpenClipboard,GetClipboardData,CloseClipboard, 9_2_0040A65A
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00414EC1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 9_2_00414EC1
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0040A65A OpenClipboard,GetClipboardData,CloseClipboard, 9_2_0040A65A
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00409468 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx, 9_2_00409468

E-Banking Fraud
barindex
Yara detected Remcos RAT
Source: Yara match File source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000024.00000002.1736773927.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.1656887776.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.3782308386.00000000014FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1405698672.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1407344012.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.1574639451.000000000117A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1417981546.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Payment Transfer Request Form.bat.exe PID: 4072, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Payment Transfer Request Form.bat.exe PID: 7380, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 8156, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 2508, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 3248, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 7388, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands
barindex
Contains functionalty to change the wallpaper
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0041A76C SystemParametersInfoW, 9_2_0041A76C

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.raw.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.raw.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 00000009.00000002.1405698672.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000009.00000002.1405698672.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000009.00000002.1405698672.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 00000000.00000002.1417981546.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Payment Transfer Request Form.bat.exe PID: 4072, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Payment Transfer Request Form.bat.exe PID: 7380, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Payment Transfer Request Form.bat.exe
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00414DB4 ExitWindowsEx,LoadLibraryA,GetProcAddress, 9_2_00414DB4
Detected potential crypto function
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_02604607 0_2_02604607
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_0260D51C 0_2_0260D51C
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_06A9CB08 0_2_06A9CB08
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_06A956F0 0_2_06A956F0
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_06A952B8 0_2_06A952B8
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_06A97268 0_2_06A97268
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_06A94E80 0_2_06A94E80
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_06A95B28 0_2_06A95B28
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_06A95B27 0_2_06A95B27
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00425152 9_2_00425152
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00435286 9_2_00435286
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004513D4 9_2_004513D4
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0045050B 9_2_0045050B
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00436510 9_2_00436510
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004316FB 9_2_004316FB
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0043569E 9_2_0043569E
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00443700 9_2_00443700
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004257FB 9_2_004257FB
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004128E3 9_2_004128E3
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00425964 9_2_00425964
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0041B917 9_2_0041B917
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0043D9CC 9_2_0043D9CC
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00435AD3 9_2_00435AD3
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00424BC3 9_2_00424BC3
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0043DBFB 9_2_0043DBFB
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0044ABA9 9_2_0044ABA9
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00433C0B 9_2_00433C0B
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00434D8A 9_2_00434D8A
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0043DE2A 9_2_0043DE2A
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0041CEAF 9_2_0041CEAF
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00435F08 9_2_00435F08
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Code function: 11_2_016BD51C 11_2_016BD51C
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Code function: 11_2_07539408 11_2_07539408
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Code function: 11_2_07537268 11_2_07537268
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Code function: 11_2_07534E80 11_2_07534E80
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Code function: 11_2_07535B19 11_2_07535B19
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Code function: 11_2_07535B28 11_2_07535B28
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 15_2_0141D51C 15_2_0141D51C
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 15_2_0776C081 15_2_0776C081
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 15_2_077656F0 15_2_077656F0
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 15_2_07767268 15_2_07767268
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 15_2_077652B8 15_2_077652B8
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 15_2_07764E80 15_2_07764E80
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 15_2_07765B28 15_2_07765B28
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 15_2_07765B18 15_2_07765B18
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_015AD51C 24_2_015AD51C
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074CBD99 24_2_074CBD99
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C56F0 24_2_074C56F0
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C7268 24_2_074C7268
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C52B8 24_2_074C52B8
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C4E80 24_2_074C4E80
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C5B28 24_2_074C5B28
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C5B27 24_2_074C5B27
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 29_2_02D3D51C 29_2_02D3D51C
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 29_2_0721BDA8 29_2_0721BDA8
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 29_2_07214E80 29_2_07214E80
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 29_2_072156F0 29_2_072156F0
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 29_2_072104C8 29_2_072104C8
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 29_2_07215B28 29_2_07215B28
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 29_2_07215B19 29_2_07215B19
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 29_2_07217268 29_2_07217268
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 29_2_072152B8 29_2_072152B8
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 33_2_0132D51C 33_2_0132D51C
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 33_2_03006BE0 33_2_03006BE0
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 33_2_03000007 33_2_03000007
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 33_2_03000040 33_2_03000040
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 33_2_03006BD8 33_2_03006BD8
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 33_2_074EBD5B 33_2_074EBD5B
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 33_2_074E56F0 33_2_074E56F0
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 33_2_074E4E80 33_2_074E4E80
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 33_2_074E5B19 33_2_074E5B19
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 33_2_074E5B28 33_2_074E5B28
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 33_2_074E7268 33_2_074E7268
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 33_2_074E52B8 33_2_074E52B8
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: String function: 00402073 appears 51 times
