Edit tour

Windows Analysis Report
rDB_YAK_838327E.cmd

Overview

General Information

Sample name:	rDB_YAK_838327E.cmd
Analysis ID:	1627857
MD5:	7103cba33be7a5c26d2f60a5c1efa0fd
SHA1:	d6fe126b586ec1e6d1f270171702d7726ba02d3d
SHA256:	1f3c62fca5bf7185f2b7db15042da223b9a95b01ac24d9fa217e297057486d1b
Tags:	cmduser-Porcupine
Infos:

Detection

DBatLoader, Remcos

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for dropped file

Contains functionality to bypass UAC (CMSTPLUA)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DBatLoader

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to inject code into remote processes

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Creates a thread in another existing process (thread injection)

Drops PE files with a suspicious file extension

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Sample uses process hollowing technique

Sigma detected: Suspicious Creation with Colorcpl

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Uses dynamic DNS services

Writes to foreign memory regions

Yara detected WebBrowserPassView password recovery tool

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 2192 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\rDB_YAK_838327E.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

extrac32.exe (PID: 1424 cmdline: extrac32 /y "C:\Users\user\Desktop\rDB_YAK_838327E.cmd" "C:\Users\user\AppData\Local\Temp\x.exe" MD5: 41330D97BF17D07CD4308264F3032547)

x.exe (PID: 5076 cmdline: "C:\Users\user\AppData\Local\Temp\x.exe" MD5: 1C38DAD206EF3BA3F3D9695F67C0294B)

colorcpl.exe (PID: 5640 cmdline: C:\Windows\System32\colorcpl.exe MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)

recover.exe (PID: 6252 cmdline: C:\Windows\SysWOW64\recover.exe /stext "C:\Users\user\AppData\Local\Temp\xrkt" MD5: D38B657A068016768CA9F3B5E100B472)

recover.exe (PID: 4052 cmdline: C:\Windows\SysWOW64\recover.exe /stext "C:\Users\user\AppData\Local\Temp\atxlilk" MD5: D38B657A068016768CA9F3B5E100B472)

recover.exe (PID: 5772 cmdline: C:\Windows\SysWOW64\recover.exe /stext "C:\Users\user\AppData\Local\Temp\kndwjdukttx" MD5: D38B657A068016768CA9F3B5E100B472)

Ugisfxtz.PIF (PID: 4896 cmdline: "C:\Users\user\Links\Ugisfxtz.PIF" MD5: 1C38DAD206EF3BA3F3D9695F67C0294B)

SndVol.exe (PID: 7036 cmdline: C:\Windows\System32\SndVol.exe MD5: BD4A1CC3429ED1251E5185A72501839B)

Ugisfxtz.PIF (PID: 4148 cmdline: "C:\Users\user\Links\Ugisfxtz.PIF" MD5: 1C38DAD206EF3BA3F3D9695F67C0294B)

