Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
IRSTaxRefund.exe

Overview

General Information

Sample name:IRSTaxRefund.exe
Analysis ID:1615763
MD5:761f7bcf3a87c763b5731981a3eecfa1
SHA1:54dcedae0c7aafa29a5f77837e24d5237c1bf3d5
SHA256:8f9a49880a56f8eb66edc7d57d5d6325b4966de1204dfacc57cc381541cc23ed
Tags:exeRATRemcosRATuser-abuse_ch
Infos:

Detection

DBatLoader, Remcos
Score:100
Range:0 - 100
Confidence:100%

Signatures

Contains functionality to bypass UAC (CMSTPLUA)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected DBatLoader
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Allocates many large memory junks
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Creates a thread in another existing process (thread injection)
Delayed program exit found
Drops PE files with a suspicious file extension
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
Sigma detected: Execution from Suspicious Folder
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Suspicious Creation with Colorcpl
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected WebBrowserPassView password recovery tool
Abnormal high CPU Usage
Binary contains a suspicious time stamp
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to launch a process as a different user
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w10x64
  • IRSTaxRefund.exe (PID: 7292 cmdline: "C:\Users\user\Desktop\IRSTaxRefund.exe" MD5: 761F7BCF3A87C763B5731981A3EECFA1)
    • cmd.exe (PID: 7340 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\TmohrqmbF.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7420 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\NEO.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • colorcpl.exe (PID: 7472 cmdline: C:\Windows\System32\colorcpl.exe MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)
      • colorcpl.exe (PID: 7580 cmdline: C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\arbpnwwkbdbggftjlfvxogreibczuy" MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)
      • colorcpl.exe (PID: 7588 cmdline: C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\arbpnwwkbdbggftjlfvxogreibczuy" MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)
      • colorcpl.exe (PID: 7596 cmdline: C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\dlgiophmpltlilpvupprzllvriuivjxce" MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)
      • colorcpl.exe (PID: 7612 cmdline: C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\nnlao" MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)
  • Tmohrqmb.PIF (PID: 7732 cmdline: "C:\Users\Public\Libraries\Tmohrqmb.PIF" MD5: 761F7BCF3A87C763B5731981A3EECFA1)
    • SndVol.exe (PID: 7784 cmdline: C:\Windows\System32\SndVol.exe MD5: BD4A1CC3429ED1251E5185A72501839B)
  • Tmohrqmb.PIF (PID: 7976 cmdline: "C:\Users\Public\Libraries\Tmohrqmb.PIF" MD5: 761F7BCF3A87C763B5731981A3EECFA1)
    • SndVol.exe (PID: 8036 cmdline: C:\Windows\System32\SndVol.exe MD5: BD4A1CC3429ED1251E5185A72501839B)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DBatLoaderThis Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader
NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["frontofficefax20.home-webserver.de:4126:0"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "oiuytu-9JC965", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "iuytrtyu", "Keylog file max size": ""}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\ProgramData\iuytrtyu\logs.datJoeSecurity_RemcosYara detected Remcos RATJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000000E.00000003.1894324058.0000000000C0B000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      00000000.00000002.1696793726.000000000234D000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_DBatLoaderYara detected DBatLoaderJoe Security
        0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
          0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
            0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
              Click to see the 50 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              11.2.SndVol.exe.400000.0.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
                11.2.SndVol.exe.400000.0.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
                  11.2.SndVol.exe.400000.0.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                    11.2.SndVol.exe.400000.0.unpackWindows_Trojan_Remcos_b296e965unknownunknown
                    • 0x6ad08:$a1: Remcos restarted by watchdog!
                    • 0x6b280:$a3: %02i:%02i:%02i:%03i
                    11.2.SndVol.exe.400000.0.unpackREMCOS_RAT_variantsunknownunknown
                    • 0x64f94:$str_a1: C:\Windows\System32\cmd.exe
                    • 0x64f10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                    • 0x64f10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                    • 0x65410:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
                    • 0x65a10:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
                    • 0x65004:$str_b2: Executing file:
                    • 0x65e4c:$str_b3: GetDirectListeningPort
                    • 0x65800:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
                    • 0x65980:$str_b7: \update.vbs
                    • 0x6502c:$str_b9: Downloaded file:
                    • 0x65018:$str_b10: Downloading file:
                    • 0x650bc:$str_b12: Failed to upload file:
                    • 0x65e14:$str_b13: StartForward
                    • 0x65e34:$str_b14: StopForward
                    • 0x658d8:$str_b15: fso.DeleteFile "
                    • 0x6586c:$str_b16: On Error Resume Next
                    • 0x65908:$str_b17: fso.DeleteFolder "
                    • 0x650ac:$str_b18: Uploaded file:
                    • 0x6506c:$str_b19: Unable to delete:
                    • 0x658a0:$str_b20: while fso.FileExists("
                    • 0x65549:$str_c0: [Firefox StoredLogins not found]
                    Click to see the 106 entries

                    Sigma Signatures

                    System Summary

                    barindex
                    Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
                    Source: File createdAuthor: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\Desktop\IRSTaxRefund.exe, ProcessId: 7292, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll
                    Sigma detected: Execution from Suspicious Folder
                    Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Libraries\Tmohrqmb.PIF" , CommandLine: "C:\Users\Public\Libraries\Tmohrqmb.PIF" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\Tmohrqmb.PIF, NewProcessName: C:\Users\Public\Libraries\Tmohrqmb.PIF, OriginalFileName: C:\Users\Public\Libraries\Tmohrqmb.PIF, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\Public\Libraries\Tmohrqmb.PIF" , ProcessId: 7732, ProcessName: Tmohrqmb.PIF
                    Sigma detected: New RUN Key Pointing to Suspicious Folder
                    Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Tmohrqmb.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\IRSTaxRefund.exe, ProcessId: 7292, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tmohrqmb
                    Sigma detected: Suspicious Creation with Colorcpl
                    Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\colorcpl.exe, ProcessId: 7472, TargetFilename: C:\Users\user
                    Sigma detected: CurrentVersion Autorun Keys Modification
                    Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Tmohrqmb.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\IRSTaxRefund.exe, ProcessId: 7292, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tmohrqmb
                    Sigma detected: Execution of Suspicious File Type Extension
                    Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\Public\Libraries\Tmohrqmb.PIF" , CommandLine: "C:\Users\Public\Libraries\Tmohrqmb.PIF" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\Tmohrqmb.PIF, NewProcessName: C:\Users\Public\Libraries\Tmohrqmb.PIF, OriginalFileName: C:\Users\Public\Libraries\Tmohrqmb.PIF, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\Public\Libraries\Tmohrqmb.PIF" , ProcessId: 7732, ProcessName: Tmohrqmb.PIF

                    Suricata Signatures

                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2025-02-15T12:36:11.706599+010020327761Malware Command and Control Activity Detected192.168.2.44973145.144.214.1264126TCP
                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2025-02-15T12:36:12.606616+010020327771Malware Command and Control Activity Detected45.144.214.1264126192.168.2.449731TCP
                    2025-02-15T12:38:21.529583+010020327771Malware Command and Control Activity Detected45.144.214.1264126192.168.2.449731TCP
                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2025-02-15T12:36:13.620424+010028033043Unknown Traffic192.168.2.449733178.237.33.5080TCP

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Found malware configuration
                    Source: 5.2.colorcpl.exe.7151985.4.raw.unpackMalware Configuration Extractor: Remcos {"Host:Port:Password": ["frontofficefax20.home-webserver.de:4126:0"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "oiuytu-9JC965", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "iuytrtyu", "Keylog file max size": ""}
                    Multi AV Scanner detection for dropped file
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFReversingLabs: Detection: 27%
                    Multi AV Scanner detection for submitted file
                    Source: IRSTaxRefund.exeReversingLabs: Detection: 27%
                    Source: IRSTaxRefund.exeVirustotal: Detection: 33%Perma Link
                    Yara detected Remcos RAT
                    Source: Yara matchFile source: 11.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac1985.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc1985.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7151985.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7150000.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7150000.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc1985.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7151985.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac1985.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000E.00000003.1894324058.0000000000C0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.1896020251.0000000004BC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4146895773.0000000007150000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000002.1811552220.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4143664674.0000000003011000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.1894763646.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.1811250276.0000000000C40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000003.1894262247.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4140858643.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 7472, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 7784, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 8036, type: MEMORYSTR
                    Source: Yara matchFile source: C:\ProgramData\iuytrtyu\logs.dat, type: DROPPED
                    Joe Sandbox ML detected suspicious sample
                    Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00432B45 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,5_2_00432B45
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_071838CA CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,5_2_071838CA
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00432B45 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,11_2_00432B45
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AF38CA CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,11_2_04AF38CA
                    Source: colorcpl.exeBinary or memory string: -----BEGIN PUBLIC KEY-----

                    Exploits

                    barindex
                    Yara detected UAC Bypass using CMSTP
                    Source: Yara matchFile source: 11.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac1985.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc1985.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7151985.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7150000.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7150000.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc1985.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7151985.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac1985.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.1896020251.0000000004BC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4146895773.0000000007150000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000002.1811552220.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.1894763646.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4140858643.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 7472, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 7784, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 8036, type: MEMORYSTR