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: String function: 00432B90 appears 53 times
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: String function: 00432525 appears 41 times
PE / OLE file has an invalid certificate
Source: Payment Transfer Request Form.bat.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: Payment Transfer Request Form.bat.exe, 00000000.00000002.1429283409.0000000006E30000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs Payment Transfer Request Form.bat.exe
Source: Payment Transfer Request Form.bat.exe, 00000000.00000000.1322690850.00000000001B2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameseEd.exe4 vs Payment Transfer Request Form.bat.exe
Source: Payment Transfer Request Form.bat.exe, 00000000.00000002.1413438857.000000000072E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Payment Transfer Request Form.bat.exe
Source: Payment Transfer Request Form.bat.exe, 00000000.00000002.1429762645.0000000007537000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameseEd.exe4 vs Payment Transfer Request Form.bat.exe
Source: Payment Transfer Request Form.bat.exe, 00000000.00000002.1428203129.0000000004F80000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameArthur.dll" vs Payment Transfer Request Form.bat.exe
Source: Payment Transfer Request Form.bat.exe, 00000000.00000002.1417981546.00000000038FF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs Payment Transfer Request Form.bat.exe
Source: Payment Transfer Request Form.bat.exe, 00000009.00000002.1407344012.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewscript.exe.mui` vs Payment Transfer Request Form.bat.exe
Source: Payment Transfer Request Form.bat.exe, 00000009.00000002.1407344012.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewscript.exe` vs Payment Transfer Request Form.bat.exe
Source: Payment Transfer Request Form.bat.exe Binary or memory string: OriginalFilenameseEd.exe4 vs Payment Transfer Request Form.bat.exe
Uses 32bit PE files
Source: Payment Transfer Request Form.bat.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 00000009.00000002.1405698672.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000009.00000002.1405698672.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000009.00000002.1405698672.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 00000000.00000002.1417981546.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Payment Transfer Request Form.bat.exe PID: 4072, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Payment Transfer Request Form.bat.exe PID: 7380, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Payment Transfer Request Form.bat.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: iKgKaogJ.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: remcos.exe.9.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, QwhKlmmQbOGs1vhvh6.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, QwhKlmmQbOGs1vhvh6.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, yCV0BKZVRAKIRjaruc.cs Security API names: _0020.SetAccessControl
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, yCV0BKZVRAKIRjaruc.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, yCV0BKZVRAKIRjaruc.cs Security API names: _0020.AddAccessRule
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, yCV0BKZVRAKIRjaruc.cs Security API names: _0020.SetAccessControl
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, yCV0BKZVRAKIRjaruc.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, yCV0BKZVRAKIRjaruc.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@49/31@2/2
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00415C90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError, 9_2_00415C90
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0040E2E7 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle, 9_2_0040E2E7
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00419493 FindResourceA,LoadResource,LockResource,SizeofResource, 9_2_00419493
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00418A00 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle, 9_2_00418A00
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe File created: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5664:120:WilError_03
Source: C:\ProgramData\AppUpdate\remcos.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7268:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7176:120:WilError_03
Source: C:\ProgramData\AppUpdate\remcos.exe Mutant created: \Sessions\1\BaseNamedObjects\pTaQptBbLSFkRXHSYlA
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7180:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7656:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7936:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2320:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7864:120:WilError_03
Source: C:\ProgramData\AppUpdate\remcos.exe Mutant created: \Sessions\1\BaseNamedObjects\Rmc-VCJ8ZS
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7468:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7892:120:WilError_03
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe File created: C:\Users\user\AppData\Local\Temp\tmp854C.tmp Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\install.vbs"
Source: Payment Transfer Request Form.bat.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Payment Transfer Request Form.bat.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Payment Transfer Request Form.bat.exe, 00000000.00000000.1322690850.00000000001B2000.00000002.00000001.01000000.00000003.sdmp, remcos.exe.9.dr, iKgKaogJ.exe.0.dr Binary or memory string: INSERT INTO [dbo].[CREDIT_PLAN] ([CREDIT_ID], [MATURITY_DATE], [MATURITY_SUM], [MATURITY_NOTE], [MODIF_DATE]) VALUES (@CREDIT_ID, @MATURITY_DATE, @MATURITY_SUM, @MATURITY_NOTE, @MODIF_DATE);
Source: Payment Transfer Request Form.bat.exe, 00000000.00000000.1322690850.00000000001B2000.00000002.00000001.01000000.00000003.sdmp, remcos.exe.9.dr, iKgKaogJ.exe.0.dr Binary or memory string: INSERT INTO [dbo].[CREDIT_PRODUCT] ([PROD_NAME], [PROD_ACTIVE], [PROD_SUM_FROM], [PROD_SUM_TO], [MODIF_DATE], [INTEREST]) VALUES (@PROD_NAME, @PROD_ACTIVE, @PROD_SUM_FROM, @PROD_SUM_TO, @MODIF_DATE, @INTEREST);
Source: Payment Transfer Request Form.bat.exe, 00000000.00000000.1322690850.00000000001B2000.00000002.00000001.01000000.00000003.sdmp, remcos.exe.9.dr, iKgKaogJ.exe.0.dr Binary or memory string: UPDATE [dbo].[Login] SET [User_id] = @User_id, [User_pass] = @User_pass WHERE (([User_id] = @Original_User_id) AND ([User_pass] = @Original_User_pass));
Source: Payment Transfer Request Form.bat.exe, 00000000.00000000.1322690850.00000000001B2000.00000002.00000001.01000000.00000003.sdmp, remcos.exe.9.dr, iKgKaogJ.exe.0.dr Binary or memory string: UPDATE [dbo].[CREDIT_PLAN] SET [CREDIT_ID] = @CREDIT_ID, [MATURITY_DATE] = @MATURITY_DATE, [MATURITY_SUM] = @MATURITY_SUM, [MATURITY_NOTE] = @MATURITY_NOTE, [MODIF_DATE] = @MODIF_DATE WHERE (([MATURITY_ID] = @Original_MATURITY_ID) AND ((@IsNull_CREDIT_ID = 1 AND [CREDIT_ID] IS NULL) OR ([CREDIT_ID] = @Original_CREDIT_ID)) AND ([MATURITY_DATE] = @Original_MATURITY_DATE) AND ([MATURITY_SUM] = @Original_MATURITY_SUM) AND ((@IsNull_MATURITY_NOTE = 1 AND [MATURITY_NOTE] IS NULL) OR ([MATURITY_NOTE] = @Original_MATURITY_NOTE)) AND ((@IsNull_MODIF_DATE = 1 AND [MODIF_DATE] IS NULL) OR ([MODIF_DATE] = @Original_MODIF_DATE)));
Source: Payment Transfer Request Form.bat.exe, 00000000.00000000.1322690850.00000000001B2000.00000002.00000001.01000000.00000003.sdmp, remcos.exe.9.dr, iKgKaogJ.exe.0.dr Binary or memory string: INSERT INTO [dbo].[PROD_PERIODS] ([PROD_CODE], [PROD_PERIOD]) VALUES (@PROD_CODE, @PROD_PERIOD);
Source: Payment Transfer Request Form.bat.exe, 00000000.00000000.1322690850.00000000001B2000.00000002.00000001.01000000.00000003.sdmp, remcos.exe.9.dr, iKgKaogJ.exe.0.dr Binary or memory string: UPDATE [dbo].[INTEREST] SET [PROD_CODE] = @PROD_CODE, [PROD_PERIOD] = @PROD_PERIOD, [SUM_FROM] = @SUM_FROM, [SUM_TO] = @SUM_TO WHERE (([PROD_CODE] = @Original_PROD_CODE) AND ([PROD_PERIOD] = @Original_PROD_PERIOD) AND ([SUM_FROM] = @Original_SUM_FROM) AND ([SUM_TO] = @Original_SUM_TO));