colorcpl.exe (PID: 4364 cmdline: C:\Windows\System32\colorcpl.exe MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["kavemarb99juyet1.duckdns.org:4688:0", "kavemarb99juyet1.duckdns.org:4689:1", "kavemarb99juyet2.duckdns.org:4689:0", "kavemarb99juyet3.duckdns.org:4689:0", "kavemarb99juyet4.duckdns.org:4689:0", "kavemarb99juyet5.duckdns.org:4689:0"], "Assigned name": "YAKCMD", "Connect interval": "5", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "shslokuybwg-BKAP0P", "Keylog flag": "1", "Keylog path": "AppData", "Keylog file": "myq.ocx", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "6", "Copy folder": "Remcos", "Keylog folder": ""}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\myq.ocx	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.2516763955.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000004.00000002.2347317719.000000007FB00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6d617:$a1: Remcos restarted by watchdog! 0x6dc67:$a3: %02i:%02i:%02i:%03i
00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x678b3:$str_a1: C:\Windows\System32\cmd.exe 0x6782f:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6782f:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67d2f:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x68397:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x67923:$str_b2: Executing file: 0x6875b:$str_b3: GetDirectListeningPort 0x68187:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x68307:$str_b7: \update.vbs 0x6794b:$str_b9: Downloaded file: 0x67937:$str_b10: Downloading file: 0x679db:$str_b12: Failed to upload file: 0x68723:$str_b13: StartForward 0x68743:$str_b14: StopForward 0x6825f:$str_b15: fso.DeleteFile " 0x681f3:$str_b16: On Error Resume Next 0x6828f:$str_b17: fso.DeleteFolder " 0x679cb:$str_b18: Uploaded file: 0x6798b:$str_b19: Unable to delete: 0x68227:$str_b20: while fso.FileExists(" 0x67e68:$str_c0: [Firefox StoredLogins not found]
00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x677a7:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x67737:$s1: CoGetObject 0x6774b:$s1: CoGetObject 0x67767:$s1: CoGetObject 0x71515:$s1: CoGetObject 0x676f7:$s2: Elevation:Administrator!new:
00000006.00000003.2496181551.00000000318F4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000006.00000003.2521024701.0000000031B17000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000006.00000003.2521089638.0000000031A55000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000006.00000003.2496591271.0000000031591000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6d758:$a1: Remcos restarted by watchdog! 0x6dda8:$a3: %02i:%02i:%02i:%03i
00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x679f4:$str_a1: C:\Windows\System32\cmd.exe 0x67970:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67970:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67e70:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x684d8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x67a64:$str_b2: Executing file: 0x6889c:$str_b3: GetDirectListeningPort 0x682c8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x68448:$str_b7: \update.vbs 0x67a8c:$str_b9: Downloaded file: 0x67a78:$str_b10: Downloading file: 0x67b1c:$str_b12: Failed to upload file: 0x68864:$str_b13: StartForward 0x68884:$str_b14: StopForward 0x683a0:$str_b15: fso.DeleteFile " 0x68334:$str_b16: On Error Resume Next 0x683d0:$str_b17: fso.DeleteFolder " 0x67b0c:$str_b18: Uploaded file: 0x67acc:$str_b19: Unable to delete: 0x68368:$str_b20: while fso.FileExists(" 0x67fa9:$str_c0: [Firefox StoredLogins not found]
00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x678e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x67878:$s1: CoGetObject 0x6788c:$s1: CoGetObject 0x678a8:$s1: CoGetObject 0x71656:$s1: CoGetObject 0x67838:$s2: Elevation:Administrator!new:
00000006.00000003.2478603866.000000003179F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6d758:$a1: Remcos restarted by watchdog! 0x6dda8:$a3: %02i:%02i:%02i:%03i
00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x679f4:$str_a1: C:\Windows\System32\cmd.exe 0x67970:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67970:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67e70:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x684d8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x67a64:$str_b2: Executing file: 0x6889c:$str_b3: GetDirectListeningPort 0x682c8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x68448:$str_b7: \update.vbs 0x67a8c:$str_b9: Downloaded file: 0x67a78:$str_b10: Downloading file: 0x67b1c:$str_b12: Failed to upload file: 0x68864:$str_b13: StartForward 0x68884:$str_b14: StopForward 0x683a0:$str_b15: fso.DeleteFile " 0x68334:$str_b16: On Error Resume Next 0x683d0:$str_b17: fso.DeleteFolder " 0x67b0c:$str_b18: Uploaded file: 0x67acc:$str_b19: Unable to delete: 0x68368:$str_b20: while fso.FileExists(" 0x67fa9:$str_c0: [Firefox StoredLogins not found]
00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x678e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x67878:$s1: CoGetObject 0x6788c:$s1: CoGetObject 0x678a8:$s1: CoGetObject 0x71656:$s1: CoGetObject 0x67838:$s2: Elevation:Administrator!new:
00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6d617:$a1: Remcos restarted by watchdog! 0x6dc67:$a3: %02i:%02i:%02i:%03i
00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x678b3:$str_a1: C:\Windows\System32\cmd.exe 0x6782f:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6782f:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67d2f:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x68397:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x67923:$str_b2: Executing file: 0x6875b:$str_b3: GetDirectListeningPort 0x68187:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x68307:$str_b7: \update.vbs 0x6794b:$str_b9: Downloaded file: 0x67937:$str_b10: Downloading file: 0x679db:$str_b12: Failed to upload file: 0x68723:$str_b13: StartForward 0x68743:$str_b14: StopForward 0x6825f:$str_b15: fso.DeleteFile " 0x681f3:$str_b16: On Error Resume Next 0x6828f:$str_b17: fso.DeleteFolder " 0x679cb:$str_b18: Uploaded file: 0x6798b:$str_b19: Unable to delete: 0x68227:$str_b20: while fso.FileExists(" 0x67e68:$str_c0: [Firefox StoredLogins not found]
00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x677a7:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x67737:$s1: CoGetObject 0x6774b:$s1: CoGetObject 0x67767:$s1: CoGetObject 0x71515:$s1: CoGetObject 0x676f7:$s2: Elevation:Administrator!new:
00000006.00000003.2521229038.00000000319A1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000006.00000002.4772691610.0000000031790000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000006.00000003.2520685430.00000000315F2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000006.00000003.2498082588.00000000318F1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000006.00000003.2521160715.0000000031824000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000006.00000003.2520343856.0000000031591000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: colorcpl.exe PID: 5640	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: colorcpl.exe PID: 5640	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: colorcpl.exe PID: 5640	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: colorcpl.exe PID: 5640	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: colorcpl.exe PID: 5640	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x59516:$a1: Remcos restarted by watchdog! 0x6d4b9:$a1: Remcos restarted by watchdog! 0x59b6b:$a3: %02i:%02i:%02i:%03i 0x59fa8:$a3: %02i:%02i:%02i:%03i 0x6db0e:$a3: %02i:%02i:%02i:%03i 0x6df4b:$a3: %02i:%02i:%02i:%03i
Process Memory Space: SndVol.exe PID: 7036	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: SndVol.exe PID: 7036	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: SndVol.exe PID: 7036	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: SndVol.exe PID: 7036	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x9066:$a1: Remcos restarted by watchdog! 0x19976:$a1: Remcos restarted by watchdog! 0x96bb:$a3: %02i:%02i:%02i:%03i 0x9af8:$a3: %02i:%02i:%02i:%03i 0x19fcb:$a3: %02i:%02i:%02i:%03i 0x1a408:$a3: %02i:%02i:%02i:%03i
Process Memory Space: recover.exe PID: 6252	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Click to see the 42 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.colorcpl.exe.31790000.5.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.3.colorcpl.exe.315f26a0.11.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
13.2.recover.exe.400000.0.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.2.colorcpl.exe.7180000.3.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.colorcpl.exe.7180000.3.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
6.2.colorcpl.exe.7180000.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.colorcpl.exe.7180000.3.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6d617:$a1: Remcos restarted by watchdog! 0x6dc67:$a3: %02i:%02i:%02i:%03i
6.2.colorcpl.exe.7180000.3.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x678b3:$str_a1: C:\Windows\System32\cmd.exe 0x6782f:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6782f:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67d2f:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x68397:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x67923:$str_b2: Executing file: 0x6875b:$str_b3: GetDirectListeningPort 0x68187:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x68307:$str_b7: \update.vbs 0x6794b:$str_b9: Downloaded file: 0x67937:$str_b10: Downloading file: 0x679db:$str_b12: Failed to upload file: 0x68723:$str_b13: StartForward 0x68743:$str_b14: StopForward 0x6825f:$str_b15: fso.DeleteFile " 0x681f3:$str_b16: On Error Resume Next 0x6828f:$str_b17: fso.DeleteFolder " 0x679cb:$str_b18: Uploaded file: 0x6798b:$str_b19: Unable to delete: 0x68227:$str_b20: while fso.FileExists(" 0x67e68:$str_c0: [Firefox StoredLogins not found]
6.2.colorcpl.exe.7180000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x677a7:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x67737:$s1: CoGetObject 0x6774b:$s1: CoGetObject 0x67767:$s1: CoGetObject 0x71515:$s1: CoGetObject 0x676f7:$s2: Elevation:Administrator!new:
4.2.x.exe.2930000.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
6.2.colorcpl.exe.71818bf.4.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.colorcpl.exe.71818bf.4.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
6.2.colorcpl.exe.71818bf.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.colorcpl.exe.71818bf.4.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6bd58:$a1: Remcos restarted by watchdog! 0x6c3a8:$a3: %02i:%02i:%02i:%03i
6.2.colorcpl.exe.71818bf.4.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x65ff4:$str_a1: C:\Windows\System32\cmd.exe 0x65f70:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65f70:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66470:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66ad8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x66064:$str_b2: Executing file: 0x66e9c:$str_b3: GetDirectListeningPort 0x668c8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66a48:$str_b7: \update.vbs 0x6608c:$str_b9: Downloaded file: 0x66078:$str_b10: Downloading file: 0x6611c:$str_b12: Failed to upload file: 0x66e64:$str_b13: StartForward 0x66e84:$str_b14: StopForward 0x669a0:$str_b15: fso.DeleteFile " 0x66934:$str_b16: On Error Resume Next 0x669d0:$str_b17: fso.DeleteFolder " 0x6610c:$str_b18: Uploaded file: 0x660cc:$str_b19: Unable to delete: 0x66968:$str_b20: while fso.FileExists(" 0x665a9:$str_c0: [Firefox StoredLogins not found]
6.2.colorcpl.exe.71818bf.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65ee8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65e78:$s1: CoGetObject 0x65e8c:$s1: CoGetObject 0x65ea8:$s1: CoGetObject 0x6fc56:$s1: CoGetObject 0x65e38:$s2: Elevation:Administrator!new:
6.3.colorcpl.exe.315f26a0.10.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
13.2.recover.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
9.2.SndVol.exe.400000.0.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.2.SndVol.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
9.2.SndVol.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
9.2.SndVol.exe.400000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6d758:$a1: Remcos restarted by watchdog! 0x6dda8:$a3: %02i:%02i:%02i:%03i
9.2.SndVol.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x679f4:$str_a1: C:\Windows\System32\cmd.exe 0x67970:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67970:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67e70:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x684d8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x67a64:$str_b2: Executing file: 0x6889c:$str_b3: GetDirectListeningPort 0x682c8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x68448:$str_b7: \update.vbs 0x67a8c:$str_b9: Downloaded file: 0x67a78:$str_b10: Downloading file: 0x67b1c:$str_b12: Failed to upload file: 0x68864:$str_b13: StartForward 0x68884:$str_b14: StopForward 0x683a0:$str_b15: fso.DeleteFile " 0x68334:$str_b16: On Error Resume Next 0x683d0:$str_b17: fso.DeleteFolder " 0x67b0c:$str_b18: Uploaded file: 0x67acc:$str_b19: Unable to delete: 0x68368:$str_b20: while fso.FileExists(" 0x67fa9:$str_c0: [Firefox StoredLogins not found]
9.2.SndVol.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x678e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x67878:$s1: CoGetObject 0x6788c:$s1: CoGetObject 0x678a8:$s1: CoGetObject 0x71656:$s1: CoGetObject 0x67838:$s2: Elevation:Administrator!new:
9.2.SndVol.exe.51218bf.2.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.2.SndVol.exe.51218bf.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
9.2.SndVol.exe.51218bf.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
9.2.SndVol.exe.51218bf.2.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6a358:$a1: Remcos restarted by watchdog! 0x6a9a8:$a3: %02i:%02i:%02i:%03i