                    Privilege Escalation

                    barindex
                    Contains functionality to bypass UAC (CMSTPLUA)
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00406764 _wcslen,CoGetObject,5_2_00406764
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00406764 _wcslen,CoGetObject,11_2_00406764
                    Source: IRSTaxRefund.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                    Source: Binary string: easinvoker.pdb source: IRSTaxRefund.exe, 00000000.00000002.1716729044.00000000207CB000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1671698705.000000007F060000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1671698705.000000007F073000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1671125001.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000002.1716729044.000000002079C000.00000004.00001000.00020000.00000000.sdmp, svchost.pif.0.dr
                    Source: Binary string: easinvoker.pdbGCTL source: IRSTaxRefund.exe, 00000000.00000002.1716729044.00000000207CB000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1682384750.0000000000857000.00000004.00000020.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1671698705.000000007F060000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1682384750.0000000000886000.00000004.00000020.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1671698705.000000007F073000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1671125001.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000002.1716729044.000000002079C000.00000004.00001000.00020000.00000000.sdmp, svchost.pif.0.dr
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0297534C GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,0_2_0297534C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,5_2_0040B335
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,5_2_0040B53A
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0041B63A FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,5_2_0041B63A
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,5_2_004089A9
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00406AC2 FindFirstFileW,FindNextFileW,5_2_00406AC2
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,5_2_00407A8C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,5_2_00408DA7
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00418E5F FindFirstFileW,FindNextFileW,FindNextFileW,5_2_00418E5F
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0716C3BF FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,5_2_0716C3BF
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0715C2BF FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,5_2_0715C2BF
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0715C0BA FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,5_2_0715C0BA
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07158811 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,5_2_07158811
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0715972E __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,5_2_0715972E
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07159B2C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,5_2_07159B2C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07169BE4 FindFirstFileW,5_2_07169BE4
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07157847 FindFirstFileW,FindNextFileW,5_2_07157847
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_052910F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,5_2_052910F1
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0040AE51 FindFirstFileW,FindNextFileW,7_2_0040AE51
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,8_2_00407EF8
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,9_2_00407898
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,11_2_0040B335
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,11_2_0040B53A
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0041B63A FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,11_2_0041B63A
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,11_2_004089A9
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00406AC2 FindFirstFileW,FindNextFileW,11_2_00406AC2
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,11_2_00407A8C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,11_2_00408DA7
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00418E5F FindFirstFileW,FindNextFileW,FindNextFileW,11_2_00418E5F
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04ACC0BA FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,11_2_04ACC0BA
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04ACC2BF FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,11_2_04ACC2BF
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04ADC3BF FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,11_2_04ADC3BF
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AC8811 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,11_2_04AC8811
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AC972E __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,11_2_04AC972E
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AC7847 FindFirstFileW,FindNextFileW,11_2_04AC7847
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AD9BE4 FindFirstFileW,11_2_04AD9BE4
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AC9B2C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,11_2_04AC9B2C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,5_2_00406F06

                    Networking

                    barindex
                    Suricata IDS alerts for network traffic
                    Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49731 -> 45.144.214.126:4126
                    Source: Network trafficSuricata IDS: 2032777 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Server Response : 45.144.214.126:4126 -> 192.168.2.4:49731
                    C2 URLs / IPs found in malware configuration
                    Source: Malware configuration extractorURLs: frontofficefax20.home-webserver.de
                    Source: global trafficTCP traffic: 192.168.2.4:49731 -> 45.144.214.126:4126
                    Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                    Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
                    Source: Joe Sandbox ViewASN Name: HPC-MVM-ASHU HPC-MVM-ASHU
                    Source: Network trafficSuricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49733 -> 178.237.33.50:80
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0040455B WaitForSingleObject,SetEvent,recv,5_2_0040455B
                    Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                    Source: colorcpl.exe, 00000005.00000002.4146646241.0000000005260000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000009.00000002.1727076537.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
                    Source: colorcpl.exe, colorcpl.exe, 00000009.00000002.1727076537.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
                    Source: colorcpl.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
                    Source: bhv6B80.tmp.7.drString found in binary or memory: pop-lva1.www.linkedin.com equals www.linkedin.com (Linkedin)
                    Source: bhv6B80.tmp.7.drString found in binary or memory: pop-lva1.www.linkedin.com0 equals www.linkedin.com (Linkedin)
                    Source: colorcpl.exe, 00000007.00000003.1744514210.000000000304D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
                    Source: colorcpl.exe, 00000007.00000003.1744514210.000000000304D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
                    Source: colorcpl.exe, 00000005.00000002.4159571342.00000000260F0000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000007.00000002.1745203628.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
                    Source: colorcpl.exe, 00000005.00000002.4159571342.00000000260F0000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000007.00000002.1745203628.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)
                    Source: global trafficDNS traffic detected: DNS query: frontofficefax20.home-webserver.de
                    Source: global trafficDNS traffic detected: DNS query: geoplugin.net
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertCloudServicesCA-1.crt0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crt0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertCloudServicesCA-1-g1.crl0?
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl3.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0H
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertCloudServicesCA-1-g1.crl0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0~
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://crl4.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0
                    Source: colorcpl.exe, 00000005.00000003.1717700032.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1714653918.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1719040592.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1720924755.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1721215104.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1721716564.0000000003064000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/V
                    Source: colorcpl.exe, 00000005.00000003.1747361234.0000000003021000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1721215104.000000000305E000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.4145914838.000000000305E000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1717832744.000000000305C000.00000004.00000020.00020000.00000000.sdmp, SndVol.exeString found in binary or memory: http://geoplugin.net/json.gp
                    Source: colorcpl.exe, 00000005.00000002.4146895773.0000000007150000.00000040.00000400.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.4140858643.0000000000400000.00000040.00001000.00020000.00000000.sdmp, SndVol.exe, 0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmp, SndVol.exe, 0000000B.00000002.1811552220.0000000000400000.00000040.00001000.00020000.00000000.sdmp, SndVol.exe, 0000000E.00000002.1896020251.0000000004BC0000.00000040.00000400.00020000.00000000.sdmp, SndVol.exe, 0000000E.00000002.1894763646.0000000000400000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
                    Source: colorcpl.exe, 00000005.00000002.4143664674.0000000002FD4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp?
                    Source: colorcpl.exe, 00000005.00000003.1717700032.0000000003021000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1721716564.0000000003030000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1714509144.0000000003031000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1720924755.0000000003030000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpJ
                    Source: colorcpl.exe, 00000005.00000002.4143664674.0000000002FD4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpQ
                    Source: colorcpl.exe, 00000005.00000003.1717700032.0000000003021000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.4145546656.000000000302F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1721716564.0000000003030000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1714509144.0000000003031000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1720924755.0000000003030000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1747361234.0000000003021000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpSystem32
                    Source: colorcpl.exe, 00000005.00000002.4143664674.0000000002FD4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpT
                    Source: colorcpl.exe, 00000005.00000003.1717700032.0000000003021000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1721716564.0000000003030000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1714509144.0000000003031000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1720924755.0000000003030000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpl
                    Source: colorcpl.exe, 00000005.00000003.1717700032.0000000003021000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.4145546656.000000000302F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1721716564.0000000003030000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1714509144.0000000003031000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1720924755.0000000003030000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1747361234.0000000003021000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpr
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://ocsp.digicert.com0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://ocsp.digicert.com0:
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://ocsp.digicert.com0H
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://ocsp.digicert.com0I
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://ocsp.digicert.com0Q
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://ocsp.msocsp.com0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://ocsp.msocsp.com0S
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://ocspx.digicert.com0E
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://www.digicert.com/CPS0
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://www.digicert.com/CPS0~
                    Source: colorcpl.exe, colorcpl.exe, 00000009.00000002.1727076537.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com
                    Source: colorcpl.exe, colorcpl.exe, 00000009.00000002.1727740365.0000000000D5D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000009.00000002.1727076537.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.com
                    Source: colorcpl.exe, 00000005.00000002.4146646241.0000000005260000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000009.00000002.1727076537.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
                    Source: colorcpl.exe, 00000005.00000002.4146646241.0000000005260000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000009.00000002.1727076537.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comr
                    Source: colorcpl.exe, 00000009.00000002.1727740365.0000000000D5D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.imvu.comta
                    Source: bhv6B80.tmp.7.drString found in binary or memory: http://www.msftconnecttest.com/connecttest.txt?n=1696334965379
                    Source: colorcpl.exe, 00000007.00000002.1745441308.0000000000A34000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net
                    Source: colorcpl.exe, 00000009.00000002.1727076537.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net/
                    Source: IRSTaxRefund.exe, 00000000.00000002.1741661236.000000007ED9F000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000002.1716729044.0000000020839000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1671698705.000000007F0EC000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1671698705.000000007F073000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.pmail.com
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?18b635b804a8d6ad0a1fa437
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?c9b5e9d2b836931c8ddd4e8d
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?1c89d9658c6af83a02d98b03
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?74b620657ac570f7999e6ad7
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?cf2d8bf3b68a3e37eef992d5
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?fc66b8a78ab7a1394f56e742
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?66601c3b572f284b9da07fcc
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?f67d919da1a9ba8a5672367d
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=W
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?467894188c5d788807342326
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?a176b93f037f93b5720edf68
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://config.edge.skype.com/config/v1/ODSP_Sync_Client/19.043.0304.0013?UpdateRing=Prod&OS=Win&OSV
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://config.edge.skype.com/config/v1/Skype/1446_8.53.0.77?OSVer=10.0.19045.2006&ClientID=RHTiQUpX
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BL2r8e&Fr
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BLUr5a&Fr
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-BL2r8e&FrontEnd=AFD
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp-afd-nocache-ccp.azureedge.net/apc/trans.gif?99bdaa7641aea1439604d0afe8971477
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp-afd-nocache-ccp.azureedge.net/apc/trans.gif?bc7d158a1b0c0bcddb88a222b6122bda
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?60caefc8ca640843bccad421cfaadcc8
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?a9bddedb22fa9ee1d455a5d5a89b950c
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp-vp-nocache.azureedge.net/apc/trans.gif?4be9f57fdbd89d63c136fa90032d1d91
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp-vp-nocache.azureedge.net/apc/trans.gif?e5772e13592c9d33c9159aed24f891a7
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?a6aceac28fb5ae421a73cab7cdd76bd8
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?b57fe5cd49060a950d25a1d237496815
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?2f6c563d6db8702d4f61cfc28e14d6ba
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?3dacce210479f0b4d47ed33c21160712
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?7e0e9c3a9f02f17275e789accf11532b
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?81f59f7d566abbd2077a5b6cdfd04c7b
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?3c5bdbf226e2549812723f51b8fe2023
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?c50299ad5b45bb3d4c7a57024998a291
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://fp.msedge.net/conf/v2/asgw/fpconfig.min.json?monitorId=asgw
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                    Source: colorcpl.exe, 00000007.00000003.1744514210.000000000304D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.liv
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3-4102-ae
                    Source: colorcpl.exeString found in binary or memory: https://login.yahoo.com/config/login
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.css
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_sKiljltKC1Ne_Y3fl1HuHQ2.css
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_BxKM4IRLudkIao5qo
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOq
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2.js
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2.js
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://maps.windows.com/windows-app-web-link
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-09-17-00-05-23/PreSignInSettingsConfig.json?One
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/update100.xml?OneDriveUpdate=27ff908e89d7b6264fde
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/dfb21df16475d4e5b2b0ba41e6c4e842c100b150.xml?OneDriveUpdate=586ba6
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/dfb21df16475d4e5b2b0ba41e6c4e842c100b150.xml?OneDriveUpdate=7ccb04
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/dfb21df16475d4e5b2b0ba41e6c4e842c100b150.xml?OneDriveUpdate=b1ed69
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?17a81fd4cdc7fc73a2b4cf5b67ff816d
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?29331761644ba41ebf9abf96ecc6fbad
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?2f153f40414852a5ead98f4103d563a8
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?a50e32ebd978eda4d21928b1dbc78135
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/ew-preload-inline-2523c8c1505f1172be19.js
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-104bffe9378b8041455c.js
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-35de8a913e.css
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-async-styles.a903b7d0ab82e5bd2f8a.chunk.v7.css
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bootstrap-5e7af218e953d095fabf.js
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-0debb885be07c402c948.js
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-994d8943fc9264e2f8d3.css
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-fluent~left-nav-rc.ec3581b6c9e6e9985aa7.chunk.v7.js
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-forms-group~mru~officeforms-group-forms~officeforms
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-left-nav-rc.6c288f9aff9797959103.chunk.v7.js
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-mru.9ba2d4c9e339ba497e10.chunk.v7.js
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendor-bundle-1652fd8b358d589e6ec0.js
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.52c45571d19ede0a7005.chunk.v7.j
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.d918c7fc33e22b41b936.chunk.v7.c
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwaunauth-9d8bc214ac.css
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedfontstyles-27fa2598d8.css
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedscripts-939520eada.js
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticpwascripts-30998bff8f.js
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticstylesfabric-35c34b95e3.css
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/hero-image-desktop-f6720a4145.jpg
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/lockup-mslogo-color-78c06e8898.png
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/microsoft-365-logo-01d5ecd01a.png
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-apps-image-46596a6856.png
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-checkmark-image-1999f0bf81.png
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/officehome/thirdpartynotice.html
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_regular.woff2
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_semibold.woff2
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://rum8.perf.linkedin.com/apc/trans.gif?690daf9375f3d267a5b7b08fbc174993
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://rum8.perf.linkedin.com/apc/trans.gif?fe61b216ccbcc1bca02cb20f2e94fb51
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?909b77fc750668f20e07288ff0ed43e2
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?c6931b9e725f95cf9c20849dd6498c59
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://www.digicert.com/CPS0
                    Source: colorcpl.exe, colorcpl.exe, 00000009.00000002.1727076537.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
                    Source: colorcpl.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
                    Source: bhv6B80.tmp.7.drString found in binary or memory: https://www.office.com/