Source: Payment Transfer Request Form.bat.exe, 00000000.00000000.1322690850.00000000001B2000.00000002.00000001.01000000.00000003.sdmp, remcos.exe.9.dr, iKgKaogJ.exe.0.dr Binary or memory string: UPDATE [dbo].[CREDIT] SET [CREDIT_NO] = @CREDIT_NO, [CREDIT_DATE] = @CREDIT_DATE, [CREDIT_PERIOD] = @CREDIT_PERIOD, [CREDIT_END_DATE] = @CREDIT_END_DATE, [CREDIT_BEGIN_DATE] = @CREDIT_BEGIN_DATE, [CLIENT_ID] = @CLIENT_ID, [PROD_CODE] = @PROD_CODE, [CREDIT_SUM] = @CREDIT_SUM, [CREDIT_NOTE] = @CREDIT_NOTE, [MODIF_DATE] = @MODIF_DATE WHERE (([CREDIT_ID] = @Original_CREDIT_ID) AND ([CREDIT_NO] = @Original_CREDIT_NO) AND ((@IsNull_CREDIT_DATE = 1 AND [CREDIT_DATE] IS NULL) OR ([CREDIT_DATE] = @Original_CREDIT_DATE)) AND ([CREDIT_PERIOD] = @Original_CREDIT_PERIOD) AND ((@IsNull_CREDIT_END_DATE = 1 AND [CREDIT_END_DATE] IS NULL) OR ([CREDIT_END_DATE] = @Original_CREDIT_END_DATE)) AND ((@IsNull_CREDIT_BEGIN_DATE = 1 AND [CREDIT_BEGIN_DATE] IS NULL) OR ([CREDIT_BEGIN_DATE] = @Original_CREDIT_BEGIN_DATE)) AND ([CLIENT_ID] = @Original_CLIENT_ID) AND ((@IsNull_PROD_CODE = 1 AND [PROD_CODE] IS NULL) OR ([PROD_CODE] = @Original_PROD_CODE)) AND ([CREDIT_SUM] = @Original_CREDIT_SUM) AND ((@IsNull_CREDIT_NOTE = 1 AND [CREDIT_NOTE] IS NULL) OR ([CREDIT_NOTE] = @Original_CREDIT_NOTE)) AND ((@IsNull_MODIF_DATE = 1 AND [MODIF_DATE] IS NULL) OR ([MODIF_DATE] = @Original_MODIF_DATE)));
Source: Payment Transfer Request Form.bat.exe, 00000000.00000000.1322690850.00000000001B2000.00000002.00000001.01000000.00000003.sdmp, remcos.exe.9.dr, iKgKaogJ.exe.0.dr Binary or memory string: UPDATE [dbo].[CREDIT_PRODUCT] SET [PROD_NAME] = @PROD_NAME, [PROD_ACTIVE] = @PROD_ACTIVE, [PROD_SUM_FROM] = @PROD_SUM_FROM, [PROD_SUM_TO] = @PROD_SUM_TO, [MODIF_DATE] = @MODIF_DATE WHERE (([PROD_CODE] = @Original_PROD_CODE) AND ([PROD_NAME] = @Original_PROD_NAME) AND ([PROD_ACTIVE] = @Original_PROD_ACTIVE) AND ([PROD_SUM_FROM] = @Original_PROD_SUM_FROM) AND ([PROD_SUM_TO] = @Original_PROD_SUM_TO) AND ((@IsNull_MODIF_DATE = 1 AND [MODIF_DATE] IS NULL) OR ([MODIF_DATE] = @Original_MODIF_DATE)));
Source: Payment Transfer Request Form.bat.exe, 00000000.00000000.1322690850.00000000001B2000.00000002.00000001.01000000.00000003.sdmp, remcos.exe.9.dr, iKgKaogJ.exe.0.dr Binary or memory string: INSERT INTO [dbo].[CREDIT_PRODUCT] ([PROD_NAME], [PROD_ACTIVE], [PROD_SUM_FROM], [PROD_SUM_TO], [MODIF_DATE]) VALUES (@PROD_NAME, @PROD_ACTIVE, @PROD_SUM_FROM, @PROD_SUM_TO, @MODIF_DATE);
Source: Payment Transfer Request Form.bat.exe ReversingLabs: Detection: 52%
Source: Payment Transfer Request Form.bat.exe Virustotal: Detection: 61%
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe File read: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe "C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe"
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKgKaogJ.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmp854C.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe "C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe"
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\install.vbs"
Source: unknown Process created: C:\Users\user\AppData\Roaming\iKgKaogJ.exe C:\Users\user\AppData\Roaming\iKgKaogJ.exe
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\ProgramData\AppUpdate\remcos.exe C:\ProgramData\AppUpdate\remcos.exe
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKgKaogJ.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmpAC9A.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: unknown Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmpCD42.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: unknown Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmpED6C.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: unknown Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmpCDB.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe" Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKgKaogJ.exe" Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmp854C.tmp" Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe "C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe" Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\install.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\AppUpdate\remcos.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\ProgramData\AppUpdate\remcos.exe C:\ProgramData\AppUpdate\remcos.exe
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKgKaogJ.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmpAC9A.tmp"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmpCD42.tmp"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmpED6C.tmp"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmpCDB.tmp"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: mscoree.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: apphelp.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: version.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: uxtheme.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: wldp.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: profapi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: cryptsp.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: rsaenh.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: dwrite.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: amsi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: userenv.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: msasn1.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: gpapi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: windowscodecs.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: propsys.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: edputil.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: urlmon.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: iertutil.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: srvcli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: netutils.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: windows.staterepositoryps.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: sspicli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: wintypes.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: appresolver.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: bcp47langs.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: slc.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: sppc.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: onecorecommonproxystub.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: winmm.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: urlmon.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: wininet.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: iertutil.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: srvcli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: netutils.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: sspicli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: mswsock.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: cryptsp.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: rsaenh.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: wldp.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: profapi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: winhttp.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: iphlpapi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: winnsi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: dnsapi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: rasadhlp.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: fwpuclnt.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: mscoree.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: version.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: uxtheme.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: wldp.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: profapi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: cryptsp.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: rsaenh.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: dwrite.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: amsi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: userenv.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: msasn1.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: gpapi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: windowscodecs.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: propsys.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: edputil.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: urlmon.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: iertutil.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: srvcli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: netutils.