9.2.SndVol.exe.51218bf.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x645f4:$str_a1: C:\Windows\System32\cmd.exe 0x64570:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64570:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a70:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x650d8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64664:$str_b2: Executing file: 0x6549c:$str_b3: GetDirectListeningPort 0x64ec8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65048:$str_b7: \update.vbs 0x6468c:$str_b9: Downloaded file: 0x64678:$str_b10: Downloading file: 0x6471c:$str_b12: Failed to upload file: 0x65464:$str_b13: StartForward 0x65484:$str_b14: StopForward 0x64fa0:$str_b15: fso.DeleteFile " 0x64f34:$str_b16: On Error Resume Next 0x64fd0:$str_b17: fso.DeleteFolder " 0x6470c:$str_b18: Uploaded file: 0x646cc:$str_b19: Unable to delete: 0x64f68:$str_b20: while fso.FileExists(" 0x64ba9:$str_c0: [Firefox StoredLogins not found]
9.2.SndVol.exe.51218bf.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x644e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64478:$s1: CoGetObject 0x6448c:$s1: CoGetObject 0x644a8:$s1: CoGetObject 0x6e256:$s1: CoGetObject 0x64438:$s2: Elevation:Administrator!new:
6.2.colorcpl.exe.400000.0.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.colorcpl.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
6.2.colorcpl.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.colorcpl.exe.400000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6d758:$a1: Remcos restarted by watchdog! 0x6dda8:$a3: %02i:%02i:%02i:%03i
6.2.colorcpl.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x679f4:$str_a1: C:\Windows\System32\cmd.exe 0x67970:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67970:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67e70:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x684d8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x67a64:$str_b2: Executing file: 0x6889c:$str_b3: GetDirectListeningPort 0x682c8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x68448:$str_b7: \update.vbs 0x67a8c:$str_b9: Downloaded file: 0x67a78:$str_b10: Downloading file: 0x67b1c:$str_b12: Failed to upload file: 0x68864:$str_b13: StartForward 0x68884:$str_b14: StopForward 0x683a0:$str_b15: fso.DeleteFile " 0x68334:$str_b16: On Error Resume Next 0x683d0:$str_b17: fso.DeleteFolder " 0x67b0c:$str_b18: Uploaded file: 0x67acc:$str_b19: Unable to delete: 0x68368:$str_b20: while fso.FileExists(" 0x67fa9:$str_c0: [Firefox StoredLogins not found]
6.2.colorcpl.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x678e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x67878:$s1: CoGetObject 0x6788c:$s1: CoGetObject 0x678a8:$s1: CoGetObject 0x71656:$s1: CoGetObject 0x67838:$s2: Elevation:Administrator!new:
6.2.colorcpl.exe.7180000.3.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.colorcpl.exe.7180000.3.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
6.2.colorcpl.exe.7180000.3.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.colorcpl.exe.7180000.3.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6ca17:$a1: Remcos restarted by watchdog! 0x6d067:$a3: %02i:%02i:%02i:%03i
6.2.colorcpl.exe.7180000.3.unpack	REMCOS_RAT_variants	unknown	unknown	0x66cb3:$str_a1: C:\Windows\System32\cmd.exe 0x66c2f:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66c2f:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6712f:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x67797:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x66d23:$str_b2: Executing file: 0x67b5b:$str_b3: GetDirectListeningPort 0x67587:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67707:$str_b7: \update.vbs 0x66d4b:$str_b9: Downloaded file: 0x66d37:$str_b10: Downloading file: 0x66ddb:$str_b12: Failed to upload file: 0x67b23:$str_b13: StartForward 0x67b43:$str_b14: StopForward 0x6765f:$str_b15: fso.DeleteFile " 0x675f3:$str_b16: On Error Resume Next 0x6768f:$str_b17: fso.DeleteFolder " 0x66dcb:$str_b18: Uploaded file: 0x66d8b:$str_b19: Unable to delete: 0x67627:$str_b20: while fso.FileExists(" 0x67268:$str_c0: [Firefox StoredLogins not found]
6.2.colorcpl.exe.7180000.3.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x66ba7:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x66b37:$s1: CoGetObject 0x66b4b:$s1: CoGetObject 0x66b67:$s1: CoGetObject 0x70915:$s1: CoGetObject 0x66af7:$s2: Elevation:Administrator!new:
9.2.SndVol.exe.5120000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.2.SndVol.exe.5120000.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
9.2.SndVol.exe.5120000.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
9.2.SndVol.exe.5120000.1.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6ca17:$a1: Remcos restarted by watchdog! 0x6d067:$a3: %02i:%02i:%02i:%03i
9.2.SndVol.exe.5120000.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x66cb3:$str_a1: C:\Windows\System32\cmd.exe 0x66c2f:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66c2f:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6712f:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x67797:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x66d23:$str_b2: Executing file: 0x67b5b:$str_b3: GetDirectListeningPort 0x67587:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67707:$str_b7: \update.vbs 0x66d4b:$str_b9: Downloaded file: 0x66d37:$str_b10: Downloading file: 0x66ddb:$str_b12: Failed to upload file: 0x67b23:$str_b13: StartForward 0x67b43:$str_b14: StopForward 0x6765f:$str_b15: fso.DeleteFile " 0x675f3:$str_b16: On Error Resume Next 0x6768f:$str_b17: fso.DeleteFolder " 0x66dcb:$str_b18: Uploaded file: 0x66d8b:$str_b19: Unable to delete: 0x67627:$str_b20: while fso.FileExists(" 0x67268:$str_c0: [Firefox StoredLogins not found]
9.2.SndVol.exe.5120000.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x66ba7:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x66b37:$s1: CoGetObject 0x66b4b:$s1: CoGetObject 0x66b67:$s1: CoGetObject 0x70915:$s1: CoGetObject 0x66af7:$s2: Elevation:Administrator!new:
9.2.SndVol.exe.5120000.1.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.2.SndVol.exe.5120000.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
9.2.SndVol.exe.5120000.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
9.2.SndVol.exe.5120000.1.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6d617:$a1: Remcos restarted by watchdog! 0x6dc67:$a3: %02i:%02i:%02i:%03i
9.2.SndVol.exe.5120000.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x678b3:$str_a1: C:\Windows\System32\cmd.exe 0x6782f:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6782f:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x67d2f:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x68397:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x67923:$str_b2: Executing file: 0x6875b:$str_b3: GetDirectListeningPort 0x68187:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x68307:$str_b7: \update.vbs 0x6794b:$str_b9: Downloaded file: 0x67937:$str_b10: Downloading file: 0x679db:$str_b12: Failed to upload file: 0x68723:$str_b13: StartForward 0x68743:$str_b14: StopForward 0x6825f:$str_b15: fso.DeleteFile " 0x681f3:$str_b16: On Error Resume Next 0x6828f:$str_b17: fso.DeleteFolder " 0x679cb:$str_b18: Uploaded file: 0x6798b:$str_b19: Unable to delete: 0x68227:$str_b20: while fso.FileExists(" 0x67e68:$str_c0: [Firefox StoredLogins not found]
9.2.SndVol.exe.5120000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x677a7:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x67737:$s1: CoGetObject 0x6774b:$s1: CoGetObject 0x67767:$s1: CoGetObject 0x71515:$s1: CoGetObject 0x676f7:$s2: Elevation:Administrator!new:
6.3.colorcpl.exe.315f26a0.10.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.3.colorcpl.exe.315f26a0.11.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.3.colorcpl.exe.315f26a0.8.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.3.colorcpl.exe.315f26a0.8.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.2.colorcpl.exe.71818bf.4.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.colorcpl.exe.71818bf.4.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
6.2.colorcpl.exe.71818bf.4.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.colorcpl.exe.71818bf.4.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6a358:$a1: Remcos restarted by watchdog! 0x6a9a8:$a3: %02i:%02i:%02i:%03i
6.2.colorcpl.exe.71818bf.4.unpack	REMCOS_RAT_variants	unknown	unknown	0x645f4:$str_a1: C:\Windows\System32\cmd.exe 0x64570:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64570:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a70:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x650d8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64664:$str_b2: Executing file: 0x6549c:$str_b3: GetDirectListeningPort 0x64ec8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65048:$str_b7: \update.vbs 0x6468c:$str_b9: Downloaded file: 0x64678:$str_b10: Downloading file: 0x6471c:$str_b12: Failed to upload file: 0x65464:$str_b13: StartForward 0x65484:$str_b14: StopForward 0x64fa0:$str_b15: fso.DeleteFile " 0x64f34:$str_b16: On Error Resume Next 0x64fd0:$str_b17: fso.DeleteFolder " 0x6470c:$str_b18: Uploaded file: 0x646cc:$str_b19: Unable to delete: 0x64f68:$str_b20: while fso.FileExists(" 0x64ba9:$str_c0: [Firefox StoredLogins not found]
6.2.colorcpl.exe.71818bf.4.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x644e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64478:$s1: CoGetObject 0x6448c:$s1: CoGetObject 0x644a8:$s1: CoGetObject 0x6e256:$s1: CoGetObject 0x64438:$s2: Elevation:Administrator!new:
6.2.colorcpl.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.colorcpl.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
6.2.colorcpl.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.colorcpl.exe.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6bd58:$a1: Remcos restarted by watchdog! 0x6c3a8:$a3: %02i:%02i:%02i:%03i
6.2.colorcpl.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x65ff4:$str_a1: C:\Windows\System32\cmd.exe 0x65f70:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65f70:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66470:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66ad8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x66064:$str_b2: Executing file: 0x66e9c:$str_b3: GetDirectListeningPort 0x668c8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66a48:$str_b7: \update.vbs 0x6608c:$str_b9: Downloaded file: 0x66078:$str_b10: Downloading file: 0x6611c:$str_b12: Failed to upload file: 0x66e64:$str_b13: StartForward 0x66e84:$str_b14: StopForward 0x669a0:$str_b15: fso.DeleteFile " 0x66934:$str_b16: On Error Resume Next 0x669d0:$str_b17: fso.DeleteFolder " 0x6610c:$str_b18: Uploaded file: 0x660cc:$str_b19: Unable to delete: 0x66968:$str_b20: while fso.FileExists(" 0x665a9:$str_c0: [Firefox StoredLogins not found]
6.2.colorcpl.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65ee8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65e78:$s1: CoGetObject 0x65e8c:$s1: CoGetObject 0x65ea8:$s1: CoGetObject 0x6fc56:$s1: CoGetObject 0x65e38:$s2: Elevation:Administrator!new:
9.2.SndVol.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.2.SndVol.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
9.2.SndVol.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
9.2.SndVol.exe.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6bd58:$a1: Remcos restarted by watchdog! 0x6c3a8:$a3: %02i:%02i:%02i:%03i
9.2.SndVol.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x65ff4:$str_a1: C:\Windows\System32\cmd.exe 0x65f70:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65f70:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66470:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66ad8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x66064:$str_b2: Executing file: 0x66e9c:$str_b3: GetDirectListeningPort 0x668c8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66a48:$str_b7: \update.vbs 0x6608c:$str_b9: Downloaded file: 0x66078:$str_b10: Downloading file: 0x6611c:$str_b12: Failed to upload file: 0x66e64:$str_b13: StartForward 0x66e84:$str_b14: StopForward 0x669a0:$str_b15: fso.DeleteFile " 0x66934:$str_b16: On Error Resume Next 0x669d0:$str_b17: fso.DeleteFolder " 0x6610c:$str_b18: Uploaded file: 0x660cc:$str_b19: Unable to delete: 0x66968:$str_b20: while fso.FileExists(" 0x665a9:$str_c0: [Firefox StoredLogins not found]
9.2.SndVol.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65ee8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65e78:$s1: CoGetObject 0x65e8c:$s1: CoGetObject 0x65ea8:$s1: CoGetObject 0x6fc56:$s1: CoGetObject 0x65e38:$s2: Elevation:Administrator!new:
6.2.colorcpl.exe.31790000.5.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
9.2.SndVol.exe.51218bf.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.2.SndVol.exe.51218bf.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
9.2.SndVol.exe.51218bf.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
9.2.SndVol.exe.51218bf.2.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6bd58:$a1: Remcos restarted by watchdog! 0x6c3a8:$a3: %02i:%02i:%02i:%03i
9.2.SndVol.exe.51218bf.2.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x65ff4:$str_a1: C:\Windows\System32\cmd.exe 0x65f70:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65f70:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66470:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66ad8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x66064:$str_b2: Executing file: 0x66e9c:$str_b3: GetDirectListeningPort 0x668c8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66a48:$str_b7: \update.vbs 0x6608c:$str_b9: Downloaded file: 0x66078:$str_b10: Downloading file: 0x6611c:$str_b12: Failed to upload file: 0x66e64:$str_b13: StartForward 0x66e84:$str_b14: StopForward 0x669a0:$str_b15: fso.DeleteFile " 0x66934:$str_b16: On Error Resume Next 0x669d0:$str_b17: fso.DeleteFolder " 0x6610c:$str_b18: Uploaded file: 0x660cc:$str_b19: Unable to delete: 0x66968:$str_b20: while fso.FileExists(" 0x665a9:$str_c0: [Firefox StoredLogins not found]
9.2.SndVol.exe.51218bf.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65ee8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65e78:$s1: CoGetObject 0x65e8c:$s1: CoGetObject 0x65ea8:$s1: CoGetObject 0x6fc56:$s1: CoGetObject 0x65e38:$s2: Elevation:Administrator!new:
Click to see the 78 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Creation with Colorcpl

