Edit tour

Windows Analysis Report
RMBUDGSD23ED PO.exe

Overview

General Information

Sample name:	RMBUDGSD23ED PO.exe
Analysis ID:	1634921
MD5:	f7964183932cd8e6597b4ac4eb50a318
SHA1:	f7faa376867e7d38b53c2bc0eb2d5eb80877966a
SHA256:	9b282e72835c39f458f208a4ad3d8304d2c44f559a9f3e3ee261498141a3b180
Tags:	exeRATRemcosRATuser-abuse_ch
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to bypass UAC (CMSTPLUA)

Detected Remcos RAT

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Injects a PE file into a foreign processes

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect virtual machines (STR)

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

RMBUDGSD23ED PO.exe (PID: 7288 cmdline: "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe" MD5: F7964183932CD8E6597B4AC4EB50A318)

powershell.exe (PID: 7400 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7456 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vXchjQznSJi.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7944 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

conhost.exe (PID: 7564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7544 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpD67E.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RMBUDGSD23ED PO.exe (PID: 7704 cmdline: "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe" MD5: F7964183932CD8E6597B4AC4EB50A318)

vXchjQznSJi.exe (PID: 7760 cmdline: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe MD5: F7964183932CD8E6597B4AC4EB50A318)

schtasks.exe (PID: 8040 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpE95A.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vXchjQznSJi.exe (PID: 8092 cmdline: "C:\Users\user\AppData\Roaming\vXchjQznSJi.exe" MD5: F7964183932CD8E6597B4AC4EB50A318)