                    Key, Mouse, Clipboard, Microphone and Screen Capturing

                    barindex
                    Contains functionality to register a low level keyboard hook
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_004099E4 SetWindowsHookExA 0000000D,004099D0,000000005_2_004099E4
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,5_2_00415B5E
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,5_2_00415B5E
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_071668E3 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,5_2_071668E3
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,7_2_0040987A
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,7_2_004098E2
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,8_2_00406DFC
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,8_2_00406E9F
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,9_2_004068B5
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,9_2_004072B5
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,11_2_00415B5E
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AD68E3 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,11_2_04AD68E3
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,5_2_00415B5E
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00409B10 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,5_2_00409B10
                    Source: Yara matchFile source: 11.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac1985.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc1985.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7151985.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7150000.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7150000.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc1985.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7151985.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac1985.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.1896020251.0000000004BC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4146895773.0000000007150000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000002.1811552220.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.1894763646.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4140858643.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 7472, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 7784, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 8036, type: MEMORYSTR

                    E-Banking Fraud

                    barindex
                    Yara detected Remcos RAT
                    Source: Yara matchFile source: 11.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac1985.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc1985.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7151985.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7150000.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7150000.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc1985.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7151985.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac1985.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000E.00000003.1894324058.0000000000C0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.1896020251.0000000004BC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4146895773.0000000007150000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000002.1811552220.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4143664674.0000000003011000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.1894763646.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.1811250276.0000000000C40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000003.1894262247.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4140858643.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 7472, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 7784, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 8036, type: MEMORYSTR
                    Source: Yara matchFile source: C:\ProgramData\iuytrtyu\logs.dat, type: DROPPED

                    Spam, unwanted Advertisements and Ransom Demands

                    barindex
                    Contains functionalty to change the wallpaper
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0041BD82 SystemParametersInfoW,5_2_0041BD82
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0716CB07 SystemParametersInfoW,5_2_0716CB07
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0041BD82 SystemParametersInfoW,11_2_0041BD82
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04ADCB07 SystemParametersInfoW,11_2_04ADCB07