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: windows.staterepositoryps.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: sspicli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: wintypes.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: appresolver.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: bcp47langs.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: slc.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: sppc.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: onecorecommonproxystub.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: winmm.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: urlmon.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: wininet.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: iertutil.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: srvcli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: netutils.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: mscoree.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: version.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: uxtheme.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: wldp.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: profapi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: cryptsp.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: rsaenh.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: dwrite.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: amsi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: userenv.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: msasn1.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: gpapi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: windowscodecs.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: propsys.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: edputil.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: urlmon.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: iertutil.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: srvcli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: netutils.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: windows.staterepositoryps.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: sspicli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: wintypes.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: appresolver.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: bcp47langs.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: slc.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: sppc.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: onecorecommonproxystub.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: winmm.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: urlmon.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: wininet.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: iertutil.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: srvcli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: netutils.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: mscoree.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: version.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: uxtheme.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: wldp.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: profapi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: cryptsp.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: rsaenh.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: dwrite.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: amsi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: userenv.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: msasn1.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: gpapi.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: windowscodecs.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: propsys.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: edputil.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: urlmon.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: iertutil.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: srvcli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: netutils.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: windows.staterepositoryps.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: sspicli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: wintypes.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: appresolver.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: bcp47langs.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: slc.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: sppc.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: onecorecommonproxystub.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: winmm.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: urlmon.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: wininet.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: iertutil.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: srvcli.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: netutils.dll
Source: C:\ProgramData\AppUpdate\remcos.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Payment Transfer Request Form.bat.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Payment Transfer Request Form.bat.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: Payment Transfer Request Form.bat.exe Static file information: File size 1243656 > 1048576
Source: Payment Transfer Request Form.bat.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x129a00
Source: Payment Transfer Request Form.bat.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: Payment Transfer Request Form.bat.exe, InnerForm.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: iKgKaogJ.exe.0.dr, InnerForm.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, yCV0BKZVRAKIRjaruc.cs .Net Code: TRNtTFepRA System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, yCV0BKZVRAKIRjaruc.cs .Net Code: TRNtTFepRA System.Reflection.Assembly.Load(byte[])
Source: remcos.exe.9.dr, InnerForm.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0041A8DA LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 9_2_0041A8DA
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_02604698 push edx; ret 0_2_0260469A
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_0260469B push edx; ret 0_2_0260469E
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_0260469F push edx; ret 0_2_026046A2
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_0260475B push ebp; ret 0_2_02604762
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_02604791 push esi; ret 0_2_02604792
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_0260DB84 pushfd ; ret 0_2_0260DB89
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_06A942D9 push ebx; ret 0_2_06A942DA
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 0_2_06A94E63 push es; ret 0_2_06A94E64
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004000D8 push es; iretd 9_2_004000D9
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0040008C push es; iretd 9_2_0040008D
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004542E6 push ecx; ret 9_2_004542F9
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0045B4FD push esi; ret 9_2_0045B506
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00432BD6 push ecx; ret 9_2_00432BE9
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00454C08 push eax; ret 9_2_00454C26
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Code function: 11_2_016BDB84 pushfd ; ret 11_2_016BDB89
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Code function: 11_2_075342D9 push ebx; ret 11_2_075342DA
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 15_2_0141DB84 pushfd ; ret 15_2_0141DB89
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_015ADB84 pushfd ; ret 24_2_015ADB89
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C477B push edi; ret 24_2_074C4783
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C272A push eax; ret 24_2_074C272B
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C2620 push eax; ret 24_2_074C2621
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C063E pushad ; ret 24_2_074C063F
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C4694 push edx; ret 24_2_074C4695
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C0575 push edx; ret 24_2_074C0576
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C3509 push 48074B9Dh; ret 24_2_074C3515