svchost.exe (PID: 7836 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["45.144.212.83:1987:0"], "Assigned name": "TOKEN", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-6L0UG9", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": ""}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\remcos\logs.dat	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.1235674948.0000000001027000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000007.00000002.3613822926.00000000014AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000007.00000002.3614615875.0000000002FFF000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000007.00000002.3613822926.0000000001477000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6d758:$a1: Remcos restarted by watchdog! 0x6dda8:$a3: %02i:%02i:%02i:%03i
0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x679f4:$str_a1: C:\Windows\System32\cmd.exe 0x67970:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67970:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67e70:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x684d8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x67a64:$str_b2: Executing file: 0x6889c:$str_b3: GetDirectListeningPort 0x682c8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x68448:$str_b7: \update.vbs 0x67a8c:$str_b9: Downloaded file: 0x67a78:$str_b10: Downloading file: 0x67b1c:$str_b12: Failed to upload file: 0x68864:$str_b13: StartForward 0x68884:$str_b14: StopForward 0x683a0:$str_b15: fso.DeleteFile " 0x68334:$str_b16: On Error Resume Next 0x683d0:$str_b17: fso.DeleteFolder " 0x67b0c:$str_b18: Uploaded file: 0x67acc:$str_b19: Unable to delete: 0x68368:$str_b20: while fso.FileExists(" 0x67fa9:$str_c0: [Firefox StoredLogins not found]
0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x678e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x67878:$s1: CoGetObject 0x6788c:$s1: CoGetObject 0x678a8:$s1: CoGetObject 0x71656:$s1: CoGetObject 0x67838:$s2: Elevation:Administrator!new:
00000008.00000002.1259665953.0000000005037000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000008.00000002.1259665953.0000000005037000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000008.00000002.1259665953.0000000005037000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000008.00000002.1259665953.0000000005037000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c808:$a1: Remcos restarted by watchdog! 0xe6228:$a1: Remcos restarted by watchdog! 0x15f868:$a1: Remcos restarted by watchdog! 0x6ce58:$a3: %02i:%02i:%02i:%03i 0xe6878:$a3: %02i:%02i:%02i:%03i 0x15feb8:$a3: %02i:%02i:%02i:%03i
00000000.00000002.1209600933.00000000047B5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000002.1209600933.00000000047B5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.1209600933.00000000047B5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.1209600933.00000000047B5000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c7f0:$a1: Remcos restarted by watchdog! 0xe6210:$a1: Remcos restarted by watchdog! 0x15f850:$a1: Remcos restarted by watchdog! 0x6ce40:$a3: %02i:%02i:%02i:%03i 0xe6860:$a3: %02i:%02i:%02i:%03i 0x15fea0:$a3: %02i:%02i:%02i:%03i
Process Memory Space: RMBUDGSD23ED PO.exe PID: 7288	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: RMBUDGSD23ED PO.exe PID: 7288	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: RMBUDGSD23ED PO.exe PID: 7288	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RMBUDGSD23ED PO.exe PID: 7288	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: RMBUDGSD23ED PO.exe PID: 7288	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xbb8b2:$a1: Remcos restarted by watchdog! 0xbbf07:$a3: %02i:%02i:%02i:%03i 0xbc344:$a3: %02i:%02i:%02i:%03i
Process Memory Space: RMBUDGSD23ED PO.exe PID: 7704	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: vXchjQznSJi.exe PID: 7760	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: vXchjQznSJi.exe PID: 7760	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: vXchjQznSJi.exe PID: 7760	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: vXchjQznSJi.exe PID: 7760	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: vXchjQznSJi.exe PID: 7760	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x57bbb:$a1: Remcos restarted by watchdog! 0x58210:$a3: %02i:%02i:%02i:%03i 0x5864d:$a3: %02i:%02i:%02i:%03i
Process Memory Space: vXchjQznSJi.exe PID: 8092	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: vXchjQznSJi.exe PID: 8092	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: vXchjQznSJi.exe PID: 8092	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: vXchjQznSJi.exe PID: 8092	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xf31d:$a1: Remcos restarted by watchdog! 0xf972:$a3: %02i:%02i:%02i:%03i 0xfdaf:$a3: %02i:%02i:%02i:%03i
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.vXchjQznSJi.exe.5037ab0.4.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.2.vXchjQznSJi.exe.5037ab0.4.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
8.2.vXchjQznSJi.exe.5037ab0.4.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
8.2.vXchjQznSJi.exe.5037ab0.4.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6a358:$a1: Remcos restarted by watchdog! 0x6a9a8:$a3: %02i:%02i:%02i:%03i
8.2.vXchjQznSJi.exe.5037ab0.4.unpack	REMCOS_RAT_variants	unknown	unknown	0x645f4:$str_a1: C:\Windows\System32\cmd.exe 0x64570:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64570:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a70:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x650d8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64664:$str_b2: Executing file: 0x6549c:$str_b3: GetDirectListeningPort 0x64ec8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65048:$str_b7: \update.vbs 0x6468c:$str_b9: Downloaded file: 0x64678:$str_b10: Downloading file: 0x6471c:$str_b12: Failed to upload file: 0x65464:$str_b13: StartForward 0x65484:$str_b14: StopForward 0x64fa0:$str_b15: fso.DeleteFile " 0x64f34:$str_b16: On Error Resume Next 0x64fd0:$str_b17: fso.DeleteFolder " 0x6470c:$str_b18: Uploaded file: 0x646cc:$str_b19: Unable to delete: 0x64f68:$str_b20: while fso.FileExists(" 0x64ba9:$str_c0: [Firefox StoredLogins not found]
8.2.vXchjQznSJi.exe.5037ab0.4.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x644e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64478:$s1: CoGetObject 0x6448c:$s1: CoGetObject 0x644a8:$s1: CoGetObject 0x6e256:$s1: CoGetObject 0x64438:$s2: Elevation:Administrator!new:
13.2.vXchjQznSJi.exe.400000.0.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
13.2.vXchjQznSJi.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
13.2.vXchjQznSJi.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.vXchjQznSJi.exe.400000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6d758:$a1: Remcos restarted by watchdog! 0x6dda8:$a3: %02i:%02i:%02i:%03i
13.2.vXchjQznSJi.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x679f4:$str_a1: C:\Windows\System32\cmd.exe 0x67970:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67970:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67e70:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x684d8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x67a64:$str_b2: Executing file: 0x6889c:$str_b3: GetDirectListeningPort 0x682c8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x68448:$str_b7: \update.vbs 0x67a8c:$str_b9: Downloaded file: 0x67a78:$str_b10: Downloading file: 0x67b1c:$str_b12: Failed to upload file: 0x68864:$str_b13: StartForward 0x68884:$str_b14: StopForward 0x683a0:$str_b15: fso.DeleteFile " 0x68334:$str_b16: On Error Resume Next 0x683d0:$str_b17: fso.DeleteFolder " 0x67b0c:$str_b18: Uploaded file: 0x67acc:$str_b19: Unable to delete: 0x68368:$str_b20: while fso.FileExists(" 0x67fa9:$str_c0: [Firefox StoredLogins not found]
13.2.vXchjQznSJi.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x678e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x67878:$s1: CoGetObject 0x6788c:$s1: CoGetObject 0x678a8:$s1: CoGetObject 0x71656:$s1: CoGetObject 0x67838:$s2: Elevation:Administrator!new:
8.2.vXchjQznSJi.exe.50b14d0.5.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.2.vXchjQznSJi.exe.50b14d0.5.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
8.2.vXchjQznSJi.exe.50b14d0.5.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
8.2.vXchjQznSJi.exe.50b14d0.5.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6a358:$a1: Remcos restarted by watchdog! 0x6a9a8:$a3: %02i:%02i:%02i:%03i
8.2.vXchjQznSJi.exe.50b14d0.5.unpack	REMCOS_RAT_variants	unknown	unknown	0x645f4:$str_a1: C:\Windows\System32\cmd.exe 0x64570:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64570:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a70:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x650d8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64664:$str_b2: Executing file: 0x6549c:$str_b3: GetDirectListeningPort 0x64ec8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65048:$str_b7: \update.vbs 0x6468c:$str_b9: Downloaded file: 0x64678:$str_b10: Downloading file: 0x6471c:$str_b12: Failed to upload file: 0x65464:$str_b13: StartForward 0x65484:$str_b14: StopForward 0x64fa0:$str_b15: fso.DeleteFile " 0x64f34:$str_b16: On Error Resume Next 0x64fd0:$str_b17: fso.DeleteFolder " 0x6470c:$str_b18: Uploaded file: 0x646cc:$str_b19: Unable to delete: 0x64f68:$str_b20: while fso.FileExists(" 0x64ba9:$str_c0: [Firefox StoredLogins not found]
8.2.vXchjQznSJi.exe.50b14d0.5.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x644e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64478:$s1: CoGetObject 0x6448c:$s1: CoGetObject 0x644a8:$s1: CoGetObject 0x6e256:$s1: CoGetObject 0x64438:$s2: Elevation:Administrator!new:
0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6a358:$a1: Remcos restarted by watchdog! 0x6a9a8:$a3: %02i:%02i:%02i:%03i
0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack	REMCOS_RAT_variants	unknown	unknown	0x645f4:$str_a1: C:\Windows\System32\cmd.exe 0x64570:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64570:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a70:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x650d8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64664:$str_b2: Executing file: 0x6549c:$str_b3: GetDirectListeningPort 0x64ec8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65048:$str_b7: \update.vbs 0x6468c:$str_b9: Downloaded file: 0x64678:$str_b10: Downloading file: 0x6471c:$str_b12: Failed to upload file: 0x65464:$str_b13: StartForward 0x65484:$str_b14: StopForward 0x64fa0:$str_b15: fso.DeleteFile " 0x64f34:$str_b16: On Error Resume Next 0x64fd0:$str_b17: fso.DeleteFolder " 0x6470c:$str_b18: Uploaded file: 0x646cc:$str_b19: Unable to delete: 0x64f68:$str_b20: while fso.FileExists(" 0x64ba9:$str_c0: [Firefox StoredLogins not found]
0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x644e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64478:$s1: CoGetObject 0x6448c:$s1: CoGetObject 0x644a8:$s1: CoGetObject 0x6e256:$s1: CoGetObject 0x64438:$s2: Elevation:Administrator!new:
13.2.vXchjQznSJi.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
13.2.vXchjQznSJi.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
13.2.vXchjQznSJi.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.vXchjQznSJi.exe.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6bd58:$a1: Remcos restarted by watchdog! 0x6c3a8:$a3: %02i:%02i:%02i:%03i
13.2.vXchjQznSJi.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x65ff4:$str_a1: C:\Windows\System32\cmd.exe 0x65f70:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65f70:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66470:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66ad8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x66064:$str_b2: Executing file: 0x66e9c:$str_b3: GetDirectListeningPort 0x668c8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66a48:$str_b7: \update.vbs 0x6608c:$str_b9: Downloaded file: 0x66078:$str_b10: Downloading file: 0x6611c:$str_b12: Failed to upload file: 0x66e64:$str_b13: StartForward 0x66e84:$str_b14: StopForward 0x669a0:$str_b15: fso.DeleteFile " 0x66934:$str_b16: On Error Resume Next 0x669d0:$str_b17: fso.DeleteFolder " 0x6610c:$str_b18: Uploaded file: 0x660cc:$str_b19: Unable to delete: 0x66968:$str_b20: while fso.FileExists(" 0x665a9:$str_c0: [Firefox StoredLogins not found]
13.2.vXchjQznSJi.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65ee8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65e78:$s1: CoGetObject 0x65e8c:$s1: CoGetObject 0x65ea8:$s1: CoGetObject 0x6fc56:$s1: CoGetObject 0x65e38:$s2: Elevation:Administrator!new:
0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6a358:$a1: Remcos restarted by watchdog! 0x6a9a8:$a3: %02i:%02i:%02i:%03i
0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack	REMCOS_RAT_variants	unknown	unknown	0x645f4:$str_a1: C:\Windows\System32\cmd.exe 0x64570:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64570:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a70:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x650d8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64664:$str_b2: Executing file: 0x6549c:$str_b3: GetDirectListeningPort 0x64ec8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65048:$str_b7: \update.vbs 0x6468c:$str_b9: Downloaded file: 0x64678:$str_b10: Downloading file: 0x6471c:$str_b12: Failed to upload file: 0x65464:$str_b13: StartForward 0x65484:$str_b14: StopForward 0x64fa0:$str_b15: fso.DeleteFile " 0x64f34:$str_b16: On Error Resume Next 0x64fd0:$str_b17: fso.DeleteFolder " 0x6470c:$str_b18: Uploaded file: 0x646cc:$str_b19: Unable to delete: 0x64f68:$str_b20: while fso.FileExists(" 0x64ba9:$str_c0: [Firefox StoredLogins not found]
0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x644e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64478:$s1: CoGetObject 0x6448c:$s1: CoGetObject 0x644a8:$s1: CoGetObject 0x6e256:$s1: CoGetObject 0x64438:$s2: Elevation:Administrator!new:
8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6bd58:$a1: Remcos restarted by watchdog! 0xe5398:$a1: Remcos restarted by watchdog! 0x6c3a8:$a3: %02i:%02i:%02i:%03i 0xe59e8:$a3: %02i:%02i:%02i:%03i
8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65ee8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0xdf528:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65e78:$s1: CoGetObject 0x65e8c:$s1: CoGetObject 0x65ea8:$s1: CoGetObject 0x6fc56:$s1: CoGetObject 0xdf4b8:$s1: CoGetObject 0xdf4cc:$s1: CoGetObject 0xdf4e8:$s1: CoGetObject 0xe9296:$s1: CoGetObject 0x65e38:$s2: Elevation:Administrator!new: 0xdf478:$s2: Elevation:Administrator!new:
0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6bd58:$a1: Remcos restarted by watchdog! 0xe5398:$a1: Remcos restarted by watchdog! 0x6c3a8:$a3: %02i:%02i:%02i:%03i 0xe59e8:$a3: %02i:%02i:%02i:%03i
0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65ee8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0xdf528:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65e78:$s1: CoGetObject 0x65e8c:$s1: CoGetObject 0x65ea8:$s1: CoGetObject 0x6fc56:$s1: CoGetObject 0xdf4b8:$s1: CoGetObject 0xdf4cc:$s1: CoGetObject 0xdf4e8:$s1: CoGetObject 0xe9296:$s1: CoGetObject 0x65e38:$s2: Elevation:Administrator!new: 0xdf478:$s2: Elevation:Administrator!new:
0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6bd58:$a1: Remcos restarted by watchdog! 0xe5778:$a1: Remcos restarted by watchdog! 0x15edb8:$a1: Remcos restarted by watchdog! 0x6c3a8:$a3: %02i:%02i:%02i:%03i 0xe5dc8:$a3: %02i:%02i:%02i:%03i 0x15f408:$a3: %02i:%02i:%02i:%03i
0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65ee8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0xdf908:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x158f48:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65e78:$s1: CoGetObject 0x65e8c:$s1: CoGetObject 0x65ea8:$s1: CoGetObject 0x6fc56:$s1: CoGetObject 0xdf898:$s1: CoGetObject 0xdf8ac:$s1: CoGetObject 0xdf8c8:$s1: CoGetObject 0xe9676:$s1: CoGetObject 0x158ed8:$s1: CoGetObject 0x158eec:$s1: CoGetObject 0x158f08:$s1: CoGetObject 0x162cb6:$s1: CoGetObject 0x65e38:$s2: Elevation:Administrator!new: 0xdf858:$s2: Elevation:Administrator!new: 0x158e98:$s2: Elevation:Administrator!new:
8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6bd58:$a1: Remcos restarted by watchdog! 0xe5778:$a1: Remcos restarted by watchdog! 0x15edb8:$a1: Remcos restarted by watchdog! 0x6c3a8:$a3: %02i:%02i:%02i:%03i 0xe5dc8:$a3: %02i:%02i:%02i:%03i 0x15f408:$a3: %02i:%02i:%02i:%03i
8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65ee8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0xdf908:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x158f48:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65e78:$s1: CoGetObject 0x65e8c:$s1: CoGetObject 0x65ea8:$s1: CoGetObject 0x6fc56:$s1: CoGetObject 0xdf898:$s1: CoGetObject 0xdf8ac:$s1: CoGetObject 0xdf8c8:$s1: CoGetObject 0xe9676:$s1: CoGetObject 0x158ed8:$s1: CoGetObject 0x158eec:$s1: CoGetObject 0x158f08:$s1: CoGetObject 0x162cb6:$s1: CoGetObject 0x65e38:$s2: Elevation:Administrator!new: 0xdf858:$s2: Elevation:Administrator!new: 0x158e98:$s2: Elevation:Administrator!new:
Click to see the 51 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe", ParentImage: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe, ParentProcessId: 7288, ParentProcessName: RMBUDGSD23ED PO.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe", ProcessId: 7400, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpE95A.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpE95A.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe, ParentImage: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe, ParentProcessId: 7760, ParentProcessName: vXchjQznSJi.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpE95A.tmp", ProcessId: 8040, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpD67E.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpD67E.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe", ParentImage: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe, ParentProcessId: 7288, ParentProcessName: RMBUDGSD23ED PO.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpD67E.tmp", ProcessId: 7544, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe", ParentImage: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe, ParentProcessId: 7288, ParentProcessName: RMBUDGSD23ED PO.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe", ProcessId: 7400, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7836, ProcessName: svchost.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpD67E.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpD67E.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe", ParentImage: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe, ParentProcessId: 7288, ParentProcessName: RMBUDGSD23ED PO.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpD67E.tmp", ProcessId: 7544, ProcessName: schtasks.exe