                    System Summary

                    barindex
                    Malicious sample detected (through community Yara rule)
                    Source: 11.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 11.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 11.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 11.2.SndVol.exe.4ac1985.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 11.2.SndVol.exe.4ac1985.2.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 11.2.SndVol.exe.4ac1985.2.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 14.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 14.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 14.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 11.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 11.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 11.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 14.2.SndVol.exe.4bc1985.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 14.2.SndVol.exe.4bc1985.2.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 14.2.SndVol.exe.4bc1985.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 11.2.SndVol.exe.4ac0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 11.2.SndVol.exe.4ac0000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 11.2.SndVol.exe.4ac0000.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 11.2.SndVol.exe.4ac0000.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 11.2.SndVol.exe.4ac0000.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 11.2.SndVol.exe.4ac0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 14.2.SndVol.exe.4bc0000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 14.2.SndVol.exe.4bc0000.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 14.2.SndVol.exe.4bc0000.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 5.2.colorcpl.exe.7151985.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 5.2.colorcpl.exe.7151985.4.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 5.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 5.2.colorcpl.exe.7151985.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 5.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 5.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 14.2.SndVol.exe.4bc0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 14.2.SndVol.exe.4bc0000.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 14.2.SndVol.exe.4bc0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 14.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 14.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 14.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 5.2.colorcpl.exe.7150000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 5.2.colorcpl.exe.7150000.3.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 5.2.colorcpl.exe.7150000.3.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 5.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 5.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 5.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 5.2.colorcpl.exe.7150000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 5.2.colorcpl.exe.7150000.3.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 5.2.colorcpl.exe.7150000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 14.2.SndVol.exe.4bc1985.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 14.2.SndVol.exe.4bc1985.2.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 14.2.SndVol.exe.4bc1985.2.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 5.2.colorcpl.exe.7151985.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 5.2.colorcpl.exe.7151985.4.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 5.2.colorcpl.exe.7151985.4.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 11.2.SndVol.exe.4ac1985.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 11.2.SndVol.exe.4ac1985.2.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 11.2.SndVol.exe.4ac1985.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 0000000E.00000002.1896020251.0000000004BC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 0000000E.00000002.1896020251.0000000004BC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 0000000E.00000002.1896020251.0000000004BC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 00000005.00000002.4146895773.0000000007150000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 00000005.00000002.4146895773.0000000007150000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 00000005.00000002.4146895773.0000000007150000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 0000000B.00000002.1811552220.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 0000000B.00000002.1811552220.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 0000000B.00000002.1811552220.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 0000000E.00000002.1894763646.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 0000000E.00000002.1894763646.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 0000000E.00000002.1894763646.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 00000005.00000002.4140858643.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 00000005.00000002.4140858643.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 00000005.00000002.4140858643.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: Process Memory Space: colorcpl.exe PID: 7472, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: Process Memory Space: SndVol.exe PID: 7784, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: Process Memory Space: SndVol.exe PID: 8036, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Initial sample is a PE file and has a suspicious name
                    Source: initial sampleStatic PE information: Filename: IRSTaxRefund.exe
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess Stats: CPU usage > 49%
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_029833F8 NtWriteVirtualMemory,0_2_029833F8
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_029830AC NtAllocateVirtualMemory,0_2_029830AC
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_029896E4 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,0_2_029896E4
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02989600 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,0_2_02989600
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02989578 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,0_2_02989578
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02986A8C GetModuleHandleW,NtOpenProcess,IsBadReadPtr,IsBadReadPtr,GetModuleHandleW,NtCreateThreadEx,0_2_02986A8C
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_029842A8 GetThreadContext,SetThreadContext,NtResumeThread,0_2_029842A8
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_029842A6 GetThreadContext,SetThreadContext,NtResumeThread,0_2_029842A6
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_029830AA NtAllocateVirtualMemory,0_2_029830AA
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02989524 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,0_2_02989524
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02983A14 NtProtectVirtualMemory,0_2_02983A14
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0041742B GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,5_2_0041742B
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0041AECC OpenProcess,NtSuspendProcess,CloseHandle,5_2_0041AECC
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0041AEF8 OpenProcess,NtResumeProcess,CloseHandle,5_2_0041AEF8
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_071681B0 CreateProcessW,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,5_2_071681B0
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0716BC51 OpenProcess,NtSuspendProcess,CloseHandle,5_2_0716BC51
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0716BC7D OpenProcess,NtResumeProcess,CloseHandle,5_2_0716BC7D
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0716DA2E NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,5_2_0716DA2E
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,7_2_0040DD85
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_00401806 NtdllDefWindowProc_W,7_2_00401806
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_004018C0 NtdllDefWindowProc_W,7_2_004018C0
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_004016FD NtdllDefWindowProc_A,8_2_004016FD
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_004017B7 NtdllDefWindowProc_A,8_2_004017B7
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_00402CAC NtdllDefWindowProc_A,9_2_00402CAC
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_00402D66 NtdllDefWindowProc_A,9_2_00402D66
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: 10_2_02AC6A8C GetModuleHandleW,NtOpenProcess,IsBadReadPtr,IsBadReadPtr,GetModuleHandleW,NtCreateThreadEx,10_2_02AC6A8C
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: 10_2_02AC33F8 NtWriteVirtualMemory,10_2_02AC33F8
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: 10_2_02AC30AC NtAllocateVirtualMemory,10_2_02AC30AC
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: 10_2_02AC96E4 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,10_2_02AC96E4
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: 10_2_02AC3AAC NtProtectVirtualMemory,10_2_02AC3AAC
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: 10_2_02AC42A8 Toolhelp32ReadProcessMemory,Thread32Next,GetThreadContext,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Toolhelp32ReadProcessMemory,Heap32ListFirst,SetThreadContext,NtResumeThread,Thread32Next,10_2_02AC42A8
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: 10_2_02AC42A6 Toolhelp32ReadProcessMemory,Thread32Next,GetThreadContext,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Toolhelp32ReadProcessMemory,Heap32ListFirst,SetThreadContext,NtResumeThread,Thread32Next,10_2_02AC42A6
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: 10_2_02AC3A14 NtProtectVirtualMemory,10_2_02AC3A14
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: 10_2_02AC30AA NtAllocateVirtualMemory,10_2_02AC30AA
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: 10_2_02AC9600 RtlDosPathNameToNtPathName_U,NtWriteFile,NtClose,10_2_02AC9600
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: 10_2_02AC3493 NtWriteVirtualMemory,10_2_02AC3493
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: 10_2_02AC9524 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,10_2_02AC9524
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: 10_2_02AC9578 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,10_2_02AC9578
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04ADDA2E NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,11_2_04ADDA2E
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0298AE54 InetIsOffline,Sleep,Sleep,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,0_2_0298AE54
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00415A51 ExitWindowsEx,LoadLibraryA,GetProcAddress,5_2_00415A51
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_071667D6 ExitWindowsEx,LoadLibraryA,GetProcAddress,5_2_071667D6
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00415A51 ExitWindowsEx,LoadLibraryA,GetProcAddress,11_2_00415A51
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AD67D6 ExitWindowsEx,LoadLibraryA,GetProcAddress,11_2_04AD67D6
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeFile created: C:\Windows \SysWOW64\svchost.pifJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeFile created: C:\Windows \SysWOW64\NETUTILS.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\WindowsJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Windows \SysWOW64Jump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeFile deleted: C:\Windows \SysWOW64\svchost.pifJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_029720B40_2_029720B4
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0043D04B5_2_0043D04B
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0042707E5_2_0042707E
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0041301D5_2_0041301D
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_004410305_2_00441030
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_004531105_2_00453110
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_004271B85_2_004271B8
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0041D27C5_2_0041D27C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_004522E25_2_004522E2
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0043D2A85_2_0043D2A8
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_004373605_2_00437360
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_004363BA5_2_004363BA
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0042645F5_2_0042645F
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_004315825_2_00431582
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0043672C5_2_0043672C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0041E7EA5_2_0041E7EA
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0044C9495_2_0044C949
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_004269D65_2_004269D6
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_004369D65_2_004369D6
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0043CBED5_2_0043CBED
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00432C545_2_00432C54
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00436C9D5_2_00436C9D
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0043CE1C5_2_0043CE1C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00436F585_2_00436F58
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00434F325_2_00434F32
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_071823075_2_07182307
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0716E0015_2_0716E001
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0718E02D5_2_0718E02D
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_071880E55_2_071880E5
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0718775B5_2_0718775B
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0717775B5_2_0717775B
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0719D6CE5_2_0719D6CE
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0716F56F5_2_0716F56F
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_071874B15_2_071874B1
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0718713F5_2_0718713F
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_071771E45_2_071771E4
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_071A30675_2_071A3067
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07177F3D5_2_07177F3D
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07177E035_2_07177E03
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07191DB55_2_07191DB5
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07163DA25_2_07163DA2
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0718DDD05_2_0718DDD0
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07185CB75_2_07185CB7
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07187CDD5_2_07187CDD
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0718DBA15_2_0718DBA1
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07187A225_2_07187A22
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0718D9725_2_0718D972
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_071839D95_2_071839D9
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0529B5C15_2_0529B5C1
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_052A71945_2_052A7194
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0044B0407_2_0044B040
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0043610D7_2_0043610D
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_004473107_2_00447310
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0044A4907_2_0044A490
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0040755A7_2_0040755A
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0043C5607_2_0043C560
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0044B6107_2_0044B610
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0044D6C07_2_0044D6C0
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_004476F07_2_004476F0
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0044B8707_2_0044B870
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0044081D7_2_0044081D
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_004149577_2_00414957
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_004079EE7_2_004079EE
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_00407AEB7_2_00407AEB
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0044AA807_2_0044AA80
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_00412AA97_2_00412AA9
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_00404B747_2_00404B74
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_00404B037_2_00404B03
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0044BBD87_2_0044BBD8
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_00404BE57_2_00404BE5
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_00404C767_2_00404C76
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_00415CFE7_2_00415CFE
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_00416D727_2_00416D72
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_00446D307_2_00446D30
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_00446D8B7_2_00446D8B
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_00406E8F7_2_00406E8F
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_004050388_2_00405038
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_0041208C8_2_0041208C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_004050A98_2_004050A9
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_0040511A8_2_0040511A
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_0043C13A8_2_0043C13A
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_004051AB8_2_004051AB
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_004493008_2_00449300
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_0040D3228_2_0040D322
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_0044A4F08_2_0044A4F0
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_0043A5AB8_2_0043A5AB
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_004136318_2_00413631
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_004466908_2_00446690
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_0044A7308_2_0044A730
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_004398D88_2_004398D8
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_004498E08_2_004498E0
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_0044A8868_2_0044A886
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_0043DA098_2_0043DA09
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_00438D5E8_2_00438D5E
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_00449ED08_2_00449ED0
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_0041FE838_2_0041FE83
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_00430F548_2_00430F54
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_004050C29_2_004050C2
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_004014AB9_2_004014AB
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_004051339_2_00405133
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_004051A49_2_004051A4
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_004012469_2_00401246
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_0040CA469_2_0040CA46
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_004052359_2_00405235
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_004032C89_2_004032C8
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_004016899_2_00401689
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_00402F609_2_00402F60
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: 10_2_02AB20B410_2_02AB20B4
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0043D04B11_2_0043D04B
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0042707E11_2_0042707E
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0041301D11_2_0041301D
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0044103011_2_00441030
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0045311011_2_00453110
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_004271B811_2_004271B8
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0041D27C11_2_0041D27C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_004522E211_2_004522E2
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0043D2A811_2_0043D2A8
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0043736011_2_00437360
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_004363BA11_2_004363BA
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0042645F11_2_0042645F
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0043158211_2_00431582
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0043672C11_2_0043672C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0041E7EA11_2_0041E7EA
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0044C94911_2_0044C949
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_004269D611_2_004269D6
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_004369D611_2_004369D6
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0043CBED11_2_0043CBED
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00432C5411_2_00432C54
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00436C9D11_2_00436C9D
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0043CE1C11_2_0043CE1C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00436F5811_2_00436F58
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00434F3211_2_00434F32
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AF80E511_2_04AF80E5
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AFE02D11_2_04AFE02D
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04ADE00111_2_04ADE001
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AF230711_2_04AF2307
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AF74B111_2_04AF74B1
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04ADF56F11_2_04ADF56F
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04B0D6CE11_2_04B0D6CE
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AF775B11_2_04AF775B
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AE775B11_2_04AE775B
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04B1306711_2_04B13067
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AE71E411_2_04AE71E4
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AF713F11_2_04AF713F
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AF5CB711_2_04AF5CB7
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AF7CDD11_2_04AF7CDD
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04B01DB511_2_04B01DB5
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AD3DA211_2_04AD3DA2
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AFDDD011_2_04AFDDD0
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AE7E0311_2_04AE7E03
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AE7F3D11_2_04AE7F3D
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AF39D911_2_04AF39D9
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AFD97211_2_04AFD972
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AF7A2211_2_04AF7A22
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AFDBA111_2_04AFDBA1
                    Source: Joe Sandbox ViewDropped File: C:\Windows \SysWOW64\svchost.pif 0DB4D3FFDB96D13CF3B427AF8BE66D985728C55AE254E4B67D287797E4C0B323
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: String function: 02974444 appears 154 times
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: String function: 02983E98 appears 50 times
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: String function: 0297424C appears 64 times
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: String function: 029745D0 appears 576 times
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: String function: 02974270 appears 31 times
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: String function: 02AB45D0 appears 576 times
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: String function: 02AC3E98 appears 50 times
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: String function: 02AB4444 appears 154 times
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 004169A7 appears 87 times
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 00433AB0 appears 41 times
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 004165FF appears 35 times
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 004341C0 appears 55 times
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 00422297 appears 42 times
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 00401F66 appears 50 times
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 07152E6C appears 39 times
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 004020E7 appears 40 times
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 07184835 appears 40 times
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 0044DB70 appears 41 times
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 07184F45 appears 54 times
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 00444B5A appears 37 times
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 00413025 appears 79 times
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 00416760 appears 69 times
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: String function: 004020E7 appears 39 times
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: String function: 00433AB0 appears 41 times