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\colorcpl.exe, ProcessId: 5640, TargetFilename: C:\Users\user\AppData\Roaming\myq.ocx

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\\Users\\user\\Links\Ugisfxtz.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\x.exe, ProcessId: 5076, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ugisfxtz

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\Links\Ugisfxtz.PIF" , CommandLine: "C:\Users\user\Links\Ugisfxtz.PIF" , CommandLine|base64offset|contains: , Image: C:\Users\user\Links\Ugisfxtz.PIF, NewProcessName: C:\Users\user\Links\Ugisfxtz.PIF, OriginalFileName: C:\Users\user\Links\Ugisfxtz.PIF, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Users\user\Links\Ugisfxtz.PIF" , ProcessId: 4896, ProcessName: Ugisfxtz.PIF

Suricata Signatures

ET MALWARE Remcos 3.x Unencrypted Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-03T10:01:35.430937+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49783	172.94.126.47	4688	TCP

ET MALWARE Remcos 3.x Unencrypted Server Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-03T10:01:36.180740+0100	2032777	1	Malware Command and Control Activity Detected	172.94.126.47	4688	192.168.2.6	49783	TCP
2025-03-03T10:04:04.256016+0100	2032777	1	Malware Command and Control Activity Detected	172.94.126.47	4688	192.168.2.6	49783	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-03T10:01:37.083277+0100	2803304	3	Unknown Traffic	192.168.2.6	49790	178.237.33.50	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\Links\Ugisfxtz.PIF	Avira: detection malicious, Label: HEUR/AGEN.1326095
Source: C:\Users\user\AppData\Local\Temp\x.exe	Avira: detection malicious, Label: HEUR/AGEN.1326095