Stealing of Sensitive Information

Sigma detected: Remcos

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe, ProcessId: 7704, TargetFilename: C:\ProgramData\remcos\logs.dat

Suricata Signatures

ET MALWARE Remcos 3.x Unencrypted Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T06:46:26.392741+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49717	45.144.212.83	1987	TCP

ET MALWARE Remcos 3.x Unencrypted Server Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T06:46:27.043735+0100	2032777	1	Malware Command and Control Activity Detected	45.144.212.83	1987	192.168.2.4	49717	TCP
2025-03-11T06:48:45.437592+0100	2032777	1	Malware Command and Control Activity Detected	45.144.212.83	1987	192.168.2.4	49717	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T06:46:28.410440+0100	2803304	3	Unknown Traffic	192.168.2.4	49718	178.237.33.50	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RMBUDGSD23ED PO.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Avira: detection malicious, Label: HEUR/AGEN.1307430

Found malware configuration

Source: 00000008.00000002.1259665953.0000000005037000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": ["45.144.212.83:1987:0"], "Assigned name": "TOKEN", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-6L0UG9", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": ""}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: RMBUDGSD23ED PO.exe	Virustotal: Detection: 54%			Perma Link
Source: RMBUDGSD23ED PO.exe	ReversingLabs: Detection: 39%

Yara detected Remcos RAT

Source: Yara match	File source: 8.2.vXchjQznSJi.exe.5037ab0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vXchjQznSJi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.50b14d0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vXchjQznSJi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1235674948.0000000001027000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3613822926.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3614615875.0000000002FFF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3613822926.0000000001477000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1259665953.0000000005037000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1209600933.00000000047B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RMBUDGSD23ED PO.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RMBUDGSD23ED PO.exe PID: 7704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vXchjQznSJi.exe PID: 7760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vXchjQznSJi.exe PID: 8092, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_00433B64 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

13_2_00433B64

Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1209600933.00000000047B5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_0f756245-d

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 8.2.vXchjQznSJi.exe.5037ab0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vXchjQznSJi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.50b14d0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vXchjQznSJi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1259665953.0000000005037000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1209600933.00000000047B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RMBUDGSD23ED PO.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vXchjQznSJi.exe PID: 7760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vXchjQznSJi.exe PID: 8092, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_00406ABC _wcslen,CoGetObject,

13_2_00406ABC

Source: RMBUDGSD23ED PO.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RMBUDGSD23ED PO.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_004090DC __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	13_2_004090DC
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0040B6B5 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	13_2_0040B6B5
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0041C7E5 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	13_2_0041C7E5
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0040B8BA FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	13_2_0040B8BA
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0044E989 FindFirstFileExA,	13_2_0044E989
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00408CDE __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	13_2_00408CDE
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00419CEE FindFirstFileW,FindNextFileW,FindNextFileW,	13_2_00419CEE
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00407EDD __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	13_2_00407EDD
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00406F13 FindFirstFileW,FindNextFileW,	13_2_00406F13

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_00407357 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

13_2_00407357

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49717 -> 45.144.212.83:1987
Source: Network traffic	Suricata IDS: 2032777 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Server Response : 45.144.212.83:1987 -> 192.168.2.4:49717

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 45.144.212.83

Source: global traffic

TCP traffic: 192.168.2.4:49717 -> 45.144.212.83:1987

Source: global traffic

TCP traffic: 192.168.2.4:53968 -> 162.159.36.2:53

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: HPC-MVM-ASHU HPC-MVM-ASHU

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49718 -> 178.237.33.50:80

Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.83
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.83
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.83
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.83
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.83
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.83
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.83
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.83
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.83
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.83
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.83
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.83
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.83
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.83
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_004062E2 ShellExecuteW,URLDownloadToFileW,

13_2_004062E2

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: geoplugin.net
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 56.163.245.4.in-addr.arpa

Source: svchost.exe, 00000009.00000002.2869106392.000001F7FBA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000009.00000003.1214097342.000001F7FB938000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000009.00000003.1214097342.000001F7FB938000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000009.00000003.1214097342.000001F7FB938000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000009.00000003.1214097342.000001F7FB96D000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3614341226.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp, vXchjQznSJi.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1209600933.00000000047B5000.00000004.00000800.00020000.00000000.sdmp, vXchjQznSJi.exe, 00000008.00000002.1259665953.0000000005037000.00000004.00000800.00020000.00000000.sdmp, vXchjQznSJi.exe, 0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gplY
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpu
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1208234588.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, vXchjQznSJi.exe, 00000008.00000002.1256557607.0000000003391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1215357293.0000000009052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: svchost.exe, 00000009.00000003.1214097342.000001F7FB9E2000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000009.00000003.1214097342.000001F7FB9E2000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000009.00000003.1214097342.000001F7FB9E2000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: vXchjQznSJi.exe, 00000008.00000002.1255441842.00000000016CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wdcp.microsf?W

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_00409D1E SetWindowsHookExA 0000000D,00409D0A,00000000

13_2_00409D1E

Installs a global keyboard hook

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_0040B158 OpenClipboard,GetClipboardData,CloseClipboard,

13_2_0040B158

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_0041696E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

13_2_0041696E

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_0040B158 OpenClipboard,GetClipboardData,CloseClipboard,

13_2_0040B158

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_00409E4A GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

13_2_00409E4A

Source: Yara match	File source: 8.2.vXchjQznSJi.exe.5037ab0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vXchjQznSJi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.50b14d0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vXchjQznSJi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1259665953.0000000005037000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1209600933.00000000047B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RMBUDGSD23ED PO.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vXchjQznSJi.exe PID: 7760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vXchjQznSJi.exe PID: 8092, type: MEMORYSTR

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 8.2.vXchjQznSJi.exe.5037ab0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vXchjQznSJi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.50b14d0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vXchjQznSJi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1235674948.0000000001027000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3613822926.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3614615875.0000000002FFF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3613822926.0000000001477000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1259665953.0000000005037000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1209600933.00000000047B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RMBUDGSD23ED PO.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RMBUDGSD23ED PO.exe PID: 7704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vXchjQznSJi.exe PID: 7760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vXchjQznSJi.exe PID: 8092, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_0041CF2D SystemParametersInfoW,