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: String function: 04AC2E6C appears 39 times
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: String function: 004341C0 appears 55 times
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: String function: 04AF4F45 appears 54 times
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: String function: 00401F66 appears 50 times
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: String function: 04AF4835 appears 40 times
                    Source: NETUTILS.dll.0.drStatic PE information: Number of sections : 19 > 10
                    Source: IRSTaxRefund.exe, 00000000.00000003.1671125001.000000007ED0C000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs IRSTaxRefund.exe
                    Source: IRSTaxRefund.exe, 00000000.00000002.1716729044.00000000207CB000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs IRSTaxRefund.exe
                    Source: IRSTaxRefund.exe, 00000000.00000002.1741661236.000000007ED9F000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLOADER.EXEB vs IRSTaxRefund.exe
                    Source: IRSTaxRefund.exe, 00000000.00000002.1716729044.0000000020839000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs IRSTaxRefund.exe
                    Source: IRSTaxRefund.exe, 00000000.00000002.1716729044.0000000020839000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLOADER.EXEB vs IRSTaxRefund.exe
                    Source: IRSTaxRefund.exe, 00000000.00000003.1682384750.00000000008AA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs IRSTaxRefund.exe
                    Source: IRSTaxRefund.exe, 00000000.00000003.1671698705.000000007F0EC000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs IRSTaxRefund.exe
                    Source: IRSTaxRefund.exe, 00000000.00000003.1671698705.000000007F0EC000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLOADER.EXEB vs IRSTaxRefund.exe
                    Source: IRSTaxRefund.exe, 00000000.00000003.1671698705.000000007F073000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs IRSTaxRefund.exe
                    Source: IRSTaxRefund.exe, 00000000.00000003.1671698705.000000007F073000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLOADER.EXEB vs IRSTaxRefund.exe
                    Source: IRSTaxRefund.exe, 00000000.00000003.1682384750.000000000087B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs IRSTaxRefund.exe
                    Source: IRSTaxRefund.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                    Source: 11.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 11.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 11.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 11.2.SndVol.exe.4ac1985.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 11.2.SndVol.exe.4ac1985.2.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 11.2.SndVol.exe.4ac1985.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 14.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 14.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 14.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 11.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 11.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 11.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 14.2.SndVol.exe.4bc1985.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 14.2.SndVol.exe.4bc1985.2.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 14.2.SndVol.exe.4bc1985.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 11.2.SndVol.exe.4ac0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 11.2.SndVol.exe.4ac0000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 11.2.SndVol.exe.4ac0000.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 11.2.SndVol.exe.4ac0000.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 11.2.SndVol.exe.4ac0000.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 11.2.SndVol.exe.4ac0000.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 14.2.SndVol.exe.4bc0000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 14.2.SndVol.exe.4bc0000.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 14.2.SndVol.exe.4bc0000.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 5.2.colorcpl.exe.7151985.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 5.2.colorcpl.exe.7151985.4.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 5.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 5.2.colorcpl.exe.7151985.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 5.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 5.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 14.2.SndVol.exe.4bc0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 14.2.SndVol.exe.4bc0000.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 14.2.SndVol.exe.4bc0000.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 14.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 14.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 14.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 5.2.colorcpl.exe.7150000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 5.2.colorcpl.exe.7150000.3.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 5.2.colorcpl.exe.7150000.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 5.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 5.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 5.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 5.2.colorcpl.exe.7150000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 5.2.colorcpl.exe.7150000.3.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 5.2.colorcpl.exe.7150000.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 14.2.SndVol.exe.4bc1985.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 14.2.SndVol.exe.4bc1985.2.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 14.2.SndVol.exe.4bc1985.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 5.2.colorcpl.exe.7151985.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 5.2.colorcpl.exe.7151985.4.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 5.2.colorcpl.exe.7151985.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 11.2.SndVol.exe.4ac1985.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 11.2.SndVol.exe.4ac1985.2.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 11.2.SndVol.exe.4ac1985.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 0000000E.00000002.1896020251.0000000004BC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 0000000E.00000002.1896020251.0000000004BC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 0000000E.00000002.1896020251.0000000004BC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 00000005.00000002.4146895773.0000000007150000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 00000005.00000002.4146895773.0000000007150000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 00000005.00000002.4146895773.0000000007150000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 0000000B.00000002.1811552220.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 0000000B.00000002.1811552220.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 0000000B.00000002.1811552220.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 0000000E.00000002.1894763646.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 0000000E.00000002.1894763646.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 0000000E.00000002.1894763646.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 00000005.00000002.4140858643.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 00000005.00000002.4140858643.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 00000005.00000002.4140858643.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: Process Memory Space: colorcpl.exe PID: 7472, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: Process Memory Space: SndVol.exe PID: 7784, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: Process Memory Space: SndVol.exe PID: 8036, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: classification engineClassification label: mal100.rans.phis.troj.spyw.expl.evad.winEXE@25/11@2/2
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,7_2_004182CE
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00416C9D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,5_2_00416C9D
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07167A22 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,5_2_07167A22
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_00410DE1 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,CloseHandle,9_2_00410DE1
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00416C9D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,11_2_00416C9D
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AD7A22 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,11_2_04AD7A22
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_029779B4 GetDiskFreeSpaceA,0_2_029779B4
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0298670C CreateToolhelp32Snapshot,0_2_0298670C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0041A84A FindResourceA,LoadResource,LockResource,SizeofResource,5_2_0041A84A
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00419DBA OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,5_2_00419DBA
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeFile created: C:\Users\Public\TmohrqmbF.cmdJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeMutant created: \Sessions\1\BaseNamedObjects\oiuytu-9JC965
                    Source: C:\Windows\SysWOW64\SndVol.exeMutant created: \Sessions\1\BaseNamedObjects\Windows Volume App Window
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03
                    Source: C:\Windows\SysWOW64\colorcpl.exeFile created: C:\Users\user\AppData\Local\Temp\bhv6B80.tmpJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSystem information queried: HandleInformationJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: colorcpl.exe, colorcpl.exe, 00000007.00000002.1745203628.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                    Source: colorcpl.exe, colorcpl.exe, 00000008.00000002.1725654279.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                    Source: colorcpl.exe, 00000005.00000002.4159571342.00000000260F0000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000007.00000002.1745203628.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                    Source: colorcpl.exe, colorcpl.exe, 00000007.00000002.1745203628.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
                    Source: colorcpl.exe, colorcpl.exe, 00000007.00000002.1745203628.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                    Source: colorcpl.exe, colorcpl.exe, 00000007.00000002.1745203628.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                    Source: colorcpl.exe, 00000007.00000002.1746331179.000000000481A000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000003.1744859230.000000000481A000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000007.00000003.1744310231.000000000481A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                    Source: colorcpl.exe, colorcpl.exe, 00000007.00000002.1745203628.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                    Source: IRSTaxRefund.exeReversingLabs: Detection: 27%
                    Source: IRSTaxRefund.exeVirustotal: Detection: 33%
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeFile read: C:\Users\user\Desktop\IRSTaxRefund.exeJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeEvasive API call chain: __getmainargs,DecisionNodes,exit
                    Source: unknownProcess created: C:\Users\user\Desktop\IRSTaxRefund.exe "C:\Users\user\Desktop\IRSTaxRefund.exe"
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\TmohrqmbF.cmd" "
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\NEO.cmd" "
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\arbpnwwkbdbggftjlfvxogreibczuy"
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\arbpnwwkbdbggftjlfvxogreibczuy"
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\dlgiophmpltlilpvupprzllvriuivjxce"
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\nnlao"
                    Source: unknownProcess created: C:\Users\Public\Libraries\Tmohrqmb.PIF "C:\Users\Public\Libraries\Tmohrqmb.PIF"
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFProcess created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe
                    Source: unknownProcess created: C:\Users\Public\Libraries\Tmohrqmb.PIF "C:\Users\Public\Libraries\Tmohrqmb.PIF"
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFProcess created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\TmohrqmbF.cmd" "Jump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\NEO.cmd" "Jump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exeJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\arbpnwwkbdbggftjlfvxogreibczuy"Jump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\arbpnwwkbdbggftjlfvxogreibczuy"Jump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\dlgiophmpltlilpvupprzllvriuivjxce"Jump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\nnlao"Jump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFProcess created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exeJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFProcess created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exeJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: url.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ieframe.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: netapi32.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: wkscli.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: winmm.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: am.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ieproxy.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ieproxy.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ieproxy.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: mssip32.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: mssip32.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: mssip32.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: smartscreenps.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: smartscreenps.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: smartscreenps.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??????????.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??????????.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??????????.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??????????.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ????.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ???e???????????.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ???e???????????.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??????????.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ???.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ???.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ???.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ????.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: tquery.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: cryptdll.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: spp.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: vssapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: vsstrace.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: spp.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: vssapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: vsstrace.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: mssip32.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: spp.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: vssapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: vsstrace.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: sppwmi.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: sppcext.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: winscard.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: devobj.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: colorui.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: mscms.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: coloradapterclient.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: sti.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: textshaping.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: textinputframework.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: coreuicomponents.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: coremessaging.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: devobj.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: winmm.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: pstorec.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: vaultcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: pstorec.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: version.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: url.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ieframe.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: netapi32.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: wkscli.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: winmm.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: wininet.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ieproxy.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ieproxy.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ieproxy.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: mssip32.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: mssip32.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: mssip32.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: smartscreenps.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: smartscreenps.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: smartscreenps.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: winnsi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ????.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ???e???????????.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ???e???????????.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??????????.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ???.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ???.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ???.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ????.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: tquery.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: cryptdll.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: spp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: vssapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: vsstrace.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: spp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: vssapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: vsstrace.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: mssip32.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: spp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: vssapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: vsstrace.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppwmi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: slc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppcext.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: winscard.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: devobj.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: dwmapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: atlthunk.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: mmdevapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: devobj.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: windowscodecs.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: textshaping.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: winmm.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: version.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: url.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ieframe.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: netapi32.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: wkscli.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: winmm.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: am.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: wininet.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ieproxy.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ieproxy.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ieproxy.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: winnsi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: mssip32.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: mssip32.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: mssip32.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: smartscreenps.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: smartscreenps.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: smartscreenps.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ????.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ???e???????????.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ???e???????????.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??????????.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ???.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ???.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ???.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ????.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: tquery.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: cryptdll.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: spp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: vssapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: vsstrace.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: spp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: vssapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: vsstrace.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: mssip32.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: spp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: vssapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: vsstrace.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppwmi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: slc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppcext.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: winscard.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: devobj.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFSection loaded: sppc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: uxtheme.dll
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: dwmapi.dll
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: atlthunk.dll
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: mmdevapi.dll
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: devobj.dll
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: windowscodecs.dll
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: winmm.dll
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: urlmon.dll
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: iertutil.dll
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: srvcli.dll
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: netutils.dll
                    Source: C:\Windows\SysWOW64\SndVol.exeSection loaded: wininet.dll
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32Jump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeWindow found: window name: SysTabControl32Jump to behavior
                    Source: Window RecorderWindow detected: More than 3 window changes detected
                    Source: C:\Windows\SysWOW64\colorcpl.exeWindow detected: Number of UI elements: 12
                    Source: C:\Windows\SysWOW64\colorcpl.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
                    Source: IRSTaxRefund.exeStatic file information: File size 1629696 > 1048576
                    Source: IRSTaxRefund.exeStatic PE information: Raw size of .data is bigger than: 0x100000 < 0x114c00
                    Source: Binary string: easinvoker.pdb source: IRSTaxRefund.exe, 00000000.00000002.1716729044.00000000207CB000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1671698705.000000007F060000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1671698705.000000007F073000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1671125001.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000002.1716729044.000000002079C000.00000004.00001000.00020000.00000000.sdmp, svchost.pif.0.dr
                    Source: Binary string: easinvoker.pdbGCTL source: IRSTaxRefund.exe, 00000000.00000002.1716729044.00000000207CB000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1682384750.0000000000857000.00000004.00000020.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1671698705.000000007F060000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1682384750.0000000000886000.00000004.00000020.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1671698705.000000007F073000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000003.1671125001.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp, IRSTaxRefund.exe, 00000000.00000002.1716729044.000000002079C000.00000004.00001000.00020000.00000000.sdmp, svchost.pif.0.dr