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C25DF push eax; ret 24_2_074C25E0
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C8112 push esi; ret 24_2_074C8114
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C81E4 push esi; ret 24_2_074C81EB
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C3181 push edx; ret 24_2_074C3182
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C7F66 push esi; ret 24_2_074C7F6D
Source: C:\ProgramData\AppUpdate\remcos.exe Code function: 24_2_074C9F9D push edx; ret 24_2_074C9F9E
Source: Payment Transfer Request Form.bat.exe Static PE information: section name: .text entropy: 7.664561171360738
Source: iKgKaogJ.exe.0.dr Static PE information: section name: .text entropy: 7.664561171360738
Source: remcos.exe.9.dr Static PE information: section name: .text entropy: 7.664561171360738
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, G8mARHMuZR8FXfnmCS.cs High entropy of concatenated method names: 'UhjH7mra5i', 'XY6HjYPDkV', 'PF6HMPTPVB', 'PnIHUKZk3P', 'YjHH0melV6', 'WrkHKCle1o', 'sOSHSxE2Ay', 'mn8HPByR6u', 'mnIHwZgHT8', 'BaqHEZJEmm'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, QwhKlmmQbOGs1vhvh6.cs High entropy of concatenated method names: 'CfliMWOhKg', 'w9UiUDG2tH', 'Ft2icQSo52', 'R2EiBvSMaI', 'JTLiDX0BLW', 'zu2iFCw2ph', 'cERiqd1hWw', 'UeLidOBibZ', 'IrdigGqCk0', 'kaciRRuIsY'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, T5nHuxt62bFgjEPISG.cs High entropy of concatenated method names: 'IjXpNwhKlm', 'sbOpZGs1vh', 'Vbbp3WaNw9', 'dYxpI3UyMs', 'YYdpH3XJCT', 'hVupuxxaXb', 'WDhyjeDnKZqFw5Nxgb', 'UTyMZYiwrtO9F1etxh', 'VFJppwL6hq', 'JrcpA7tFVX'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, ytAJUOq4HRtVIxw1hb.cs High entropy of concatenated method names: 'mHpCHhDhiK', 'eGAC9eOC0p', 'jXGCCsOrUl', 'SCLCL5Wpq2', 'GgZCnqdJY7', 'PV9ChNAlZb', 'Dispose', 'xEfsY6GYYd', 'LYYsiI6dlC', 'BYBsxtChcR'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, yCV0BKZVRAKIRjaruc.cs High entropy of concatenated method names: 'QIpAWe27sg', 'FuPAYYEfId', 'kNuAi7ECAD', 'LkaAx9juvZ', 'fadAONuKQG', 'jIgA28xoeJ', 'B0qANBD0D2', 'erZAZEhILB', 'oEjAv56Sng', 'QV5A3btiPj'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, FLqfnnFPJGKibtN3dh.cs High entropy of concatenated method names: 'Y4E9d0dE85', 'VTA9R2KG8I', 'F0Bsl0GkEh', 'zfnspfJt4p', 'JK99e7nLcY', 'VVo9jcK7ca', 'vJl9XsMxPy', 'WAR9MA0Ipw', 'AG69UpADh6', 'BAl9cfyrKE'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, SyMs7Qb8mMgfKRYd3X.cs High entropy of concatenated method names: 'iKjO69oqYs', 'AoxO1jWUWy', 'gQIxKUeM4B', 'CBFxSoAbnr', 'Vy1xPJ9uO0', 'PvpxwSGM8A', 'oADxET4bue', 'tHBxoSXc4W', 'O04xfCamDu', 'Xnax7yCGZW'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, Q2ZkdhRylKQKsTs4XL.cs High entropy of concatenated method names: 'yfxQxmyW92', 'idvQO32g4N', 'YW9Q2EEqqh', 'jfVQNkPo1b', 'OWcQCDmMOZ', 'K23QZvnAu5', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, Gj5cxnppjd4ARLaEyxk.cs High entropy of concatenated method names: 'LDuQRsSvVy', 'oogQzMmo48', 'OtuLlfO3iy', 'TPwLpbxbK9', 'PI9L5iiFdZ', 'iayLA22uod', 'ELfLthwy4n', 'YaTLWHbihm', 'PKbLYuxLOW', 'H2OLiZI623'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, sL1PZb5DGwDeE7Paan.cs High entropy of concatenated method names: 'AWgTY7PLH', 'g8Kaupa9I', 'Ftn87PLKd', 'P9L1tKRBn', 'vXt4g5tI0', 'gy9b6gOwH', 'bM7NAbVyCE1i2xhafS', 'TsIBUoHnMYi64TXIUB', 'VNxskRIHc', 'XpuQw4aMX'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, bjins3pl3hlyMvyiu1I.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'aEIQepphlQ', 'mU9Qj58lhs', 'y0NQXRapWc', 'KWiQMOTVDf', 'onLQUsal56', 'bjSQclOrDb', 'I1mQBG5w5x'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, xCTOVurxxaXbvrBFwx.cs High entropy of concatenated method names: 'vWd2W855I1', 'Wtr2iwe7yR', 'L4k2OKo9UO', 'zDx2NX7akf', 'wKN2ZZGGjH', 'Tc6ODvXyBP', 'IxtOFbROTd', 'zXuOq33Z0J', 'D3HOdSWvLP', 'rvMOglfgR9'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, DoUWI7geeo4gsMWcTC.cs High entropy of concatenated method names: 'siDCriUjgS', 'P8lC0SpHjg', 'V26CKfLBW6', 'eZtCSUnIK3', 'QnpCPvbNJ0', 'RnnCwjWTK4', 'rswCEIcFAU', 'CeZCoHDfxA', 'A8bCf0odHA', 'i2aC72Mua5'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, xWxrRF4bbWaNw9tYx3.cs High entropy of concatenated method names: 'HI8xabX1ct', 'kqsx8RyJ90', 'k5vxm6bWpF', 'GENx4DXHHV', 'nSmxHs7djY', 'qGuxuTgOBu', 'P1Xx9qYqsw', 'bfNxshgmBc', 'vIqxCjlZi4', 'PKixQCAWNR'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, u0rhBJzJNPIkt5N8Be.cs High entropy of concatenated method names: 'bhQQ8mDI5j', 'mDXQmiOJTZ', 'FykQ4ZLMc9', 'GpGQr6kNDA', 'lVlQ05eThQ', 'hOsQSW2MoQ', 'tjuQPremiu', 'SH7QhBykvY', 'v0pQJC1boc', 'hqBQyrL5Yg'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, k92S0QfWqHPDXLhQIB.cs High entropy of concatenated method names: 'VwrNJZ6G28', 'u7XNyFGXF2', 'CloNT2tfyQ', 'Yv7NaW5Z1u', 'J4FN6eXIDO', 'iZPN8qy1qo', 'KliN1072L4', 'iDyNmcr39k', 'mJUN4NhVk8', 'xB0NbeIVh9'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, E9y7JUBhAG4VZB3dwW.cs High entropy of concatenated method names: 'Bkh93isiBC', 'K7v9IoVLwH', 'ToString', 'Bqn9YwYoGF', 'ypR9i4n1EN', 'k7P9xJHMQh', 'Q2D9OfBov0', 'gOl92fuDC7', 'X6v9NTI1af', 'wYo9ZYosOt'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, lVPoTvXllLOLRpP1BJ.cs High entropy of concatenated method names: 'ur8VmQT5b6', 'xDMV4jQbBw', 'ISRVrfb1Ee', 'RXgV0pnskO', 'IgfVSierG5', 'EyJVPcKybC', 'OSZVE3TGQE', 'h4cVoZBpc0', 'pJEV7Dsa7A', 'XRlVesdraM'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, l1OxmNEibSWnLqsK2U.cs High entropy of concatenated method names: 'W92NYxpbaN', 'mi3NxqIRvs', 'j7UN2buWJe', 'Xc02RaN2jW', 'yv52zGpfA0', 'PgQNlfnKJW', 'YDcNpLDSr0', 'akAN5jJ4qy', 'sagNA3aAM4', 'eOHNtJvDkb'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, vEj6LbpAJ87hLqXMKwF.cs High entropy of concatenated method names: 'tg6LRpQrDw', 'fc8Lznk3Xi', 'JaDklfHF73', 'BBHtsqdvXsCQ54Nonku', 'UhFyVOdnpJ4W0UGlmxa', 'NkHtCvdzTMPkXm4X1jE'
Source: 0.2.Payment Transfer Request Form.bat.exe.3959298.0.raw.unpack, FrpWtYigKb7lvufHNE.cs High entropy of concatenated method names: 'Dispose', 'YtVpgIxw1h', 'kkp507IbCL', 'rvIwiJ6Hqw', 'FJEpRNITpX', 'nLTpzaktdc', 'ProcessDialogKey', 'sq15loUWI7', 'Oeo5p4gsMW', 'STC55X2Zkd'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, G8mARHMuZR8FXfnmCS.cs High entropy of concatenated method names: 'UhjH7mra5i', 'XY6HjYPDkV', 'PF6HMPTPVB', 'PnIHUKZk3P', 'YjHH0melV6', 'WrkHKCle1o', 'sOSHSxE2Ay', 'mn8HPByR6u', 'mnIHwZgHT8', 'BaqHEZJEmm'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, QwhKlmmQbOGs1vhvh6.cs High entropy of concatenated method names: 'CfliMWOhKg', 'w9UiUDG2tH', 'Ft2icQSo52', 'R2EiBvSMaI', 'JTLiDX0BLW', 'zu2iFCw2ph', 'cERiqd1hWw', 'UeLidOBibZ', 'IrdigGqCk0', 'kaciRRuIsY'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, T5nHuxt62bFgjEPISG.cs High entropy of concatenated method names: 'IjXpNwhKlm', 'sbOpZGs1vh', 'Vbbp3WaNw9', 'dYxpI3UyMs', 'YYdpH3XJCT', 'hVupuxxaXb', 'WDhyjeDnKZqFw5Nxgb', 'UTyMZYiwrtO9F1etxh', 'VFJppwL6hq', 'JrcpA7tFVX'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, ytAJUOq4HRtVIxw1hb.cs High entropy of concatenated method names: 'mHpCHhDhiK', 'eGAC9eOC0p', 'jXGCCsOrUl', 'SCLCL5Wpq2', 'GgZCnqdJY7', 'PV9ChNAlZb', 'Dispose', 'xEfsY6GYYd', 'LYYsiI6dlC', 'BYBsxtChcR'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, yCV0BKZVRAKIRjaruc.cs High entropy of concatenated method names: 'QIpAWe27sg', 'FuPAYYEfId', 'kNuAi7ECAD', 'LkaAx9juvZ', 'fadAONuKQG', 'jIgA28xoeJ', 'B0qANBD0D2', 'erZAZEhILB', 'oEjAv56Sng', 'QV5A3btiPj'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, FLqfnnFPJGKibtN3dh.cs High entropy of concatenated method names: 'Y4E9d0dE85', 'VTA9R2KG8I', 'F0Bsl0GkEh', 'zfnspfJt4p', 'JK99e7nLcY', 'VVo9jcK7ca', 'vJl9XsMxPy', 'WAR9MA0Ipw', 'AG69UpADh6', 'BAl9cfyrKE'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, SyMs7Qb8mMgfKRYd3X.cs High entropy of concatenated method names: 'iKjO69oqYs', 'AoxO1jWUWy', 'gQIxKUeM4B', 'CBFxSoAbnr', 'Vy1xPJ9uO0', 'PvpxwSGM8A', 'oADxET4bue', 'tHBxoSXc4W', 'O04xfCamDu', 'Xnax7yCGZW'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, Q2ZkdhRylKQKsTs4XL.cs High entropy of concatenated method names: 'yfxQxmyW92', 'idvQO32g4N', 'YW9Q2EEqqh', 'jfVQNkPo1b', 'OWcQCDmMOZ', 'K23QZvnAu5', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, Gj5cxnppjd4ARLaEyxk.cs High entropy of concatenated method names: 'LDuQRsSvVy', 'oogQzMmo48', 'OtuLlfO3iy', 'TPwLpbxbK9', 'PI9L5iiFdZ', 'iayLA22uod', 'ELfLthwy4n', 'YaTLWHbihm', 'PKbLYuxLOW', 'H2OLiZI623'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, sL1PZb5DGwDeE7Paan.cs High entropy of concatenated method names: 'AWgTY7PLH', 'g8Kaupa9I', 'Ftn87PLKd', 'P9L1tKRBn', 'vXt4g5tI0', 'gy9b6gOwH', 'bM7NAbVyCE1i2xhafS', 'TsIBUoHnMYi64TXIUB', 'VNxskRIHc', 'XpuQw4aMX'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, bjins3pl3hlyMvyiu1I.