13_2_0041CF2D

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.vXchjQznSJi.exe.5037ab0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.vXchjQznSJi.exe.5037ab0.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.vXchjQznSJi.exe.5037ab0.4.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.vXchjQznSJi.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 13.2.vXchjQznSJi.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 13.2.vXchjQznSJi.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.vXchjQznSJi.exe.50b14d0.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.vXchjQznSJi.exe.50b14d0.5.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.vXchjQznSJi.exe.50b14d0.5.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.vXchjQznSJi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 13.2.vXchjQznSJi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 13.2.vXchjQznSJi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000008.00000002.1259665953.0000000005037000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.1209600933.00000000047B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: RMBUDGSD23ED PO.exe PID: 7288, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: vXchjQznSJi.exe PID: 7760, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: vXchjQznSJi.exe PID: 8092, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_00416861 ExitWindowsEx,LoadLibraryA,GetProcAddress,

13_2_00416861

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D2348	0_2_010D2348
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D1DF3	0_2_010D1DF3
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D21DB	0_2_010D21DB
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D200D	0_2_010D200D
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D0929	0_2_010D0929
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D0975	0_2_010D0975
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D09B1	0_2_010D09B1
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D08AC	0_2_010D08AC
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D08FC	0_2_010D08FC
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D0B2D	0_2_010D0B2D
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D2B80	0_2_010D2B80
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D0BFC	0_2_010D0BFC
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D0A24	0_2_010D0A24
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D0A96	0_2_010D0A96
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D0AD0	0_2_010D0AD0
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D0D30	0_2_010D0D30
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D0DB0	0_2_010D0DB0
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D0DFD	0_2_010D0DFD
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D0C7C	0_2_010D0C7C
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D2C98	0_2_010D2C98
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D0E82	0_2_010D0E82
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D13A0	0_2_010D13A0
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D36A0	0_2_010D36A0
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D36B0	0_2_010D36B0
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D1B2F	0_2_010D1B2F
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D1B66	0_2_010D1B66
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D1B9B	0_2_010D1B9B
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D1A42	0_2_010D1A42
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D1AC2	0_2_010D1AC2
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D1C1A	0_2_010D1C1A
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_010D1CE8	0_2_010D1CE8
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_02A425D8	0_2_02A425D8
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_02A44668	0_2_02A44668
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_09024890	0_2_09024890
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_090248A0	0_2_090248A0
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_0902BDE0	0_2_0902BDE0
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_09024CD8	0_2_09024CD8
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_0902302A	0_2_0902302A
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_09023060	0_2_09023060
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_090255A1	0_2_090255A1
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_090255B0	0_2_090255B0
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_09023498	0_2_09023498
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01992348	8_2_01992348
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01991DF3	8_2_01991DF3
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_019921DB	8_2_019921DB
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_0199200D	8_2_0199200D
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_019909B1	8_2_019909B1
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01990929	8_2_01990929
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01990975	8_2_01990975
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_019908AC	8_2_019908AC
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_019908FC	8_2_019908FC
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01990BFC	8_2_01990BFC
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01990B2D	8_2_01990B2D
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01990A96	8_2_01990A96
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01990AD0	8_2_01990AD0
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01990A24	8_2_01990A24
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01990DB0	8_2_01990DB0
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01990DFD	8_2_01990DFD
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01990D30	8_2_01990D30
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01992C98	8_2_01992C98
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01992C88	8_2_01992C88
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01990C7C	8_2_01990C7C
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01990E82	8_2_01990E82
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_019913A0	8_2_019913A0
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_019936B0	8_2_019936B0
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_019936A0	8_2_019936A0
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01991B9B	8_2_01991B9B
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01991B2F	8_2_01991B2F
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01991B66	8_2_01991B66
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01991AC2	8_2_01991AC2
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01991A42	8_2_01991A42
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01991CE8	8_2_01991CE8
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_01991C1A	8_2_01991C1A
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_053C25D8	8_2_053C25D8
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_053C4668	8_2_053C4668
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_082C48A0	8_2_082C48A0
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_082C4890	8_2_082C4890
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_082C4CD8	8_2_082C4CD8
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_082C3030	8_2_082C3030
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_082C3060	8_2_082C3060
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_082CB0D8	8_2_082CB0D8
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_082C3498	8_2_082C3498
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_082C55A1	8_2_082C55A1
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_082C55B0	8_2_082C55B0
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0042809D	13_2_0042809D
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0045412B	13_2_0045412B
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_004421C0	13_2_004421C0
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_004281D7	13_2_004281D7
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0043E1E0	13_2_0043E1E0
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0041E29B	13_2_0041E29B
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_004373DA	13_2_004373DA
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00438380	13_2_00438380
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00453472	13_2_00453472
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0042747E	13_2_0042747E
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0043E43D	13_2_0043E43D
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_004325A1	13_2_004325A1
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0043774C	13_2_0043774C
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0041F809	13_2_0041F809
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_004379F6	13_2_004379F6
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_004279F5	13_2_004279F5
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0044DAD9	13_2_0044DAD9
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00433C73	13_2_00433C73
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00413CA0	13_2_00413CA0
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00437CBD	13_2_00437CBD
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0043DD82	13_2_0043DD82
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00435F52	13_2_00435F52
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00437F78	13_2_00437F78
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0043DFB1	13_2_0043DFB1

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: String function: 004351E0 appears 55 times
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: String function: 00401F96 appears 49 times
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: String function: 00401EBF appears 32 times
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: String function: 00434ACF appears 43 times
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: String function: 00402117 appears 39 times

Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1208234588.0000000002ACA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs RMBUDGSD23ED PO.exe
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1217499507.0000000009D80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs RMBUDGSD23ED PO.exe
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1208234588.0000000002B78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs RMBUDGSD23ED PO.exe
Source: RMBUDGSD23ED PO.exe, 00000000.00000000.1150647601.0000000000790000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameJhRU.exe" vs RMBUDGSD23ED PO.exe
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1206670902.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RMBUDGSD23ED PO.exe
Source: RMBUDGSD23ED PO.exe, 00000000.00000002.1207796033.0000000002A10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs RMBUDGSD23ED PO.exe
Source: RMBUDGSD23ED PO.exe	Binary or memory string: OriginalFilenameJhRU.exe" vs RMBUDGSD23ED PO.exe

Source: RMBUDGSD23ED PO.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8.2.vXchjQznSJi.exe.5037ab0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.vXchjQznSJi.exe.5037ab0.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.vXchjQznSJi.exe.5037ab0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.vXchjQznSJi.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 13.2.vXchjQznSJi.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 13.2.vXchjQznSJi.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.vXchjQznSJi.exe.50b14d0.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.vXchjQznSJi.exe.50b14d0.5.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.vXchjQznSJi.exe.50b14d0.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.vXchjQznSJi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 13.2.vXchjQznSJi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 13.2.vXchjQznSJi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000008.00000002.1259665953.0000000005037000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.1209600933.00000000047B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: RMBUDGSD23ED PO.exe PID: 7288, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: vXchjQznSJi.exe PID: 7760, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: vXchjQznSJi.exe PID: 8092, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: RMBUDGSD23ED PO.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: vXchjQznSJi.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, RBjLpKVqr9gt8ht48L.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, RBjLpKVqr9gt8ht48L.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, RBjLpKVqr9gt8ht48L.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, RBjLpKVqr9gt8ht48L.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, RBjLpKVqr9gt8ht48L.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, RBjLpKVqr9gt8ht48L.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, rvmFSswBam2Mv08EZj.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, rvmFSswBam2Mv08EZj.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, RBjLpKVqr9gt8ht48L.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, RBjLpKVqr9gt8ht48L.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, RBjLpKVqr9gt8ht48L.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, rvmFSswBam2Mv08EZj.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, rvmFSswBam2Mv08EZj.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, rvmFSswBam2Mv08EZj.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, rvmFSswBam2Mv08EZj.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@21/22@3/3

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_00417AD9 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

13_2_00417AD9

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_0040C03C GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

13_2_0040C03C

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_0041B9AB FindResourceA,LoadResource,LockResource,SizeofResource,

13_2_0041B9AB

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_0041AC43 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

13_2_0041AC43

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

File created: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-6L0UG9
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7564:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Mutant created: \Sessions\1\BaseNamedObjects\RqBzeinwQqWgTZdPYvouwmLCmc