                    Data Obfuscation

                    barindex
                    Yara detected DBatLoader
                    Source: Yara matchFile source: 0.2.IRSTaxRefund.exe.234d648.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.IRSTaxRefund.exe.234d648.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.IRSTaxRefund.exe.2970000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000002.1696793726.000000000234D000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: svchost.pif.0.drStatic PE information: 0xA57E43AD [Tue Dec 25 14:18:21 2057 UTC]
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02983E98 LoadLibraryW,GetProcAddress,FreeLibrary,0_2_02983E98
                    Source: NETUTILS.dll.0.drStatic PE information: real checksum: 0x2792e should be: 0x28440
                    Source: Tmohrqmb.PIF.0.drStatic PE information: real checksum: 0x0 should be: 0x1988e0
                    Source: IRSTaxRefund.exeStatic PE information: real checksum: 0x0 should be: 0x1988e0
                    Source: svchost.pif.0.drStatic PE information: section name: .imrsiv
                    Source: svchost.pif.0.drStatic PE information: section name: .didat
                    Source: NETUTILS.dll.0.drStatic PE information: section name: .xdata
                    Source: NETUTILS.dll.0.drStatic PE information: section name: /4
                    Source: NETUTILS.dll.0.drStatic PE information: section name: /19
                    Source: NETUTILS.dll.0.drStatic PE information: section name: /31
                    Source: NETUTILS.dll.0.drStatic PE information: section name: /45
                    Source: NETUTILS.dll.0.drStatic PE information: section name: /57
                    Source: NETUTILS.dll.0.drStatic PE information: section name: /70
                    Source: NETUTILS.dll.0.drStatic PE information: section name: /81
                    Source: NETUTILS.dll.0.drStatic PE information: section name: /92
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_029962A4 push 0299630Fh; ret 0_2_02996307
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02973240 push eax; ret 0_2_0297327C
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_029960AC push 02996125h; ret 0_2_0299611D
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02986018 push 02986050h; ret 0_2_02986048
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02984010 push 02984048h; ret 0_2_02984040
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0298400E push 02984048h; ret 0_2_02984040
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_029761BE push 02976202h; ret 0_2_029761FA
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_029761C0 push 02976202h; ret 0_2_029761FA
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_029961F8 push 02996288h; ret 0_2_02996280
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02996144 push 029961ECh; ret 0_2_029961E4
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0297F677 push 0297F6C5h; ret 0_2_0297F6BD
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0297F678 push 0297F6C5h; ret 0_2_0297F6BD
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02982488 push ecx; mov dword ptr [esp], edx0_2_0298248A
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0297C4FD push 0297C696h; ret 0_2_0297C68E
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0297C510 push 0297C696h; ret 0_2_0297C68E
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0297F56C push 0297F5E2h; ret 0_2_0297F5DA
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0298A8B4 push ecx; mov dword ptr [esp], edx0_2_0298A8B9
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0298A918 push ecx; mov dword ptr [esp], edx0_2_0298A91D
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0297BE90 push ecx; mov dword ptr [esp], edx0_2_0297BE95
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0297CEF8 pushad ; iretd 0_2_0297CEF9
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0297CE58 push 0297CE84h; ret 0_2_0297CE7C
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02982F52 push 02982FFFh; ret 0_2_02982FF7
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02982F54 push 02982FFFh; ret 0_2_02982FF7
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02995C0C push 02995DE8h; ret 0_2_02995DE0
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02983DB8 push 02983DFAh; ret 0_2_02983DF2
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02975DF4 push 02975E4Fh; ret 0_2_02975E47
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02975DF2 push 02975E4Fh; ret 0_2_02975E47
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_004560BF push ecx; ret 5_2_004560D2
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00434206 push ecx; ret 5_2_00434219
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0045C9DD push esi; ret 5_2_0045C9E6
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_004569F0 push eax; ret 5_2_00456A0E

                    Persistence and Installation Behavior

                    barindex
                    Drops PE files with a suspicious file extension
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeFile created: C:\Windows \SysWOW64\svchost.pifJump to dropped file
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeFile created: C:\Users\Public\Libraries\Tmohrqmb.PIFJump to dropped file
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00406128 ShellExecuteW,URLDownloadToFileW,5_2_00406128
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeFile created: C:\Windows \SysWOW64\svchost.pifJump to dropped file
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeFile created: C:\Users\Public\Libraries\Tmohrqmb.PIFJump to dropped file
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeFile created: C:\Windows \SysWOW64\NETUTILS.dllJump to dropped file
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeFile created: C:\Windows \SysWOW64\svchost.pifJump to dropped file
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeFile created: C:\Windows \SysWOW64\NETUTILS.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00419DBA OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,5_2_00419DBA
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run TmohrqmbJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run TmohrqmbJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02986490 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_02986490
                    Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                    Malware Analysis System Evasion