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'aEIQepphlQ', 'mU9Qj58lhs', 'y0NQXRapWc', 'KWiQMOTVDf', 'onLQUsal56', 'bjSQclOrDb', 'I1mQBG5w5x'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, xCTOVurxxaXbvrBFwx.cs High entropy of concatenated method names: 'vWd2W855I1', 'Wtr2iwe7yR', 'L4k2OKo9UO', 'zDx2NX7akf', 'wKN2ZZGGjH', 'Tc6ODvXyBP', 'IxtOFbROTd', 'zXuOq33Z0J', 'D3HOdSWvLP', 'rvMOglfgR9'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, DoUWI7geeo4gsMWcTC.cs High entropy of concatenated method names: 'siDCriUjgS', 'P8lC0SpHjg', 'V26CKfLBW6', 'eZtCSUnIK3', 'QnpCPvbNJ0', 'RnnCwjWTK4', 'rswCEIcFAU', 'CeZCoHDfxA', 'A8bCf0odHA', 'i2aC72Mua5'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, xWxrRF4bbWaNw9tYx3.cs High entropy of concatenated method names: 'HI8xabX1ct', 'kqsx8RyJ90', 'k5vxm6bWpF', 'GENx4DXHHV', 'nSmxHs7djY', 'qGuxuTgOBu', 'P1Xx9qYqsw', 'bfNxshgmBc', 'vIqxCjlZi4', 'PKixQCAWNR'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, u0rhBJzJNPIkt5N8Be.cs High entropy of concatenated method names: 'bhQQ8mDI5j', 'mDXQmiOJTZ', 'FykQ4ZLMc9', 'GpGQr6kNDA', 'lVlQ05eThQ', 'hOsQSW2MoQ', 'tjuQPremiu', 'SH7QhBykvY', 'v0pQJC1boc', 'hqBQyrL5Yg'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, k92S0QfWqHPDXLhQIB.cs High entropy of concatenated method names: 'VwrNJZ6G28', 'u7XNyFGXF2', 'CloNT2tfyQ', 'Yv7NaW5Z1u', 'J4FN6eXIDO', 'iZPN8qy1qo', 'KliN1072L4', 'iDyNmcr39k', 'mJUN4NhVk8', 'xB0NbeIVh9'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, E9y7JUBhAG4VZB3dwW.cs High entropy of concatenated method names: 'Bkh93isiBC', 'K7v9IoVLwH', 'ToString', 'Bqn9YwYoGF', 'ypR9i4n1EN', 'k7P9xJHMQh', 'Q2D9OfBov0', 'gOl92fuDC7', 'X6v9NTI1af', 'wYo9ZYosOt'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, lVPoTvXllLOLRpP1BJ.cs High entropy of concatenated method names: 'ur8VmQT5b6', 'xDMV4jQbBw', 'ISRVrfb1Ee', 'RXgV0pnskO', 'IgfVSierG5', 'EyJVPcKybC', 'OSZVE3TGQE', 'h4cVoZBpc0', 'pJEV7Dsa7A', 'XRlVesdraM'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, l1OxmNEibSWnLqsK2U.cs High entropy of concatenated method names: 'W92NYxpbaN', 'mi3NxqIRvs', 'j7UN2buWJe', 'Xc02RaN2jW', 'yv52zGpfA0', 'PgQNlfnKJW', 'YDcNpLDSr0', 'akAN5jJ4qy', 'sagNA3aAM4', 'eOHNtJvDkb'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, vEj6LbpAJ87hLqXMKwF.cs High entropy of concatenated method names: 'tg6LRpQrDw', 'fc8Lznk3Xi', 'JaDklfHF73', 'BBHtsqdvXsCQ54Nonku', 'UhFyVOdnpJ4W0UGlmxa', 'NkHtCvdzTMPkXm4X1jE'
Source: 0.2.Payment Transfer Request Form.bat.exe.6e30000.4.raw.unpack, FrpWtYigKb7lvufHNE.cs High entropy of concatenated method names: 'Dispose', 'YtVpgIxw1h', 'kkp507IbCL', 'rvIwiJ6Hqw', 'FJEpRNITpX', 'nLTpzaktdc', 'ProcessDialogKey', 'sq15loUWI7', 'Oeo5p4gsMW', 'STC55X2Zkd'
Contains functionality to download and launch executables
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004063C6 ShellExecuteW,URLDownloadToFileW, 9_2_004063C6
Drops PE files
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe File created: C:\ProgramData\AppUpdate\remcos.exe Jump to dropped file
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe File created: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe File created: C:\ProgramData\AppUpdate\remcos.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmp854C.tmp"
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00418A00 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle, 9_2_00418A00
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AppUpdate Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AppUpdate Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run AppUpdate Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run AppUpdate Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0041A8DA LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 9_2_0041A8DA
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AppUpdate\remcos.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Payment Transfer Request Form.bat.exe PID: 4072, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: iKgKaogJ.exe PID: 7508, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 7704, type: MEMORYSTR
Delayed program exit found
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0040E18D Sleep,ExitProcess, 9_2_0040E18D
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Memory allocated: 2560000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Memory allocated: 27D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Memory allocated: 2560000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Memory allocated: 7720000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Memory allocated: 8720000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Memory allocated: 88D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Memory allocated: 98D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Memory allocated: 1330000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Memory allocated: 3080000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Memory allocated: 2E80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Memory allocated: 7A80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Memory allocated: 8A80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Memory allocated: 8C20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Memory allocated: 9C20000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 1060000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 2DA0000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 4DA0000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 78B0000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 88B0000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 8A50000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 9A50000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 15A0000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 3140000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 2F60000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 7B10000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 8B10000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 8CB0000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 9CB0000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 2D30000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 2EC0000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 4EC0000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 7960000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 8960000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 8B00000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 9B00000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 1210000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 3080000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 1240000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 7930000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 8930000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 8AC0000 memory reserve | memory write watch
Source: C:\ProgramData\AppUpdate\remcos.exe Memory allocated: 9AC0000 memory reserve | memory write watch
Contains functionality to enumerate running services
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle, 9_2_004186FE
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\AppUpdate\remcos.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AppUpdate\remcos.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AppUpdate\remcos.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AppUpdate\remcos.exe Thread delayed: delay time: 922337203685477
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5777 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7007 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 355 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5690
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6346
Source: C:\ProgramData\AppUpdate\remcos.exe Window / User API: threadDelayed 9765
Found evaded block containing many API calls
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Evaded block: after key decision
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Evaded block: after key decision