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

File created: C:\Users\user\AppData\Local\Temp\tmpD67E.tmp

Jump to behavior

Source: RMBUDGSD23ED PO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RMBUDGSD23ED PO.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RMBUDGSD23ED PO.exe	Virustotal: Detection: 54%
Source: RMBUDGSD23ED PO.exe	ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

File read: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe"
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vXchjQznSJi.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpD67E.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe C:\Users\user\AppData\Roaming\vXchjQznSJi.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpE95A.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process created: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe "C:\Users\user\AppData\Roaming\vXchjQznSJi.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vXchjQznSJi.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpD67E.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpE95A.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process created: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe "C:\Users\user\AppData\Roaming\vXchjQznSJi.exe"	Jump to behavior

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: RMBUDGSD23ED PO.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RMBUDGSD23ED PO.exe

Static file information: File size 1146880 > 1048576

Source: RMBUDGSD23ED PO.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, RBjLpKVqr9gt8ht48L.cs	.Net Code: ajTCtxNqxn System.Reflection.Assembly.Load(byte[])
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, RBjLpKVqr9gt8ht48L.cs	.Net Code: ajTCtxNqxn System.Reflection.Assembly.Load(byte[])
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, RBjLpKVqr9gt8ht48L.cs	.Net Code: ajTCtxNqxn System.Reflection.Assembly.Load(byte[])

Source: RMBUDGSD23ED PO.exe

Static PE information: 0x9E1B6128 [Wed Jan 21 07:47:52 2054 UTC]

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_0041D0CF LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

13_2_0041D0CF

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Code function: 0_2_02A4B4CC pushad ; ret	0_2_02A4BD99
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 8_2_053CB4CC pushad ; ret	8_2_053CBD99
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_004570CF push ecx; ret	13_2_004570E2
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00435226 push ecx; ret	13_2_00435239
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0045D9ED push esi; ret	13_2_0045D9F6
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00457A00 push eax; ret	13_2_00457A1E

Source: RMBUDGSD23ED PO.exe	Static PE information: section name: .text entropy: 7.870879785728716
Source: vXchjQznSJi.exe.0.dr	Static PE information: section name: .text entropy: 7.870879785728716

Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, PslOapTT0fmpCWob6A.cs	High entropy of concatenated method names: 'yraYjVVEUw', 'nj8YW1wlK7', 'W7sYdirPJd', 'U2xYpUFcRs', 'cjeYsEAsmy', 'FI4YDsLbpV', 'BK4Y5UM58L', 'axAYn4jWys', 'shrYeHJ4UD', 'M45YBS3uFj'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, rvmFSswBam2Mv08EZj.cs	High entropy of concatenated method names: 'XBkNf8UYqi', 'bcPNHFWTej', 'EEGNFm0Op3', 'nQeNAfRfTW', 'SVDNZf9fuY', 'D2KNQVTBv7', 'zZCNxYmv5T', 'KxjNPteJoM', 'jWPNTk558A', 'uHMNU4WfQT'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, u95qXveuwnWGrT1UGb.cs	High entropy of concatenated method names: 'CQdoqAJown', 'vrAo7x80Eu', 'VRLoteDrhO', 'QZ0og5Asa2', 'uhsoiK9tI8', 'lTioryus6p', 'bctomsH7mV', 'b9Zow2MOhn', 'lemo0ImFLA', 'koxoSYPAkS'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, zqnVBV4edVRBQ2LAd9.cs	High entropy of concatenated method names: 'v87t4qXsH', 'Db0gAAGZC', 'QVnrVuRd2', 'yp1mJ7MOa', 'ILl000b5q', 'SGoSyBRY1', 'vyaE4L2CrMTCMeO6lU', 'uoTYRaN66853gbVUqq', 'p8XRWsV0u', 'TFjKpiUjF'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, l7PyGQxWqYTtpC4RBb.cs	High entropy of concatenated method names: 'DklYLsm5Xm', 'liGYX50U5h', 'w4LYYDwx7Z', 'm8wYhuxWOT', 'MZ9YyVhGnr', 'CVjYcaDUrH', 'Dispose', 'HDYR6JxpgS', 'OHPRNXYjAa', 'b9MREA70Cj'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, rqqRu5j7blnRIjvG5J.cs	High entropy of concatenated method names: 'DYRbagaSEA', 'f2TbN748c3', 'cqGbIT19Ho', 'y5tbo9g2y7', 'pFLbVh9sOM', 'YjAIZgos5j', 'xO2IQXxA2b', 'smhIx8At0V', 'xqXIPx1eOO', 'z4XIT8gHDM'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, BVu9U8JJiW4FQLvR8WN.cs	High entropy of concatenated method names: 'JSTKUbgdU8', 'Yb3KzZeba1', 'WUhhM3OjP6', 'Y24hJZAhEZ', 'sB6h4hPl7N', 'sT6hveWxuu', 'xyqhCV71Xj', 'epshaJYE7a', 'Jykh6dVxic', 'p0xhNJ7s7y'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, sJbXhc5B749T91KekB.cs	High entropy of concatenated method names: 'ie8o6Cx6Hs', 'zHjoEERm4r', 'QVcob5xqxG', 'rmubU561mB', 'GU7bzlYSnk', 'w8WoMSW0uW', 'KI5oJcX0Ib', 'g15o45RThC', 'plJovwsW8V', 'saToC0uXCD'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, GRxHrpED5SWHtdfI8Z.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'rsh4TrCB7Y', 'c594UtOUhH', 'MpZ4zVjT0E', 'fUmvMTZOeD', 'whCvJFoDw2', 'UCiv4QlTP4', 'f8Tvv4vrZZ', 'kKEWLcRhHFCQ9ZdDSu5'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, RYsnELSNfeChTn8QJu.cs	High entropy of concatenated method names: 'aJaIi8GibK', 'De2ImBxtZa', 'Fu5EdZlEaU', 'Cd1Ep1gRoh', 'rWqEsyJgp6', 'iRAEDoSpK2', 'YvlE52QxDv', 'D2LEnGhX6t', 'd5iEel0bXh', 'tCaEBX2tSh'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, aVSuVdNkHaYIQc5iSj.cs	High entropy of concatenated method names: 'Dispose', 'rTtJTpC4RB', 'K4T4WVREH6', 'IZDTk2nvvy', 'iBtJUMjVMQ', 'mYUJzVpEJ6', 'ProcessDialogKey', 'fcu4MslOap', 'X0f4JmpCWo', 'i6A44DMe8f'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, RCeMscfFBS7Ktj5mWg.cs	High entropy of concatenated method names: 'J38LBw8pE4', 'QV6LGCb4g8', 'eyVLfuj5lu', 'ijmLHAo1gA', 'rGvLWSV7eU', 'hT6LdVDnb5', 'NtHLpJfW60', 'XxKLsasxMe', 'gRMLDdkG98', 'u95L5MaRAA'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, wF34GvJCTTGCcZ86LEe.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zgV2YQAPKx', 'IQk2K5DGFG', 'xoi2h1ynGl', 'PAT2210Vlm', 'AlC2yB6uep', 'Pcg29bLGMk', 'T6u2c5kRQ6'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, KMe8f0Uh0nbrmgIOdN.cs	High entropy of concatenated method names: 'OdlKEJ1emE', 'HHeKI5R1Ww', 'JUlKbmViKL', 'MQ0KoQMX3L', 'jU5KY1khGQ', 'cvfKVnSBpe', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, RBjLpKVqr9gt8ht48L.cs	High entropy of concatenated method names: 'OLvvaWIsay', 'XCHv6A5Rwn', 'OElvNkgoRj', 'DZWvE0dyxq', 'br6vIoBBi7', 'vyWvbqul3P', 'aLsvopiILm', 'e1QvVlDwZK', 'JcCvlsbEZV', 'hkxvkrKot3'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, KUQHIqQyEa5g1PpDjI.cs	High entropy of concatenated method names: 'sGJXPvYP9J', 'jDOXUBJ3xm', 'hawRMKHvUk', 'zFNRJyiBHO', 'IYVX3ibIqN', 'lBoXG1vQqX', 'qF0Xupco2q', 'J2sXfaArWW', 'G8eXHigyfc', 'AuuXFPZI8p'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, pmnTo7Cw3Bn5vf70sc.cs	High entropy of concatenated method names: 'GVYJovmFSs', 'NamJV2Mv08', 'tmWJkpJrOb', 'qt5J8vHYsn', 'M8QJLJuRqq', 'ru5J17blnR', 'YApQdOwQs8sm6ymlBc', 'rjGWLrzYYZF8X0tyYY', 'sTCJJFEi1w', 'C5GJvRbC2C'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, yyeGFRuEZPdd0nTps4.cs	High entropy of concatenated method names: 'abBOwp9JYe', 'wrOO0x8dfw', 'eDrOjUxjqK', 'vLSOWjCw1v', 'VkHOpCKD1j', 'o7sOsD3TML', 'KL5O5BghH0', 'jE9OnGMQ71', 'hclOBkcFwU', 'qyLO32RD61'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, epoGXcJMRdsBr0jv9XH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'KmuK3B8tt6', 'k5dKG6vo8i', 'KTdKuMa4LP', 's1SKf5OZOQ', 'BR2KHHaB6G', 'bQBKFtTeBx', 'RhYKAfjft9'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, pUu9yh0mWpJrObXt5v.cs	High entropy of concatenated method names: 'WxdEgdbGSI', 'iAiEr1TyaE', 'EToEwmXD4Z', 'NkFE006i7w', 'Bx8ELk6q18', 'Lq6E1iXuag', 'EIbEXmOX2H', 'KswERQQ2wR', 'WgcEYFqrRx', 'jgpEKE7ZBw'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, UhyiFAAPuFl3BeMAgV.cs	High entropy of concatenated method names: 'PKnXkbrpG5', 'm6oX82H8En', 'ToString', 'znlX6Oa8Ko', 'p7BXN3Tqd4', 'uKpXEhhlvI', 'BJ7XIAexSG', 'FK6XbWVvbD', 'TMTXoAjcKD', 'sEAXVNe0P8'
Source: 0.2.RMBUDGSD23ED PO.exe.9d80000.8.raw.unpack, j4ynNJzNFnS8F5xwaO.cs	High entropy of concatenated method names: 'RT2KrwKOod', 'gGCKwHJMri', 'D4ZK0VZd8n', 'tkDKj6Vy6F', 'm2IKWegijm', 'KvUKpiTkJM', 'T7pKsF0r8y', 'xH6KcBwN4P', 'xtWKqlM6VZ', 'UFiK7JmSsS'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, PslOapTT0fmpCWob6A.cs	High entropy of concatenated method names: 'yraYjVVEUw', 'nj8YW1wlK7', 'W7sYdirPJd', 'U2xYpUFcRs', 'cjeYsEAsmy', 'FI4YDsLbpV', 'BK4Y5UM58L', 'axAYn4jWys', 'shrYeHJ4UD', 'M45YBS3uFj'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, rvmFSswBam2Mv08EZj.cs	High entropy of concatenated method names: 'XBkNf8UYqi', 'bcPNHFWTej', 'EEGNFm0Op3', 'nQeNAfRfTW', 'SVDNZf9fuY', 'D2KNQVTBv7', 'zZCNxYmv5T', 'KxjNPteJoM', 'jWPNTk558A', 'uHMNU4WfQT'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, u95qXveuwnWGrT1UGb.cs	High entropy of concatenated method names: 'CQdoqAJown', 'vrAo7x80Eu', 'VRLoteDrhO', 'QZ0og5Asa2', 'uhsoiK9tI8', 'lTioryus6p', 'bctomsH7mV', 'b9Zow2MOhn', 'lemo0ImFLA', 'koxoSYPAkS'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, zqnVBV4edVRBQ2LAd9.cs	High entropy of concatenated method names: 'v87t4qXsH', 'Db0gAAGZC', 'QVnrVuRd2', 'yp1mJ7MOa', 'ILl000b5q', 'SGoSyBRY1', 'vyaE4L2CrMTCMeO6lU', 'uoTYRaN66853gbVUqq', 'p8XRWsV0u', 'TFjKpiUjF'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, l7PyGQxWqYTtpC4RBb.cs	High entropy of concatenated method names: 'DklYLsm5Xm', 'liGYX50U5h', 'w4LYYDwx7Z', 'm8wYhuxWOT', 'MZ9YyVhGnr', 'CVjYcaDUrH', 'Dispose', 'HDYR6JxpgS', 'OHPRNXYjAa', 'b9MREA70Cj'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, rqqRu5j7blnRIjvG5J.cs	High entropy of concatenated method names: 'DYRbagaSEA', 'f2TbN748c3', 'cqGbIT19Ho', 'y5tbo9g2y7', 'pFLbVh9sOM', 'YjAIZgos5j', 'xO2IQXxA2b', 'smhIx8At0V', 'xqXIPx1eOO', 'z4XIT8gHDM'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, BVu9U8JJiW4FQLvR8WN.cs	High entropy of concatenated method names: 'JSTKUbgdU8', 'Yb3KzZeba1', 'WUhhM3OjP6', 'Y24hJZAhEZ', 'sB6h4hPl7N', 'sT6hveWxuu', 'xyqhCV71Xj', 'epshaJYE7a', 'Jykh6dVxic', 'p0xhNJ7s7y'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, sJbXhc5B749T91KekB.cs	High entropy of concatenated method names: 'ie8o6Cx6Hs', 'zHjoEERm4r', 'QVcob5xqxG', 'rmubU561mB', 'GU7bzlYSnk', 'w8WoMSW0uW', 'KI5oJcX0Ib', 'g15o45RThC', 'plJovwsW8V', 'saToC0uXCD'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, GRxHrpED5SWHtdfI8Z.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'rsh4TrCB7Y', 'c594UtOUhH', 'MpZ4zVjT0E', 'fUmvMTZOeD', 'whCvJFoDw2', 'UCiv4QlTP4', 'f8Tvv4vrZZ', 'kKEWLcRhHFCQ9ZdDSu5'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, RYsnELSNfeChTn8QJu.cs	High entropy of concatenated method names: 'aJaIi8GibK', 'De2ImBxtZa', 'Fu5EdZlEaU', 'Cd1Ep1gRoh', 'rWqEsyJgp6', 'iRAEDoSpK2', 'YvlE52QxDv', 'D2LEnGhX6t', 'd5iEel0bXh', 'tCaEBX2tSh'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, aVSuVdNkHaYIQc5iSj.cs	High entropy of concatenated method names: 'Dispose', 'rTtJTpC4RB', 'K4T4WVREH6', 'IZDTk2nvvy', 'iBtJUMjVMQ', 'mYUJzVpEJ6', 'ProcessDialogKey', 'fcu4MslOap', 'X0f4JmpCWo', 'i6A44DMe8f'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, RCeMscfFBS7Ktj5mWg.cs	High entropy of concatenated method names: 'J38LBw8pE4', 'QV6LGCb4g8', 'eyVLfuj5lu', 'ijmLHAo1gA', 'rGvLWSV7eU', 'hT6LdVDnb5', 'NtHLpJfW60', 'XxKLsasxMe', 'gRMLDdkG98', 'u95L5MaRAA'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, wF34GvJCTTGCcZ86LEe.