                    barindex
                    Allocates many large memory junks
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory allocated: 2A10000 memory commit 500064256Jump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory allocated: 2A11000 memory commit 500154368Jump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory allocated: 2A36000 memory commit 500002816Jump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory allocated: 2A42000 memory commit 501014528Jump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory allocated: 2B3A000 memory commit 500006912Jump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory allocated: 2B3B000 memory commit 500015104Jump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeMemory allocated: 2970000 memory commit 500064256Jump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeMemory allocated: 2971000 memory commit 500154368Jump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeMemory allocated: 2996000 memory commit 500002816Jump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeMemory allocated: 29A2000 memory commit 501014528Jump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeMemory allocated: 2A9A000 memory commit 500006912Jump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeMemory allocated: 2A9B000 memory commit 500015104Jump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory allocated: 2AB0000 memory commit 500064256Jump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory allocated: 2AB1000 memory commit 500154368Jump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory allocated: 2AD6000 memory commit 500002816Jump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory allocated: 2AE2000 memory commit 501014528Jump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory allocated: 2BDA000 memory commit 500006912Jump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory allocated: 2BDB000 memory commit 500015104Jump to behavior
                    Delayed program exit found
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0040E627 Sleep,ExitProcess,5_2_0040E627
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0715F3AC Sleep,ExitProcess,5_2_0715F3AC
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0040E627 Sleep,ExitProcess,11_2_0040E627
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04ACF3AC Sleep,ExitProcess,11_2_04ACF3AC
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,7_2_0040DD85
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,5_2_00419AB8
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,5_2_0716A83D
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,11_2_00419AB8
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,11_2_04ADA83D
                    Source: C:\Windows\SysWOW64\colorcpl.exeWindow / User API: threadDelayed 9230Jump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeWindow / User API: foregroundWindowGot 1757Jump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeDropped PE file which has not been started: C:\Windows \SysWOW64\svchost.pifJump to dropped file
                    Source: C:\Windows\SysWOW64\colorcpl.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleepgraph_5-100292
                    Source: C:\Windows\SysWOW64\colorcpl.exeAPI coverage: 9.0 %
                    Source: C:\Windows\SysWOW64\colorcpl.exeAPI coverage: 9.3 %
                    Source: C:\Windows\SysWOW64\SndVol.exeAPI coverage: 2.6 %
                    Source: C:\Windows\SysWOW64\colorcpl.exe TID: 7516Thread sleep time: -83500s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exe TID: 7520Thread sleep time: -1008000s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exe TID: 7520Thread sleep time: -27690000s >= -30000sJump to behavior
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0297534C GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,0_2_0297534C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,5_2_0040B335
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,5_2_0040B53A
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0041B63A FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,5_2_0041B63A
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,5_2_004089A9
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00406AC2 FindFirstFileW,FindNextFileW,5_2_00406AC2
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,5_2_00407A8C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,5_2_00408DA7
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00418E5F FindFirstFileW,FindNextFileW,FindNextFileW,5_2_00418E5F
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0716C3BF FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,5_2_0716C3BF
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0715C2BF FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,5_2_0715C2BF
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0715C0BA FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,5_2_0715C0BA
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07158811 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,5_2_07158811
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0715972E __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,5_2_0715972E
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07159B2C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,5_2_07159B2C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07169BE4 FindFirstFileW,5_2_07169BE4
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07157847 FindFirstFileW,FindNextFileW,5_2_07157847
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_052910F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,5_2_052910F1
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0040AE51 FindFirstFileW,FindNextFileW,7_2_0040AE51
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 8_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,8_2_00407EF8
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 9_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,9_2_00407898
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,11_2_0040B335
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,11_2_0040B53A
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0041B63A FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,11_2_0041B63A
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,11_2_004089A9
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00406AC2 FindFirstFileW,FindNextFileW,11_2_00406AC2
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,11_2_00407A8C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,11_2_00408DA7
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00418E5F FindFirstFileW,FindNextFileW,FindNextFileW,11_2_00418E5F
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04ACC0BA FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,11_2_04ACC0BA
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04ACC2BF FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,11_2_04ACC2BF
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04ADC3BF FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,11_2_04ADC3BF
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AC8811 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,11_2_04AC8811
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AC972E __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,11_2_04AC972E
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AC7847 FindFirstFileW,FindNextFileW,11_2_04AC7847
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AD9BE4 FindFirstFileW,11_2_04AD9BE4
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AC9B2C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,11_2_04AC9B2C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,5_2_00406F06
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_00418981 memset,GetSystemInfo,7_2_00418981
                    Source: colorcpl.exe, 00000005.00000003.1717700032.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1714653918.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1719040592.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1720924755.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1721215104.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1721716564.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.4145914838.0000000003064000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWo
                    Source: IRSTaxRefund.exe, 00000000.00000002.1695797145.000000000080C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
                    Source: colorcpl.exe, 00000005.00000003.1717700032.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1714653918.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1719040592.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1720924755.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1721215104.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1721716564.0000000003064000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.4143664674.0000000003011000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.4145914838.0000000003064000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                    Source: bhv6B80.tmp.7.drBinary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
                    Source: Tmohrqmb.PIF, 0000000A.00000002.1812072516.000000000083D000.00000004.00000020.00020000.00000000.sdmp, Tmohrqmb.PIF, 0000000D.00000002.1895627021.00000000006F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                    Source: bhv6B80.tmp.7.drBinary or memory string: https://config.edge.skype.com/config/v1/Skype/1446_8.53.0.77?OSVer=10.0.19045.2006&ClientID=RHTiQUpXOaQeBtbq%2B7LgJauNdx5lF%2FQ%2FOy2qwXRNGjU%3D&Manufacturer=VMware%2C%20Inc.&Model=VMware20%2C1&Language=en&Locale=en-US
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeAPI call chain: ExitProcess graph end nodegraph_0-23759
                    Source: C:\Windows\SysWOW64\colorcpl.exeAPI call chain: ExitProcess graph end nodegraph_5-101855
                    Source: C:\Windows\SysWOW64\colorcpl.exeAPI call chain: ExitProcess graph end node
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFAPI call chain: ExitProcess graph end node
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeProcess information queried: ProcessInformationJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0043A86D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_0043A86D
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 7_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,7_2_0040DD85
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02983E98 LoadLibraryW,GetProcAddress,FreeLibrary,0_2_02983E98
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00442764 mov eax, dword ptr fs:[00000030h]5_2_00442764
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_071510FB mov eax, dword ptr fs:[00000030h]5_2_071510FB
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_071510FB mov eax, dword ptr fs:[00000030h]5_2_071510FB
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_071934E9 mov eax, dword ptr fs:[00000030h]5_2_071934E9
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_05294AB4 mov eax, dword ptr fs:[00000030h]5_2_05294AB4
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00442764 mov eax, dword ptr fs:[00000030h]11_2_00442764
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AC10FB mov eax, dword ptr fs:[00000030h]11_2_04AC10FB
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AC10FB mov eax, dword ptr fs:[00000030h]11_2_04AC10FB
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04B034E9 mov eax, dword ptr fs:[00000030h]11_2_04B034E9
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00410BF1 GetNativeSystemInfo,GetProcessHeap,HeapAlloc,SetLastError,SetLastError,5_2_00410BF1
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00434378 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_2_00434378
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0043A86D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_0043A86D
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00433D4F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_00433D4F
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00433EE2 SetUnhandledExceptionFilter,5_2_00433EE2
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07184C67 SetUnhandledExceptionFilter,5_2_07184C67
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_07184AD4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_07184AD4
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0718B5F2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_0718B5F2
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_071850FD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_2_071850FD
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_05292639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_05292639
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_052960E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_052960E2
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_05292B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_2_05292B1C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00434378 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,11_2_00434378
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_0043A86D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_0043A86D
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00433D4F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_00433D4F
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_00433EE2 SetUnhandledExceptionFilter,11_2_00433EE2
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AF4C67 SetUnhandledExceptionFilter,11_2_04AF4C67
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AF4AD4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_04AF4AD4
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AFB5F2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_04AFB5F2
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 11_2_04AF50FD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,11_2_04AF50FD

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    Allocates memory in foreign processes
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeMemory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 7150000 protect: page execute and read and writeJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory allocated: C:\Windows\SysWOW64\SndVol.exe base: 4AC0000 protect: page execute and read and writeJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory allocated: C:\Windows\SysWOW64\SndVol.exe base: 4BC0000 protect: page execute and read and writeJump to behavior
                    Contains functionality to inject code into remote processes
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0041742B GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,5_2_0041742B
                    Creates a thread in another existing process (thread injection)
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeThread created: C:\Windows\SysWOW64\colorcpl.exe EIP: 715166EJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFThread created: C:\Windows\SysWOW64\SndVol.exe EIP: 4AC166EJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFThread created: C:\Windows\SysWOW64\SndVol.exe EIP: 4BC166EJump to behavior
                    Injects a PE file into a foreign processes
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeMemory written: C:\Windows\SysWOW64\colorcpl.exe base: 7150000 value starts with: 4D5AJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory written: C:\Windows\SysWOW64\SndVol.exe base: 4AC0000 value starts with: 4D5AJump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory written: C:\Windows\SysWOW64\SndVol.exe base: 4BC0000 value starts with: 4D5AJump to behavior
                    Maps a DLL or memory area into another process
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: NULL target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and writeJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: NULL target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and writeJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: NULL target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and writeJump to behavior
                    Writes to foreign memory regions
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeMemory written: C:\Windows\SysWOW64\colorcpl.exe base: 7150000Jump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory written: C:\Windows\SysWOW64\SndVol.exe base: 4AC0000Jump to behavior
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFMemory written: C:\Windows\SysWOW64\SndVol.exe base: 4BC0000Jump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe5_2_0041100E
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe11_2_0041100E
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0041894A mouse_event,5_2_0041894A
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\arbpnwwkbdbggftjlfvxogreibczuy"Jump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\arbpnwwkbdbggftjlfvxogreibczuy"Jump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\dlgiophmpltlilpvupprzllvriuivjxce"Jump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\user\AppData\Local\Temp\nnlao"Jump to behavior
                    Source: colorcpl.exe, 00000005.00000002.4145914838.0000000003064000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerJC965\u
                    Source: colorcpl.exe, 00000005.00000002.4145546656.000000000304E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managere
                    Source: colorcpl.exe, 00000005.00000002.4145914838.0000000003064000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerJC965\2
                    Source: colorcpl.exe, 00000005.00000002.4145546656.000000000304E000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.4145914838.0000000003064000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
                    Source: colorcpl.exe, 00000005.00000002.4145914838.0000000003064000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerJC965\Q
                    Source: colorcpl.exe, 00000005.00000002.4145914838.0000000003064000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerJC965\
                    Source: colorcpl.exe, 00000005.00000002.4143664674.0000000002FD4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager965\
                    Source: colorcpl.exe, 00000005.00000002.4145914838.0000000003064000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerJC965\|
                    Source: colorcpl.exe, 00000005.00000002.4145546656.000000000304E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managern
                    Source: colorcpl.exe, 00000005.00000002.4145546656.000000000304E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managerk
                    Source: colorcpl.exe, 00000005.00000002.4145914838.0000000003064000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerJC965\X
                    Source: colorcpl.exe, 00000005.00000002.4145914838.0000000003064000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managerr|
                    Source: colorcpl.exe, 00000005.00000002.4145914838.0000000003064000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerJC965\D
                    Source: colorcpl.exe, 00000005.00000002.4145914838.0000000003064000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerJC965\c
                    Source: colorcpl.exe, 00000005.00000002.4145914838.0000000003064000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerJC965\
                    Source: colorcpl.exe, 00000005.00000002.4145546656.000000000304E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managert
                    Source: colorcpl.exe, 00000005.00000002.4145546656.000000000304E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerR
                    Source: colorcpl.exe, 00000005.00000002.4145546656.000000000304E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager_
                    Source: colorcpl.exe, 00000005.00000002.4145546656.000000000302F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
                    Source: logs.dat.5.drBinary or memory string: [Program Manager]
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00434015 cpuid 5_2_00434015
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,0_2_02975510
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: GetLocaleInfoA,0_2_0297A130
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: GetLocaleInfoA,0_2_0297A17C
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,0_2_0297561C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,5_2_0045107A
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,5_2_004512CA
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,5_2_004472BE
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,5_2_004513F3
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,5_2_004514FA
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,5_2_004515C7
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoA,5_2_0040E751
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,5_2_004477A7
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,5_2_00450C8F
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,5_2_00450F52
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,5_2_00450F07
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,5_2_00450FED
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,5_2_0719852C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,5_2_071A234C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,5_2_071A227F
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,5_2_071A2178
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,5_2_071A204F
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,5_2_07198043
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoA,5_2_0715F4D6
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,5_2_071A1D72
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,5_2_071A1DFF
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,5_2_071A1C8C
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,5_2_071A1CD7
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,5_2_071A1A14
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,10_2_02AB5510
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: GetLocaleInfoA,10_2_02ABA17C
                    Source: C:\Users\Public\Libraries\Tmohrqmb.PIFCode function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,10_2_02AB561B
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,11_2_0045107A
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,11_2_004512CA
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: EnumSystemLocalesW,11_2_004472BE
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,11_2_004513F3
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,11_2_004514FA
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,11_2_004515C7
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoA,11_2_0040E751
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,11_2_004477A7
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,11_2_00450C8F
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: EnumSystemLocalesW,11_2_00450F52
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: EnumSystemLocalesW,11_2_00450F07
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: EnumSystemLocalesW,11_2_00450FED
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,11_2_04B0852C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: EnumSystemLocalesW,11_2_04B08043
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,11_2_04B1204F
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,11_2_04B12178
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,11_2_04B1227F
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,11_2_04B1234C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoA,11_2_04ACF4D6
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: EnumSystemLocalesW,11_2_04B11C8C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: EnumSystemLocalesW,11_2_04B11CD7
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,11_2_04B11DFF
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: EnumSystemLocalesW,11_2_04B11D72
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,11_2_04B11A14
                    Source: C:\Windows\SysWOW64\colorcpl.exeQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_02978BB0 GetLocalTime,0_2_02978BB0
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_0041A9AD GetComputerNameExW,GetUserNameW,5_2_0041A9AD
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 5_2_00448267 _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,5_2_00448267
                    Source: C:\Users\user\Desktop\IRSTaxRefund.exeCode function: 0_2_0297B0B0 GetVersionExA,0_2_0297B0B0
                    Source: C:\Windows\SysWOW64\colorcpl.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                    Stealing of Sensitive Information