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe API coverage: 5.2 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe TID: 5236 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7248 Thread sleep count: 5777 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7412 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7256 Thread sleep count: 132 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7356 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7424 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7372 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe TID: 7544 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\ProgramData\AppUpdate\remcos.exe TID: 7720 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8032 Thread sleep count: 5690 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3112 Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8016 Thread sleep count: 180 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8132 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8176 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8124 Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\AppUpdate\remcos.exe TID: 8184 Thread sleep count: 229 > 30
Source: C:\ProgramData\AppUpdate\remcos.exe TID: 8184 Thread sleep time: -687000s >= -30000s
Source: C:\ProgramData\AppUpdate\remcos.exe TID: 8184 Thread sleep count: 9765 > 30
Source: C:\ProgramData\AppUpdate\remcos.exe TID: 8184 Thread sleep time: -29295000s >= -30000s
Source: C:\ProgramData\AppUpdate\remcos.exe TID: 1072 Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\AppUpdate\remcos.exe TID: 7368 Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\AppUpdate\remcos.exe TID: 5336 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0041A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, 9_2_0041A01B
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0040B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, 9_2_0040B28E
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0040838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, 9_2_0040838E
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004087A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, 9_2_004087A0
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00407848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, 9_2_00407848
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004068CD FindFirstFileW,FindNextFileW, 9_2_004068CD
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0044BA59 FindFirstFileExA, 9_2_0044BA59
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0040AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, 9_2_0040AA71
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00417AAB FindFirstFileW,FindNextFileW,FindNextFileW, 9_2_00417AAB
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0040AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, 9_2_0040AC78
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00406D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW, 9_2_00406D28
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\AppUpdate\remcos.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AppUpdate\remcos.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AppUpdate\remcos.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AppUpdate\remcos.exe Thread delayed: delay time: 922337203685477
Source: remcos.exe, 00000021.00000002.1773191816.0000000007320000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-
Source: remcos.exe, 00000017.00000002.3782308386.00000000014FA000.00000004.00000020.00020000.00000000.sdmp, remcos.exe, 00000017.00000002.3782308386.0000000001560000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Payment Transfer Request Form.bat.exe, 00000000.00000002.1429762645.0000000007520000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}~
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004327AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_004327AE
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0041A8DA LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 9_2_0041A8DA
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004407B5 mov eax, dword ptr fs:[00000030h] 9_2_004407B5
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00410763 SetLastError,GetNativeSystemInfo,SetLastError,GetProcessHeap,HeapAlloc,SetLastError, 9_2_00410763
Enables debug privileges
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\ProgramData\AppUpdate\remcos.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004327AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_004327AE
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004328FC SetUnhandledExceptionFilter, 9_2_004328FC
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004398AC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_004398AC
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_00432D5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 9_2_00432D5C
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe"
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKgKaogJ.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKgKaogJ.exe"
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe" Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKgKaogJ.exe" Jump to behavior
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKgKaogJ.exe"
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Memory written: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\ProgramData\AppUpdate\remcos.exe Memory written: C:\ProgramData\AppUpdate\remcos.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\AppUpdate\remcos.exe Memory written: C:\ProgramData\AppUpdate\remcos.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\AppUpdate\remcos.exe Memory written: C:\ProgramData\AppUpdate\remcos.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\AppUpdate\remcos.exe Memory written: C:\ProgramData\AppUpdate\remcos.exe base: 400000 value starts with: 4D5A
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe 9_2_00410B5C
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004175E1 mouse_event, 9_2_004175E1
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe" Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKgKaogJ.exe" Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmp854C.tmp" Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe "C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe" Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\install.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\AppUpdate\remcos.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\ProgramData\AppUpdate\remcos.exe C:\ProgramData\AppUpdate\remcos.exe
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKgKaogJ.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmpAC9A.tmp"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmpCD42.tmp"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmpED6C.tmp"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKgKaogJ" /XML "C:\Users\user\AppData\Local\Temp\tmpCDB.tmp"
Source: C:\ProgramData\AppUpdate\remcos.exe Process created: C:\ProgramData\AppUpdate\remcos.exe "C:\ProgramData\AppUpdate\remcos.exe"
Source: remcos.exe, 00000017.00000002.3782308386.000000000151F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: remcos.exe, 00000017.00000002.3782308386.000000000151F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerj
Source: remcos.exe, 00000017.00000002.3782308386.000000000151F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manager5
Source: remcos.exe, 00000017.00000002.3782308386.000000000151F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managert
Source: remcos.exe, 00000017.00000002.3782308386.000000000151F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manager`
Source: remcos.exe, 00000017.00000002.3782308386.0000000001540000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: |Program Manager|
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004329DA cpuid 9_2_004329DA
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: EnumSystemLocalesW, 9_2_0044F17B
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: EnumSystemLocalesW, 9_2_0044F130
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: EnumSystemLocalesW, 9_2_0044F216
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 9_2_0044F2A3
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: GetLocaleInfoA, 9_2_0040E2BB
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: GetLocaleInfoW, 9_2_0044F4F3
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 9_2_0044F61C