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zgV2YQAPKx', 'IQk2K5DGFG', 'xoi2h1ynGl', 'PAT2210Vlm', 'AlC2yB6uep', 'Pcg29bLGMk', 'T6u2c5kRQ6'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, KMe8f0Uh0nbrmgIOdN.cs	High entropy of concatenated method names: 'OdlKEJ1emE', 'HHeKI5R1Ww', 'JUlKbmViKL', 'MQ0KoQMX3L', 'jU5KY1khGQ', 'cvfKVnSBpe', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, RBjLpKVqr9gt8ht48L.cs	High entropy of concatenated method names: 'OLvvaWIsay', 'XCHv6A5Rwn', 'OElvNkgoRj', 'DZWvE0dyxq', 'br6vIoBBi7', 'vyWvbqul3P', 'aLsvopiILm', 'e1QvVlDwZK', 'JcCvlsbEZV', 'hkxvkrKot3'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, KUQHIqQyEa5g1PpDjI.cs	High entropy of concatenated method names: 'sGJXPvYP9J', 'jDOXUBJ3xm', 'hawRMKHvUk', 'zFNRJyiBHO', 'IYVX3ibIqN', 'lBoXG1vQqX', 'qF0Xupco2q', 'J2sXfaArWW', 'G8eXHigyfc', 'AuuXFPZI8p'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, pmnTo7Cw3Bn5vf70sc.cs	High entropy of concatenated method names: 'GVYJovmFSs', 'NamJV2Mv08', 'tmWJkpJrOb', 'qt5J8vHYsn', 'M8QJLJuRqq', 'ru5J17blnR', 'YApQdOwQs8sm6ymlBc', 'rjGWLrzYYZF8X0tyYY', 'sTCJJFEi1w', 'C5GJvRbC2C'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, yyeGFRuEZPdd0nTps4.cs	High entropy of concatenated method names: 'abBOwp9JYe', 'wrOO0x8dfw', 'eDrOjUxjqK', 'vLSOWjCw1v', 'VkHOpCKD1j', 'o7sOsD3TML', 'KL5O5BghH0', 'jE9OnGMQ71', 'hclOBkcFwU', 'qyLO32RD61'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, epoGXcJMRdsBr0jv9XH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'KmuK3B8tt6', 'k5dKG6vo8i', 'KTdKuMa4LP', 's1SKf5OZOQ', 'BR2KHHaB6G', 'bQBKFtTeBx', 'RhYKAfjft9'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, pUu9yh0mWpJrObXt5v.cs	High entropy of concatenated method names: 'WxdEgdbGSI', 'iAiEr1TyaE', 'EToEwmXD4Z', 'NkFE006i7w', 'Bx8ELk6q18', 'Lq6E1iXuag', 'EIbEXmOX2H', 'KswERQQ2wR', 'WgcEYFqrRx', 'jgpEKE7ZBw'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, UhyiFAAPuFl3BeMAgV.cs	High entropy of concatenated method names: 'PKnXkbrpG5', 'm6oX82H8En', 'ToString', 'znlX6Oa8Ko', 'p7BXN3Tqd4', 'uKpXEhhlvI', 'BJ7XIAexSG', 'FK6XbWVvbD', 'TMTXoAjcKD', 'sEAXVNe0P8'
Source: 0.2.RMBUDGSD23ED PO.exe.4699090.7.raw.unpack, j4ynNJzNFnS8F5xwaO.cs	High entropy of concatenated method names: 'RT2KrwKOod', 'gGCKwHJMri', 'D4ZK0VZd8n', 'tkDKj6Vy6F', 'm2IKWegijm', 'KvUKpiTkJM', 'T7pKsF0r8y', 'xH6KcBwN4P', 'xtWKqlM6VZ', 'UFiK7JmSsS'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, PslOapTT0fmpCWob6A.cs	High entropy of concatenated method names: 'yraYjVVEUw', 'nj8YW1wlK7', 'W7sYdirPJd', 'U2xYpUFcRs', 'cjeYsEAsmy', 'FI4YDsLbpV', 'BK4Y5UM58L', 'axAYn4jWys', 'shrYeHJ4UD', 'M45YBS3uFj'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, rvmFSswBam2Mv08EZj.cs	High entropy of concatenated method names: 'XBkNf8UYqi', 'bcPNHFWTej', 'EEGNFm0Op3', 'nQeNAfRfTW', 'SVDNZf9fuY', 'D2KNQVTBv7', 'zZCNxYmv5T', 'KxjNPteJoM', 'jWPNTk558A', 'uHMNU4WfQT'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, u95qXveuwnWGrT1UGb.cs	High entropy of concatenated method names: 'CQdoqAJown', 'vrAo7x80Eu', 'VRLoteDrhO', 'QZ0og5Asa2', 'uhsoiK9tI8', 'lTioryus6p', 'bctomsH7mV', 'b9Zow2MOhn', 'lemo0ImFLA', 'koxoSYPAkS'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, zqnVBV4edVRBQ2LAd9.cs	High entropy of concatenated method names: 'v87t4qXsH', 'Db0gAAGZC', 'QVnrVuRd2', 'yp1mJ7MOa', 'ILl000b5q', 'SGoSyBRY1', 'vyaE4L2CrMTCMeO6lU', 'uoTYRaN66853gbVUqq', 'p8XRWsV0u', 'TFjKpiUjF'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, l7PyGQxWqYTtpC4RBb.cs	High entropy of concatenated method names: 'DklYLsm5Xm', 'liGYX50U5h', 'w4LYYDwx7Z', 'm8wYhuxWOT', 'MZ9YyVhGnr', 'CVjYcaDUrH', 'Dispose', 'HDYR6JxpgS', 'OHPRNXYjAa', 'b9MREA70Cj'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, rqqRu5j7blnRIjvG5J.cs	High entropy of concatenated method names: 'DYRbagaSEA', 'f2TbN748c3', 'cqGbIT19Ho', 'y5tbo9g2y7', 'pFLbVh9sOM', 'YjAIZgos5j', 'xO2IQXxA2b', 'smhIx8At0V', 'xqXIPx1eOO', 'z4XIT8gHDM'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, BVu9U8JJiW4FQLvR8WN.cs	High entropy of concatenated method names: 'JSTKUbgdU8', 'Yb3KzZeba1', 'WUhhM3OjP6', 'Y24hJZAhEZ', 'sB6h4hPl7N', 'sT6hveWxuu', 'xyqhCV71Xj', 'epshaJYE7a', 'Jykh6dVxic', 'p0xhNJ7s7y'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, sJbXhc5B749T91KekB.cs	High entropy of concatenated method names: 'ie8o6Cx6Hs', 'zHjoEERm4r', 'QVcob5xqxG', 'rmubU561mB', 'GU7bzlYSnk', 'w8WoMSW0uW', 'KI5oJcX0Ib', 'g15o45RThC', 'plJovwsW8V', 'saToC0uXCD'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, GRxHrpED5SWHtdfI8Z.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'rsh4TrCB7Y', 'c594UtOUhH', 'MpZ4zVjT0E', 'fUmvMTZOeD', 'whCvJFoDw2', 'UCiv4QlTP4', 'f8Tvv4vrZZ', 'kKEWLcRhHFCQ9ZdDSu5'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, RYsnELSNfeChTn8QJu.cs	High entropy of concatenated method names: 'aJaIi8GibK', 'De2ImBxtZa', 'Fu5EdZlEaU', 'Cd1Ep1gRoh', 'rWqEsyJgp6', 'iRAEDoSpK2', 'YvlE52QxDv', 'D2LEnGhX6t', 'd5iEel0bXh', 'tCaEBX2tSh'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, aVSuVdNkHaYIQc5iSj.cs	High entropy of concatenated method names: 'Dispose', 'rTtJTpC4RB', 'K4T4WVREH6', 'IZDTk2nvvy', 'iBtJUMjVMQ', 'mYUJzVpEJ6', 'ProcessDialogKey', 'fcu4MslOap', 'X0f4JmpCWo', 'i6A44DMe8f'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, RCeMscfFBS7Ktj5mWg.cs	High entropy of concatenated method names: 'J38LBw8pE4', 'QV6LGCb4g8', 'eyVLfuj5lu', 'ijmLHAo1gA', 'rGvLWSV7eU', 'hT6LdVDnb5', 'NtHLpJfW60', 'XxKLsasxMe', 'gRMLDdkG98', 'u95L5MaRAA'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, wF34GvJCTTGCcZ86LEe.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zgV2YQAPKx', 'IQk2K5DGFG', 'xoi2h1ynGl', 'PAT2210Vlm', 'AlC2yB6uep', 'Pcg29bLGMk', 'T6u2c5kRQ6'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, KMe8f0Uh0nbrmgIOdN.cs	High entropy of concatenated method names: 'OdlKEJ1emE', 'HHeKI5R1Ww', 'JUlKbmViKL', 'MQ0KoQMX3L', 'jU5KY1khGQ', 'cvfKVnSBpe', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, RBjLpKVqr9gt8ht48L.cs	High entropy of concatenated method names: 'OLvvaWIsay', 'XCHv6A5Rwn', 'OElvNkgoRj', 'DZWvE0dyxq', 'br6vIoBBi7', 'vyWvbqul3P', 'aLsvopiILm', 'e1QvVlDwZK', 'JcCvlsbEZV', 'hkxvkrKot3'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, KUQHIqQyEa5g1PpDjI.cs	High entropy of concatenated method names: 'sGJXPvYP9J', 'jDOXUBJ3xm', 'hawRMKHvUk', 'zFNRJyiBHO', 'IYVX3ibIqN', 'lBoXG1vQqX', 'qF0Xupco2q', 'J2sXfaArWW', 'G8eXHigyfc', 'AuuXFPZI8p'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, pmnTo7Cw3Bn5vf70sc.cs	High entropy of concatenated method names: 'GVYJovmFSs', 'NamJV2Mv08', 'tmWJkpJrOb', 'qt5J8vHYsn', 'M8QJLJuRqq', 'ru5J17blnR', 'YApQdOwQs8sm6ymlBc', 'rjGWLrzYYZF8X0tyYY', 'sTCJJFEi1w', 'C5GJvRbC2C'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, yyeGFRuEZPdd0nTps4.cs	High entropy of concatenated method names: 'abBOwp9JYe', 'wrOO0x8dfw', 'eDrOjUxjqK', 'vLSOWjCw1v', 'VkHOpCKD1j', 'o7sOsD3TML', 'KL5O5BghH0', 'jE9OnGMQ71', 'hclOBkcFwU', 'qyLO32RD61'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, epoGXcJMRdsBr0jv9XH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'KmuK3B8tt6', 'k5dKG6vo8i', 'KTdKuMa4LP', 's1SKf5OZOQ', 'BR2KHHaB6G', 'bQBKFtTeBx', 'RhYKAfjft9'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, pUu9yh0mWpJrObXt5v.cs	High entropy of concatenated method names: 'WxdEgdbGSI', 'iAiEr1TyaE', 'EToEwmXD4Z', 'NkFE006i7w', 'Bx8ELk6q18', 'Lq6E1iXuag', 'EIbEXmOX2H', 'KswERQQ2wR', 'WgcEYFqrRx', 'jgpEKE7ZBw'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, UhyiFAAPuFl3BeMAgV.cs	High entropy of concatenated method names: 'PKnXkbrpG5', 'm6oX82H8En', 'ToString', 'znlX6Oa8Ko', 'p7BXN3Tqd4', 'uKpXEhhlvI', 'BJ7XIAexSG', 'FK6XbWVvbD', 'TMTXoAjcKD', 'sEAXVNe0P8'
Source: 0.2.RMBUDGSD23ED PO.exe.45db070.6.raw.unpack, j4ynNJzNFnS8F5xwaO.cs	High entropy of concatenated method names: 'RT2KrwKOod', 'gGCKwHJMri', 'D4ZK0VZd8n', 'tkDKj6Vy6F', 'm2IKWegijm', 'KvUKpiTkJM', 'T7pKsF0r8y', 'xH6KcBwN4P', 'xtWKqlM6VZ', 'UFiK7JmSsS'