Found malware configuration

Source: 9.2.SndVol.exe.400000.0.unpack

Malware Configuration Extractor: Remcos {"Host:Port:Password": ["kavemarb99juyet1.duckdns.org:4688:0", "kavemarb99juyet1.duckdns.org:4689:1", "kavemarb99juyet2.duckdns.org:4689:0", "kavemarb99juyet3.duckdns.org:4689:0", "kavemarb99juyet4.duckdns.org:4689:0", "kavemarb99juyet5.duckdns.org:4689:0"], "Assigned name": "YAKCMD", "Connect interval": "5", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "shslokuybwg-BKAP0P", "Keylog flag": "1", "Keylog path": "AppData", "Keylog file": "myq.ocx", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "6", "Copy folder": "Remcos", "Keylog folder": ""}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\Links\Ugisfxtz.PIF	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: rDB_YAK_838327E.cmd	Virustotal: Detection: 27%			Perma Link
Source: rDB_YAK_838327E.cmd	ReversingLabs: Detection: 28%

Yara detected Remcos RAT

Source: Yara match	File source: 6.2.colorcpl.exe.7180000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.71818bf.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.51218bf.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.7180000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.5120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.5120000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.71818bf.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.51218bf.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 5640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\myq.ocx, type: DROPPED

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00433B64 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	6_2_00433B64
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071B4823 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	6_2_071B4823
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00433B64 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	9_2_00433B64
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05154823 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	9_2_05154823

Source: colorcpl.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 6.2.colorcpl.exe.7180000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.71818bf.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.51218bf.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.7180000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.5120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.5120000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.71818bf.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.51218bf.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 5640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7036, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00406ABC _wcslen,CoGetObject,		6_2_00406ABC
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00406ABC _wcslen,CoGetObject,		9_2_00406ABC

Source:	Binary string: c:\Projects\VS2005\WebBrowserPassView\Command-Line\WebBrowserPassView.pdb source: colorcpl.exe, 00000006.00000003.2521024701.0000000031B17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496181551.00000000318F4000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521089638.0000000031A55000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496591271.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2478603866.000000003179F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521229038.00000000319A1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4772691610.0000000031790000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520685430.00000000315F2000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2498082588.00000000318F1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520343856.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521160715.0000000031824000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 0000000D.00000002.2516763955.0000000000400000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\416325\out\Release\EaInstHelper.pdb source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_029352F8 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	4_2_029352F8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_004090DC __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	6_2_004090DC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0040B6B5 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	6_2_0040B6B5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0041C7E5 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	6_2_0041C7E5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0040B8BA FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	6_2_0040B8BA
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0044E989 FindFirstFileExA,	6_2_0044E989
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00408CDE __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	6_2_00408CDE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00419CEE FindFirstFileW,FindNextFileW,FindNextFileW,	6_2_00419CEE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00407EDD __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	6_2_00407EDD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00406F13 FindFirstFileW,FindNextFileW,	6_2_00406F13
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0718C579 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	6_2_0718C579
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0718C374 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	6_2_0718C374
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_07188B9C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	6_2_07188B9C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0719A9AD FindFirstFileW,	6_2_0719A9AD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071CF648 FindFirstFileExA,	6_2_071CF648
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0719D4A4 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	6_2_0719D4A4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_07189D9B __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	6_2_07189D9B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_07187BD2 FindFirstFileW,FindNextFileW,	6_2_07187BD2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0718999D __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	6_2_0718999D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_054910F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	6_2_054910F1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_05496580 FindFirstFileExA,	6_2_05496580
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_004090DC __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	9_2_004090DC
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0040B6B5 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	9_2_0040B6B5
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0041C7E5 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	9_2_0041C7E5
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0040B8BA FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	9_2_0040B8BA
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0044E989 FindFirstFileExA,	9_2_0044E989
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00408CDE __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	9_2_00408CDE
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00419CEE FindFirstFileW,FindNextFileW,FindNextFileW,	9_2_00419CEE
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00407EDD __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	9_2_00407EDD
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00406F13 FindFirstFileW,FindNextFileW,	9_2_00406F13
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0512C579 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	9_2_0512C579
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0512C374 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	9_2_0512C374
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0513A9AD FindFirstFileW,	9_2_0513A9AD
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05128B9C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	9_2_05128B9C
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0513D4A4 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	9_2_0513D4A4
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0516F648 FindFirstFileExA,	9_2_0516F648
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05129D9B __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	9_2_05129D9B
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0512999D __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	9_2_0512999D
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05127BD2 FindFirstFileW,FindNextFileW,	9_2_05127BD2

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_00407357 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

6_2_00407357

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49783 -> 172.94.126.47:4688
Source: Network traffic	Suricata IDS: 2032777 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Server Response : 172.94.126.47:4688 -> 192.168.2.6:49783

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: kavemarb99juyet1.duckdns.org
Source: Malware configuration extractor	URLs: kavemarb99juyet1.duckdns.org
Source: Malware configuration extractor	URLs: kavemarb99juyet2.duckdns.org
Source: Malware configuration extractor	URLs: kavemarb99juyet3.duckdns.org
Source: Malware configuration extractor	URLs: kavemarb99juyet4.duckdns.org
Source: Malware configuration extractor	URLs: kavemarb99juyet5.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: kavemarb99juyet1.duckdns.org

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: KEMINETAL KEMINETAL

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49790 -> 178.237.33.50:80

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_00404574 WaitForSingleObject,SetEvent,recv,