                    barindex
                    Yara detected Remcos RAT
                    Source: Yara matchFile source: 11.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac1985.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc1985.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7151985.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7150000.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7150000.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc1985.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7151985.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac1985.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000E.00000003.1894324058.0000000000C0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.1896020251.0000000004BC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4146895773.0000000007150000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000002.1811552220.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4143664674.0000000003011000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.1894763646.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.1811250276.0000000000C40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000003.1894262247.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4140858643.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 7472, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 7784, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 8036, type: MEMORYSTR
                    Source: Yara matchFile source: C:\ProgramData\iuytrtyu\logs.dat, type: DROPPED
                    Contains functionality to steal Chrome passwords or cookies
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data5_2_0040B21B
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data11_2_0040B21B
                    Contains functionality to steal Firefox passwords or cookies
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\5_2_0040B335
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: \key3.db5_2_0040B335
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\11_2_0040B335
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: \key3.db11_2_0040B335
                    Tries to harvest and steal browser information (history, passwords, etc)
                    Source: C:\Windows\SysWOW64\colorcpl.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.dbJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqliteJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                    Tries to steal Instant Messenger accounts or passwords
                    Source: C:\Windows\SysWOW64\colorcpl.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic SaltJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic SaltJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeKey opened: HKEY_CURRENT_USER\Software\PaltalkJump to behavior
                    Tries to steal Mail credentials (via file / registry access)
                    Source: C:\Windows\SysWOW64\colorcpl.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live MailJump to behavior
                    Tries to steal Mail credentials (via file registry)
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: ESMTPPassword8_2_004033F0
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword8_2_00402DB3
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword8_2_00402DB3
                    Yara detected WebBrowserPassView password recovery tool
                    Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 7472, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 7588, type: MEMORYSTR

                    Remote Access Functionality

                    barindex
                    Yara detected Remcos RAT
                    Source: Yara matchFile source: 11.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac1985.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc1985.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7151985.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7150000.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7150000.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 14.2.SndVol.exe.4bc1985.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 5.2.colorcpl.exe.7151985.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.SndVol.exe.4ac1985.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000E.00000003.1894324058.0000000000C0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000002.1812493335.0000000004AC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.1896020251.0000000004BC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4146895773.0000000007150000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000002.1811552220.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4143664674.0000000003011000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.1894763646.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000003.1811250276.0000000000C40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000003.1894262247.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000005.00000002.4140858643.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 7472, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 7784, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 8036, type: MEMORYSTR
                    Source: Yara matchFile source: C:\ProgramData\iuytrtyu\logs.dat, type: DROPPED
                    Source: C:\Windows\SysWOW64\colorcpl.exeCode function: cmd.exe5_2_00405042
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: cmd.exe11_2_00405042

                    Mitre Att&ck Matrix

                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire Infrastructure1
                    Valid Accounts                    		21
                    Native API                    		1
                    DLL Side-Loading                    		1
                    DLL Side-Loading                    		1
                    Deobfuscate/Decode Files or Information                    		2
                    OS Credential Dumping                    		2
                    System Time Discovery                    		Remote Services11
                    Archive Collected Data                    		12
                    Ingress Tool Transfer                    		Exfiltration Over Other Network Medium1
                    System Shutdown/Reboot
                    CredentialsDomainsDefault Accounts12
                    Command and Scripting Interpreter                    		1
                    Valid Accounts                    		1
                    Bypass User Account Control                    		2
                    Obfuscated Files or Information                    		111
                    Input Capture                    		1
                    Account Discovery                    		Remote Desktop Protocol1
                    Data from Local System                    		2
                    Encrypted Channel                    		Exfiltration Over Bluetooth1
                    Defacement
                    Email AddressesDNS ServerDomain Accounts2
                    Service Execution                    		1
                    Windows Service                    		1
                    Valid Accounts                    		1
                    Timestomp                    		2
                    Credentials in Registry                    		1
                    System Service Discovery                    		SMB/Windows Admin Shares1
                    Email Collection                    		1
                    Non-Standard Port                    		Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCron1
                    Registry Run Keys / Startup Folder                    		11
                    Access Token Manipulation                    		1
                    DLL Side-Loading                    		3
                    Credentials In Files                    		3
                    File and Directory Discovery                    		Distributed Component Object Model111
                    Input Capture                    		2
                    Non-Application Layer Protocol                    		Traffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
                    Windows Service                    		1
                    Bypass User Account Control                    		LSA Secrets38
                    System Information Discovery                    		SSH3
                    Clipboard Data                    		12
                    Application Layer Protocol                    		Scheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts622
                    Process Injection                    		1
                    File Deletion                    		Cached Domain Credentials231
                    Security Software Discovery                    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
                    Registry Run Keys / Startup Folder                    		121
                    Masquerading                    		DCSync1
                    Virtualization/Sandbox Evasion                    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                    Valid Accounts                    		Proc Filesystem4
                    Process Discovery                    		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                    Virtualization/Sandbox Evasion                    		/etc/passwd and /etc/shadow1
                    Application Window Discovery                    		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                    IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron11
                    Access Token Manipulation                    		Network Sniffing1
                    System Owner/User Discovery                    		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                    Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd622
                    Process Injection                    		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet
                    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1615763 Sample: IRSTaxRefund.exe Startdate: 15/02/2025 Architecture: WINDOWS Score: 100 56 frontofficefax20.home-webserver.de 2->56 58 geoplugin.net 2->58 74 Suricata IDS alerts for network traffic 2->74 76 Found malware configuration 2->76 78 Malicious sample detected (through community Yara rule) 2->78 80 12 other signatures 2->80 8 IRSTaxRefund.exe 1 7 2->8         started        12 Tmohrqmb.PIF 2->12         started        14 Tmohrqmb.PIF 2->14         started        signatures3 process4 file5 44 C:\Windows \SysWOW64\svchost.pif, PE32+ 8->44 dropped 46 C:\Windows \SysWOW6446ETUTILS.dll, PE32+ 8->46 dropped 48 C:\Users\Public\Libraries\Tmohrqmb.PIF, PE32 8->48 dropped 50 C:\Users\Public\Tmohrqmb.url, MS 8->50 dropped 82 Drops PE files with a suspicious file extension 8->82 84 Writes to foreign memory regions 8->84 86 Allocates memory in foreign processes 8->86 16 colorcpl.exe 6 16 8->16         started        21 cmd.exe 3 8->21         started        23 cmd.exe 1 8->23         started        88 Multi AV Scanner detection for dropped file 12->88 90 Allocates many large memory junks 12->90 92 Creates a thread in another existing process (thread injection) 12->92 25 SndVol.exe 12->25         started        94 Injects a PE file into a foreign processes 14->94 27 SndVol.exe 14->27         started        signatures6 process7 dnsIp8 52 frontofficefax20.home-webserver.de 45.144.214.126, 4126, 49731, 49732 HPC-MVM-ASHU Ukraine 16->52 54 geoplugin.net 178.237.33.50, 49733, 80 ATOM86-ASATOM86NL Netherlands 16->54 42 C:\ProgramData\iuytrtyu\logs.dat, data 16->42 dropped 60 Contains functionality to bypass UAC (CMSTPLUA) 16->60 62 Tries to steal Mail credentials (via file registry) 16->62 64 Contains functionalty to change the wallpaper 16->64 72 3 other signatures 16->72 29 colorcpl.exe 1 16->29         started        32 colorcpl.exe 1 16->32         started        34 colorcpl.exe 2 16->34         started        36 colorcpl.exe 16->36         started        38 conhost.exe 21->38         started        40 conhost.exe 23->40         started        66 Contains functionality to steal Chrome passwords or cookies 25->66 68 Contains functionality to steal Firefox passwords or cookies 25->68 70 Delayed program exit found 25->70 file9 signatures10 process11 signatures12 96 Tries to steal Instant Messenger accounts or passwords 29->96 98 Tries to harvest and steal browser information (history, passwords, etc) 29->98 100 Tries to steal Mail credentials (via file / registry access) 32->100

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.