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_004062E2 ShellExecuteW,URLDownloadToFileW,

13_2_004062E2

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

File created: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpD67E.tmp"

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_0041AC43 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

13_2_0041AC43

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

13_2_0041D0CF

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: RMBUDGSD23ED PO.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vXchjQznSJi.exe PID: 7760, type: MEMORYSTR

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Memory allocated: 10D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Memory allocated: 2A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Memory allocated: 50F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Memory allocated: 60F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Memory allocated: 6220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Memory allocated: 7220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Memory allocated: B270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Memory allocated: C270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Memory allocated: C700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Memory allocated: D700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Memory allocated: 1990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Memory allocated: 3340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Memory allocated: 5340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Memory allocated: 59A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Memory allocated: 69A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Memory allocated: 6AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Memory allocated: 7AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Memory allocated: B650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Memory allocated: C650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Memory allocated: CAE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Memory allocated: DAE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

Code function: 0_2_090242B0 str word ptr [ecx]

0_2_090242B0

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

13_2_0041A941

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6703	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2984	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6753	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2959	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Window / User API: threadDelayed 6876	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Window / User API: threadDelayed 2635	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Window / User API: foregroundWindowGot 1769	Jump to behavior

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

API coverage: 6.0 %

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe TID: 7308	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7496	Thread sleep count: 6703 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7496	Thread sleep count: 2984 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7636	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe TID: 7740	Thread sleep count: 235 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe TID: 7740	Thread sleep time: -117500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe TID: 7744	Thread sleep count: 6876 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe TID: 7744	Thread sleep time: -20628000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe TID: 7744	Thread sleep count: 2635 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe TID: 7744	Thread sleep time: -7905000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe TID: 7816	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7920	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_004090DC __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	13_2_004090DC
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0040B6B5 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	13_2_0040B6B5
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0041C7E5 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	13_2_0041C7E5
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0040B8BA FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	13_2_0040B8BA
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0044E989 FindFirstFileExA,	13_2_0044E989
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00408CDE __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	13_2_00408CDE
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00419CEE FindFirstFileW,FindNextFileW,FindNextFileW,	13_2_00419CEE
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00407EDD __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	13_2_00407EDD
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00406F13 FindFirstFileW,FindNextFileW,	13_2_00406F13

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_00407357 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

13_2_00407357

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3614341226.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2869903406.000001F7FBA54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.0000000001477000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: svchost.exe, 00000009.00000002.2868732142.000001F7F642B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW l
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3614341226.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_0043B88D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

13_2_0043B88D

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

13_2_0041D0CF

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_004438F4 mov eax, dword ptr fs:[00000030h]

13_2_004438F4

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_00411999 GetNativeSystemInfo,GetProcessHeap,HeapAlloc,SetLastError,SetLastError,

13_2_00411999

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00435398 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00435398
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_0043B88D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_0043B88D
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00434D6E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00434D6E
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: 13_2_00434F01 SetUnhandledExceptionFilter,	13_2_00434F01

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe"
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vXchjQznSJi.exe"
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vXchjQznSJi.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Memory written: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Memory written: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_004197D9 mouse_event,

13_2_004197D9

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vXchjQznSJi.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpD67E.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Process created: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe "C:\Users\user\Desktop\RMBUDGSD23ED PO.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXchjQznSJi" /XML "C:\Users\user\AppData\Local\Temp\tmpE95A.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Process created: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe "C:\Users\user\AppData\Roaming\vXchjQznSJi.exe"	Jump to behavior

Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerg
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerG
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerf10bd9U
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerf10bd9Z
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.0000000001477000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerilesCO}
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager-
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerf10bd9
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managercrosoft
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerESE\
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerG$
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager`
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: RMBUDGSD23ED PO.exe, 00000007.00000002.3613822926.0000000001477000.00000004.00000020.00020000.00000000.sdmp, logs.dat.7.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_00435034 cpuid

13_2_00435034

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: EnumSystemLocalesW,	13_2_004520E2
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: EnumSystemLocalesW,	13_2_00452097
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: EnumSystemLocalesW,	13_2_0045217D
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: GetLocaleInfoA,	13_2_0040F26B
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	13_2_0045220A
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: EnumSystemLocalesW,	13_2_0044844E
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: GetLocaleInfoW,	13_2_0045245A
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	13_2_00452583
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: GetLocaleInfoW,	13_2_0045268A
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	13_2_00452757
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: GetLocaleInfoW,	13_2_00448937
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	13_2_00451E1F

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Queries volume information: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_0041A1AD __EH_prolog,GdiplusStartup,CreateDirectoryW,Sleep,GetLocalTime,Sleep,

13_2_0041A1AD

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_0041BB0E GetUserNameW,

13_2_0041BB0E

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: 13_2_004491DA _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

13_2_004491DA

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 8.2.vXchjQznSJi.exe.5037ab0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vXchjQznSJi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.50b14d0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vXchjQznSJi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1235674948.0000000001027000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3613822926.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3614615875.0000000002FFF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3613822926.0000000001477000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1259665953.0000000005037000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1209600933.00000000047B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RMBUDGSD23ED PO.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RMBUDGSD23ED PO.exe PID: 7704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vXchjQznSJi.exe PID: 7760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vXchjQznSJi.exe PID: 8092, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

13_2_0040B59B

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		13_2_0040B6B5
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Code function: \key3.db		13_2_0040B6B5

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\RMBUDGSD23ED PO.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-6L0UG9			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-6L0UG9

Yara detected Remcos RAT

Source: Yara match	File source: 8.2.vXchjQznSJi.exe.5037ab0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vXchjQznSJi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.50b14d0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vXchjQznSJi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.50b14d0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.482f4b8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RMBUDGSD23ED PO.exe.47b5a98.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.vXchjQznSJi.exe.5037ab0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1235674948.0000000001027000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3613822926.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3614615875.0000000002FFF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3613822926.0000000001477000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1235183372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1259665953.0000000005037000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1209600933.00000000047B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RMBUDGSD23ED PO.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RMBUDGSD23ED PO.exe PID: 7704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vXchjQznSJi.exe PID: 7760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vXchjQznSJi.exe PID: 8092, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\AppData\Roaming\vXchjQznSJi.exe

Code function: cmd.exe

13_2_00405091

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 Windows Service	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Access Token Manipulation	3 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Windows Service	12 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 Service Execution	Network Logon Script	112 Process Injection	1 Timestomp	LSA Secrets	43 System Information Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	1 DLL Side-Loading	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	12 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Bypass User Account Control	DCSync	51 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	51 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	112 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RMBUDGSD23ED PO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
RMBUDGSD23ED PO.exe