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: GetLocaleInfoW, 9_2_0044F723
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 9_2_0044F7F0
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: EnumSystemLocalesW, 9_2_00445914
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: GetLocaleInfoW, 9_2_00445E1C
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 9_2_0044EEB8
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Queries volume information: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Queries volume information: C:\Users\user\AppData\Roaming\iKgKaogJ.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKgKaogJ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\ProgramData\AppUpdate\remcos.exe VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\ProgramData\AppUpdate\remcos.exe VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\ProgramData\AppUpdate\remcos.exe VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\ProgramData\AppUpdate\remcos.exe VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\ProgramData\AppUpdate\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_0040A0B0 GetLocalTime,wsprintfW, 9_2_0040A0B0
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004195F8 GetUserNameW, 9_2_004195F8
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: 9_2_004466BF _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free, 9_2_004466BF
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Remcos RAT
Source: Yara match File source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000024.00000002.1736773927.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.1656887776.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.3782308386.00000000014FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1405698672.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1407344012.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.1574639451.000000000117A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1417981546.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Payment Transfer Request Form.bat.exe PID: 4072, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Payment Transfer Request Form.bat.exe PID: 7380, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 8156, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 2508, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 3248, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 7388, type: MEMORYSTR
Contains functionality to steal Chrome passwords or cookies
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data 9_2_0040A953
Contains functionality to steal Firefox passwords or cookies
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\ 9_2_0040AA71
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: \key3.db 9_2_0040AA71

Remote Access Functionality
barindex
Detected Remcos RAT
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Mutex created: \Sessions\1\BaseNamedObjects\Rmc-VCJ8ZS Jump to behavior
Source: C:\ProgramData\AppUpdate\remcos.exe Mutex created: \Sessions\1\BaseNamedObjects\Rmc-VCJ8ZS
Source: C:\ProgramData\AppUpdate\remcos.exe Mutex created: \Sessions\1\BaseNamedObjects\Rmc-VCJ8ZS
Source: C:\ProgramData\AppUpdate\remcos.exe Mutex created: \Sessions\1\BaseNamedObjects\Rmc-VCJ8ZS
Source: C:\ProgramData\AppUpdate\remcos.exe Mutex created: \Sessions\1\BaseNamedObjects\Rmc-VCJ8ZS
Yara detected Remcos RAT
Source: Yara match File source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Payment Transfer Request Form.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.434efe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment Transfer Request Form.bat.exe.42d99c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000024.00000002.1736773927.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.1656887776.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.3782308386.00000000014FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1405698672.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1407344012.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.1574639451.000000000117A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1417981546.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Payment Transfer Request Form.bat.exe PID: 4072, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Payment Transfer Request Form.bat.exe PID: 7380, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 8156, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 2508, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 3248, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 7388, type: MEMORYSTR
Contains functionality to launch a control a shell (cmd.exe)
Source: C:\Users\user\Desktop\Payment Transfer Request Form.bat.exe Code function: cmd.exe 9_2_0040567A
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1561752 Sample: Payment Transfer Request Fo... Startdate: 24/11/2024 Architecture: WINDOWS Score: 100 98 geoplugin.net 2->98 104 Suricata IDS alerts for network traffic 2->104 106 Found malware configuration 2->106 108 Malicious sample detected (through community Yara rule) 2->108 110 22 other signatures 2->110 12 Payment Transfer Request Form.bat.exe 7 2->12         started        16 remcos.exe 2->16         started        18 remcos.exe 2->18         started        20 2 other processes 2->20 signatures3 process4 file5 86 C:\Users\user\AppData\Roaming\iKgKaogJ.exe, PE32 12->86 dropped 88 C:\Users\...\iKgKaogJ.exe:Zone.Identifier, ASCII 12->88 dropped 90 C:\Users\user\AppData\Local\...\tmp854C.tmp, XML 12->90 dropped 92 Payment Transfer R...st Form.bat.exe.log, ASCII 12->92 dropped 128 Adds a directory exclusion to Windows Defender 12->128 130 Injects a PE file into a foreign processes 12->130 22 Payment Transfer Request Form.bat.exe 5 5 12->22         started        26 powershell.exe 23 12->26         started        28 powershell.exe 23 12->28         started        30 schtasks.exe 1 12->30         started        32 remcos.exe 16->32         started        34 schtasks.exe 16->34         started        36 remcos.exe 18->36         started        38 schtasks.exe 18->38         started        132 Multi AV Scanner detection for dropped file 20->132 134 Machine Learning detection for dropped file 20->134 40 2 other processes 20->40 signatures6 process7 file8 80 C:\ProgramData\AppUpdate\remcos.exe, PE32 22->80 dropped 82 C:\Users\user\AppData\Local\...\install.vbs, data 22->82 dropped 84 C:\ProgramData\...\remcos.exe:Zone.Identifier, ASCII 22->84 dropped 112 Detected Remcos RAT 22->112 42 wscript.exe 1 22->42         started        114 Loading BitLocker PowerShell Module 26->114 45 conhost.exe 26->45         started        47 conhost.exe 28->47         started        49 conhost.exe 30->49         started        51 conhost.exe 34->51         started        53 conhost.exe 38->53         started        55 conhost.exe 40->55         started        signatures9 process10 signatures11 116 Windows Scripting host queries suspicious COM object (likely to drop second stage) 42->116 118 Suspicious execution chain found 42->118 57 cmd.exe 42->57         started        process12 process13 59 remcos.exe 57->59         started        62 conhost.exe 57->62         started        signatures14 120 Multi AV Scanner detection for dropped file 59->120 122 Machine Learning detection for dropped file 59->122 124 Adds a directory exclusion to Windows Defender 59->124 126 Injects a PE file into a foreign processes 59->126 64 remcos.exe 59->64         started        68 powershell.exe 59->68         started        70 powershell.exe 59->70         started        72 schtasks.exe 59->72         started        process15 dnsIp16 94 212.162.149.226, 49754, 9285 UNREAL-SERVERSUS Netherlands 64->94 96 geoplugin.net 178.237.33.50, 49761, 80 ATOM86-ASATOM86NL Netherlands 64->96 100 Detected Remcos RAT 64->100 102 Loading BitLocker PowerShell Module 68->102 74 conhost.exe 68->74         started        76 conhost.exe 70->76         started        78 conhost.exe 72->78         started        signatures17 process18
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
178.237.33.50
 geoplugin.net Netherlands
8455 ATOM86-ASATOM86NL false
212.162.149.226
 unknown Netherlands
64236 UNREAL-SERVERSUS true

Contacted Domains

Name IP Active
geoplugin.net 178.237.33.50 true
s-part-0035.t-0009.t-msedge.net 13.107.246.63 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://geoplugin.net/json.gp false
    		high
    149.226 true
    • Avira URL Cloud: safe
    		 unknown