6_2_00404574

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: colorcpl.exe, 00000006.00000003.2521024701.0000000031B17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496181551.00000000318F4000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521089638.0000000031A55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: @dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.dathttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: colorcpl.exe, 00000006.00000003.2521024701.0000000031B17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496181551.00000000318F4000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521089638.0000000031A55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: @dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.dathttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: colorcpl.exe, 00000006.00000002.4755424256.0000000005460000.00000040.10000000.00040000.00000000.sdmp, recover.exe, 0000000F.00000002.2502369504.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
Source: colorcpl.exe, 00000006.00000002.4755424256.0000000005460000.00000040.10000000.00040000.00000000.sdmp, recover.exe, 0000000F.00000002.2502369504.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
Source: recover.exe, 0000000D.00000002.2517417441.0000000004A09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srffile://192.168.2.1/all/install/setup.au3file:///C:/Windows/system32/oobe/FirstLogonAnim.htmlhttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: recover.exe, 0000000D.00000002.2517417441.0000000004A09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srffile://192.168.2.1/all/install/setup.au3file:///C:/Windows/system32/oobe/FirstLogonAnim.htmlhttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: colorcpl.exe, 00000006.00000003.2464561625.0000000003444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ted:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.dathttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: colorcpl.exe, 00000006.00000003.2464561625.0000000003444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ted:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.dathttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: kavemarb99juyet1.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: bhv8238.tmp.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://cacerts.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crt0
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl3.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0H
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://crl4.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0
Source: colorcpl.exe, 00000006.00000003.2520874945.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4752885939.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520445252.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2497991322.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2371060750.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2464561625.000000000342D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/
Source: colorcpl.exe, 00000006.00000003.2520874945.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4752885939.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520445252.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2497991322.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2371060750.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2464561625.000000000342D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/j
Source: colorcpl.exe, colorcpl.exe, 00000006.00000003.2520874945.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2371060750.0000000003415000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4752638021.00000000033E4000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521351534.0000000003415000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4752885939.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520874945.0000000003415000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520445252.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2464561625.0000000003405000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2497991322.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520445252.0000000003412000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2497991322.0000000003405000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2371060750.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4752885939.0000000003415000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2464561625.000000000342D000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, bhv8238.tmp.13.dr	String found in binary or memory: http://geoplugin.net/json.gp
Source: colorcpl.exe, 00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp, SndVol.exe, 00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp, SndVol.exe, 00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: colorcpl.exe, 00000006.00000003.2371060750.0000000003415000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521351534.0000000003415000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520874945.0000000003415000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2464561625.0000000003405000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520445252.0000000003412000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2497991322.0000000003405000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4752885939.0000000003415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpLZ
Source: colorcpl.exe, 00000006.00000003.2371060750.0000000003415000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2464561625.0000000003405000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2497991322.0000000003405000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpN
Source: colorcpl.exe, 00000006.00000003.2371060750.0000000003415000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2464561625.0000000003405000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp_
Source: colorcpl.exe, 00000006.00000003.2371060750.0000000003415000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2464561625.0000000003405000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2497991322.0000000003405000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpa
Source: colorcpl.exe, 00000006.00000003.2371060750.0000000003415000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2464561625.0000000003405000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2497991322.0000000003405000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpal
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://ocsp.digicert.com0:
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://ocsp.digicert.com0Q
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://ocsp.msocsp.com0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://ocsp.msocsp.com0S
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crl0a
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcd.com0&
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.360.cn
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: bhv8238.tmp.13.dr	String found in binary or memory: http://www.digicert.com/CPS0~
Source: colorcpl.exe, 00000006.00000002.4755424256.0000000005460000.00000040.10000000.00040000.00000000.sdmp, recover.exe, 0000000F.00000002.2502369504.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com
Source: colorcpl.exe, 00000006.00000002.4755424256.0000000005460000.00000040.10000000.00040000.00000000.sdmp, recover.exe, 0000000F.00000002.2502369504.0000000000400000.00000040.80000000.00040000.00000000.sdmp, recover.exe, 0000000F.00000003.2502064831.000000000389D000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 0000000F.00000003.2502110970.000000000389D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.imvu.com
Source: colorcpl.exe, 00000006.00000002.4755424256.0000000005460000.00000040.10000000.00040000.00000000.sdmp, recover.exe, 0000000F.00000002.2502369504.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
Source: recover.exe, 0000000F.00000003.2502064831.000000000389D000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 0000000F.00000003.2502110970.000000000389D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.imvu.compData
Source: colorcpl.exe, 00000006.00000002.4755424256.0000000005460000.00000040.10000000.00040000.00000000.sdmp, recover.exe, 0000000F.00000002.2502369504.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comr
Source: recover.exe, 0000000D.00000002.2516886927.0000000002994000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net
Source: recover.exe, 0000000F.00000002.2502369504.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pmail.com
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EL
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/ODSP_Sync_Client/19.043.0304.0013?UpdateRing=Prod&OS=Win&OSV
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://fp-afd.azureedge.net/apc/trans.gif?0684adfa5500b3bab63593997d26215c
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://fp-afd.azureedge.net/apc/trans.gif?79b1312614e5ac304828ba5e1fdb4fa3
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?7ae939fc98ce1346dd2e496abdba2d3b
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?9f3db9405f1b2793ad8d8de9770248e4
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?4aec53910de6415b25f2c4faf3f7e54a
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?77290711a5e44a163ac2e666ad7b53fd
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://fp.msedge.net/conf/v1/asgw/fpconfig.min.json
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://fp.msedge.net/conf/v2/asgw/fpconfig.min.json?monitorId=asgw
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.css
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOq
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2.js
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-09-17-00-05-23/PreSignInSettingsConfig.json?One
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2023-10-05-06-30-24/PreSignInSettingsConfig.json?One
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2023-10-05-06-40-12/PreSignInSettingsConfig.json
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/update100.xml?OneDriveUpdate=14d1c105224b3e736c3c
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/741e3e8c607c445262f3add0e58b18f19e0502af.xml?OneDriveUpdate=7fe112
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/ew-preload-inline-2523c8c1505f1172be19.js
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-104bffe9378b8041455c.js
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-35de8a913e.css
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-async-styles.a903b7d0ab82e5bd2f8a.chunk.v7.css
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bootstrap-5e7af218e953d095fabf.js
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-3a99f64809c6780df035.js
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-994d8943fc9264e2f8d3.css
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-fluent~left-nav-rc.ac5cfbeadfd63fc27ffd.chunk.v7.js
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-forms-group~mru~officeforms-group-forms~officeforms
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7.js
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-mru.2ce72562ad7c0ae7059c.chunk.v7.js
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendor-bundle-ba2888a24179bf152f3d.js
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.169ce481376dceef3ef6.chunk.v7.c
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7.j
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwaunauth-9d8bc214ac.css
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedfontstyles-27fa2598d8.css
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedscripts-939520eada.js
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticpwascripts-30998bff8f.js
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticstylesfabric-35c34b95e3.css
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/hero-image-desktop-f6720a4145.jpg
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/lockup-mslogo-color-78c06e8898.png
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/microsoft-365-logo-01d5ecd01a.png
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-apps-image-46596a6856.png
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-checkmark-image-1999f0bf81.png
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/officehome/thirdpartynotice.html
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_regular.woff2
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_semibold.woff2
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/03
Source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06
Source: colorcpl.exe, 00000006.00000002.4755424256.0000000005460000.00000040.10000000.00040000.00000000.sdmp, recover.exe, 0000000F.00000002.2502369504.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: bhv8238.tmp.13.dr	String found in binary or memory: https://www.office.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_00409D1E SetWindowsHookExA 0000000D,00409D0A,00000000

6_2_00409D1E

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_0040B158 OpenClipboard,GetClipboardData,CloseClipboard,

6_2_0040B158

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0041696E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	6_2_0041696E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0719762D OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	6_2_0719762D
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0041696E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	9_2_0041696E
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0513762D OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	9_2_0513762D

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_0040B158 OpenClipboard,GetClipboardData,CloseClipboard,

6_2_0040B158

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_00409E4A GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

6_2_00409E4A

Source: Yara match	File source: 6.2.colorcpl.exe.7180000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.71818bf.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.51218bf.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.7180000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.5120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.5120000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.71818bf.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.51218bf.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 5640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7036, type: MEMORYSTR

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 6.2.colorcpl.exe.7180000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.71818bf.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.51218bf.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.7180000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.5120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.5120000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.71818bf.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.51218bf.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 5640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\myq.ocx, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0041CF2D SystemParametersInfoW,	6_2_0041CF2D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0719DBEC SystemParametersInfoW,	6_2_0719DBEC
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0041CF2D SystemParametersInfoW,	9_2_0041CF2D
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0513DBEC SystemParametersInfoW,	9_2_0513DBEC

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.colorcpl.exe.7180000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.colorcpl.exe.7180000.3.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.2.colorcpl.exe.7180000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.colorcpl.exe.71818bf.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.colorcpl.exe.71818bf.4.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.2.colorcpl.exe.71818bf.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.SndVol.exe.51218bf.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.SndVol.exe.51218bf.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.SndVol.exe.51218bf.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.colorcpl.exe.7180000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.colorcpl.exe.7180000.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.2.colorcpl.exe.7180000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.SndVol.exe.5120000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.SndVol.exe.5120000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.SndVol.exe.5120000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.SndVol.exe.5120000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.SndVol.exe.5120000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.SndVol.exe.5120000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.colorcpl.exe.71818bf.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.colorcpl.exe.71818bf.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.2.colorcpl.exe.71818bf.4.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.SndVol.exe.51218bf.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.SndVol.exe.51218bf.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.SndVol.exe.51218bf.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: colorcpl.exe PID: 5640, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: SndVol.exe PID: 7036, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Windows\SysWOW64\colorcpl.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02943380 NtWriteVirtualMemory,	4_2_02943380
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02943034 NtAllocateVirtualMemory,	4_2_02943034
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02949654 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	4_2_02949654
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02949738 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	4_2_02949738
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02946AE0 GetModuleHandleW,NtOpenProcess,IsBadReadPtr,IsBadReadPtr,GetModuleHandleW,NtCreateThreadEx,	4_2_02946AE0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_0294421C GetThreadContext,SetThreadContext,NtResumeThread,	4_2_0294421C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_0294421A GetThreadContext,SetThreadContext,NtResumeThread,	4_2_0294421A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02943032 NtAllocateVirtualMemory,	4_2_02943032
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_029495CC RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	4_2_029495CC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02949578 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	4_2_02949578
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_0294399C NtProtectVirtualMemory,	4_2_0294399C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00418267 GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,GetLastError,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,	6_2_00418267
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0041C077 OpenProcess,NtSuspendProcess,CloseHandle,	6_2_0041C077
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0041C0A3 OpenProcess,NtResumeProcess,CloseHandle,	6_2_0041C0A3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_07198F26 CreateProcessW,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,SetThreadContext,ResumeThread,GetLastError,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,	6_2_07198F26
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0719CD36 OpenProcess,NtSuspendProcess,CloseHandle,	6_2_0719CD36
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0719CD62 OpenProcess,NtResumeProcess,CloseHandle,	6_2_0719CD62
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0719E987 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	6_2_0719E987
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_02906AE0 GetModuleHandleW,NtOpenProcess,IsBadReadPtr,IsBadReadPtr,GetModuleHandleW,NtCreateThreadEx,	8_2_02906AE0
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_02903380 NtWriteVirtualMemory,	8_2_02903380
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_02903034 NtAllocateVirtualMemory,	8_2_02903034
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_02909738 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	8_2_02909738
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_0290421A Toolhelp32ReadProcessMemory,Thread32Next,GetThreadContext,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Toolhelp32ReadProcessMemory,Heap32ListFirst,SetThreadContext,NtResumeThread,Thread32Next,	8_2_0290421A
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_0290421C Toolhelp32ReadProcessMemory,Thread32Next,GetThreadContext,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Toolhelp32ReadProcessMemory,Heap32ListFirst,SetThreadContext,NtResumeThread,Thread32Next,	8_2_0290421C
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_02903A34 NtProtectVirtualMemory,	8_2_02903A34
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_02909809 NtQueryInformationFile,NtReadFile,NtClose,	8_2_02909809
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_02903032 NtAllocateVirtualMemory,	8_2_02903032
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_0290399C NtProtectVirtualMemory,	8_2_0290399C
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_02909654 RtlDosPathNameToNtPathName_U,NtWriteFile,NtClose,	8_2_02909654
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_0290341B NtWriteVirtualMemory,	8_2_0290341B
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_029095CC RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	8_2_029095CC
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_02909578 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	8_2_02909578
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0513E987 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	9_2_0513E987

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 4_2_0294A634 InetIsOffline,Sleep,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

4_2_0294A634

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00416861 ExitWindowsEx,LoadLibraryA,GetProcAddress,	6_2_00416861
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_07197520 ExitWindowsEx,LoadLibraryA,GetProcAddress,	6_2_07197520
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00416861 ExitWindowsEx,LoadLibraryA,GetProcAddress,	9_2_00416861
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05137520 ExitWindowsEx,LoadLibraryA,GetProcAddress,	9_2_05137520

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_029320B4	4_2_029320B4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0042809D	6_2_0042809D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0045412B	6_2_0045412B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_004421C0	6_2_004421C0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_004281D7	6_2_004281D7
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0043E1E0	6_2_0043E1E0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0041E29B	6_2_0041E29B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_004373DA	6_2_004373DA
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00438380	6_2_00438380
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00453472	6_2_00453472
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0042747E	6_2_0042747E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0043E43D	6_2_0043E43D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_004325A1	6_2_004325A1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0041F809	6_2_0041F809
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_004279F5	6_2_004279F5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0044DAD9	6_2_0044DAD9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00433C73	6_2_00433C73
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00413CA0	6_2_00413CA0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0043DD82	6_2_0043DD82
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00435F52	6_2_00435F52
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0043DFB1	6_2_0043DFB1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071CE798	6_2_071CE798
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071A86B4	6_2_071A86B4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071A04C8	6_2_071A04C8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071A813D	6_2_071A813D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071D4131	6_2_071D4131
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071B8099	6_2_071B8099
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0719EF5A	6_2_0719EF5A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071C2E7F	6_2_071C2E7F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071BEE9F	6_2_071BEE9F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071A8E96	6_2_071A8E96
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071A8D5C	6_2_071A8D5C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071D4DEA	6_2_071D4DEA
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071B6C11	6_2_071B6C11
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071BEC70	6_2_071BEC70
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071BEA41	6_2_071BEA41
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071B4932	6_2_071B4932
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0719495F	6_2_0719495F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071B3260	6_2_071B3260
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071B903F	6_2_071B903F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071BF0FC	6_2_071BF0FC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0549B5C1	6_2_0549B5C1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_054A7194	6_2_054A7194
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: 8_2_028F20B4	8_2_028F20B4
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0042809D	9_2_0042809D
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0045412B	9_2_0045412B
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_004421C0	9_2_004421C0
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_004281D7	9_2_004281D7
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0043E1E0	9_2_0043E1E0
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0041E29B	9_2_0041E29B
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_004373DA	9_2_004373DA
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00438380	9_2_00438380
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00453472	9_2_00453472
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0042747E	9_2_0042747E
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0043E43D	9_2_0043E43D
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_004325A1	9_2_004325A1
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0041F809	9_2_0041F809
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_004279F5	9_2_004279F5
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0044DAD9	9_2_0044DAD9
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00433C73	9_2_00433C73
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00413CA0	9_2_00413CA0
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0043DD82	9_2_0043DD82
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00435F52	9_2_00435F52
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0043DFB1	9_2_0043DFB1
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_051404C8	9_2_051404C8
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0516E798	9_2_0516E798
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_051486B4	9_2_051486B4
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05174131	9_2_05174131
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0514813D	9_2_0514813D
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05158099	9_2_05158099
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05148D5C	9_2_05148D5C
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05174DEA	9_2_05174DEA
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05156C11	9_2_05156C11
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0515EC70	9_2_0515EC70
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0513EF5A	9_2_0513EF5A
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05162E7F	9_2_05162E7F
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05148E96	9_2_05148E96
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0515EE9F	9_2_0515EE9F
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05154932	9_2_05154932
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0513495F	9_2_0513495F
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0515EA41	9_2_0515EA41
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0515903F	9_2_0515903F
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0515F0FC	9_2_0515F0FC
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05153260	9_2_05153260

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 02943E20 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 02943E9C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 02934414 appears 246 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 0293457C appears 827 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 0293421C appears 64 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 004351E0 appears 55 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 071B578E appears 43 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 00434ACF appears 43 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 00401F96 appears 49 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 00401EBF appears 32 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 071B5E9F appears 55 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 07182DD6 appears 39 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 00402117 appears 41 times
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: String function: 028F457C appears 566 times
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: String function: 02903E20 appears 48 times
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: String function: 028F4414 appears 154 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 004351E0 appears 55 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 05155E9F appears 55 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 00434ACF appears 43 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 00401F96 appears 49 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 05122DD6 appears 39 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 0515578E appears 43 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 00401EBF appears 32 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 00402117 appears 39 times

Source: 6.2.colorcpl.exe.7180000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.colorcpl.exe.7180000.3.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.2.colorcpl.exe.7180000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.colorcpl.exe.71818bf.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.colorcpl.exe.71818bf.4.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.2.colorcpl.exe.71818bf.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.SndVol.exe.51218bf.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.SndVol.exe.51218bf.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.SndVol.exe.51218bf.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.colorcpl.exe.7180000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.colorcpl.exe.7180000.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.2.colorcpl.exe.7180000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.SndVol.exe.5120000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.SndVol.exe.5120000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.SndVol.exe.5120000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.SndVol.exe.5120000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.SndVol.exe.5120000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.SndVol.exe.5120000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.colorcpl.exe.71818bf.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.colorcpl.exe.71818bf.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.2.colorcpl.exe.71818bf.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.SndVol.exe.51218bf.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.SndVol.exe.51218bf.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.SndVol.exe.51218bf.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: colorcpl.exe PID: 5640, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: SndVol.exe PID: 7036, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.phis.troj.spyw.expl.evad.winCMD@20/7@5/2

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00417AD9 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	6_2_00417AD9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_07198798 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	6_2_07198798
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00417AD9 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	9_2_00417AD9
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05138798 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	9_2_05138798

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 4_2_0293793A GetDiskFreeSpaceA,

4_2_0293793A

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 4_2_02946760 CreateToolhelp32Snapshot,

4_2_02946760

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_0041B9AB FindResourceA,LoadResource,LockResource,SizeofResource,

6_2_0041B9AB

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_0041AC43 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

6_2_0041AC43

Source: C:\Users\user\AppData\Local\Temp\x.exe

File created: C:\Users\user\Links\Ugisfxtz.PIF

Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe	Mutant created: \Sessions\1\BaseNamedObjects\shslokuybwg-BKAP0P
Source: C:\Windows\SysWOW64\SndVol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Windows Volume App Window
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6728:120:WilError_03

Source: C:\Windows\System32\extrac32.exe

File created: C:\Users\user\AppData\Local\Temp\CAB01424.TMP

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\SysWOW64\recover.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Windows\SysWOW64\recover.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Windows\System32\extrac32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: colorcpl.exe, 00000006.00000003.2521024701.0000000031B17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496181551.00000000318F4000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521089638.0000000031A55000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496591271.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2478603866.000000003179F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521229038.00000000319A1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4772691610.0000000031790000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520685430.00000000315F2000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2498082588.00000000318F1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520343856.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521160715.0000000031824000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: colorcpl.exe, 00000006.00000003.2521024701.0000000031B17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496181551.00000000318F4000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521089638.0000000031A55000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496591271.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2478603866.000000003179F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4772817881.00000000318F0000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521229038.00000000319A1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4772691610.0000000031790000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520685430.00000000315F2000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2498082588.00000000318F1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520343856.0000000031591000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: colorcpl.exe, 00000006.00000003.2521024701.0000000031B17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496181551.00000000318F4000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521089638.0000000031A55000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496591271.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2464432145.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2478603866.000000003179F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521229038.00000000319A1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4772691610.0000000031790000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520685430.00000000315F2000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2498082588.00000000318F1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520343856.0000000031591000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: colorcpl.exe, 00000006.00000003.2521024701.0000000031B17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496181551.00000000318F4000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521089638.0000000031A55000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496591271.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2478603866.000000003179F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521229038.00000000319A1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4772691610.0000000031790000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520685430.00000000315F2000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2498082588.00000000318F1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520343856.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521160715.0000000031824000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: colorcpl.exe, 00000006.00000003.2521024701.0000000031B17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496181551.00000000318F4000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521089638.0000000031A55000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496591271.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2464432145.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2478603866.000000003179F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521229038.00000000319A1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4772691610.0000000031790000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520685430.00000000315F2000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2498082588.00000000318F1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520343856.0000000031591000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: colorcpl.exe, 00000006.00000003.2521024701.0000000031B17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496181551.00000000318F4000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521089638.0000000031A55000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496591271.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2464432145.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2478603866.000000003179F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521229038.00000000319A1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4772691610.0000000031790000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520685430.00000000315F2000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2498082588.00000000318F1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520343856.0000000031591000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: recover.exe, 0000000D.00000002.2517461592.0000000004F3F000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 0000000D.00000003.2515401265.0000000004F3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: colorcpl.exe, 00000006.00000003.2521024701.0000000031B17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496181551.00000000318F4000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521089638.0000000031A55000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496591271.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2478603866.000000003179F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521229038.00000000319A1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4772691610.0000000031790000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520685430.00000000315F2000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2498082588.00000000318F1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520343856.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521160715.0000000031824000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: rDB_YAK_838327E.cmd	Virustotal: Detection: 27%
Source: rDB_YAK_838327E.cmd	ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\rDB_YAK_838327E.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\rDB_YAK_838327E.cmd" "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
Source: unknown	Process created: C:\Users\user\Links\Ugisfxtz.PIF "C:\Users\user\Links\Ugisfxtz.PIF"
Source: C:\Users\user\Links\Ugisfxtz.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe
Source: unknown	Process created: C:\Users\user\Links\Ugisfxtz.PIF "C:\Users\user\Links\Ugisfxtz.PIF"
Source: C:\Users\user\Links\Ugisfxtz.PIF	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
Source: C:\Windows\SysWOW64\colorcpl.exe	Process created: C:\Windows\SysWOW64\recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\user\AppData\Local\Temp\xrkt"
Source: C:\Windows\SysWOW64\colorcpl.exe	Process created: C:\Windows\SysWOW64\recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\user\AppData\Local\Temp\atxlilk"
Source: C:\Windows\SysWOW64\colorcpl.exe	Process created: C:\Windows\SysWOW64\recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\user\AppData\Local\Temp\kndwjdukttx"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\rDB_YAK_838327E.cmd" "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process created: C:\Windows\SysWOW64\recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\user\AppData\Local\Temp\xrkt"	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process created: C:\Windows\SysWOW64\recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\user\AppData\Local\Temp\atxlilk"	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process created: C:\Windows\SysWOW64\recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\user\AppData\Local\Temp\kndwjdukttx"	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??????s?.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: tquery.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppwmi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppcext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: colorui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: sti.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??????s?.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: tquery.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Section loaded: endpointdlp.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\colorcpl.exe

Window detected: Number of UI elements: 12

Source: C:\Windows\SysWOW64\recover.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

Jump to behavior

Source: rDB_YAK_838327E.cmd

Static file information: File size 1625627 > 1048576

Source:	Binary string: c:\Projects\VS2005\WebBrowserPassView\Command-Line\WebBrowserPassView.pdb source: colorcpl.exe, 00000006.00000003.2521024701.0000000031B17000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496181551.00000000318F4000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521089638.0000000031A55000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2496591271.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2478603866.000000003179F000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521229038.00000000319A1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4772691610.0000000031790000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520685430.00000000315F2000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2498082588.00000000318F1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520343856.0000000031591000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521160715.0000000031824000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 0000000D.00000002.2516763955.0000000000400000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\416325\out\Release\EaInstHelper.pdb source: x.exe, 00000004.00000003.2291500219.000000007EDE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2323503161.000000002065A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2345869038.000000007ECEF000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 4.2.x.exe.2930000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2347317719.000000007FB00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 4_2_02943E20 LoadLibraryW,GetProcAddress,WriteProcessMemory,FreeLibrary,

4_2_02943E20

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_029562A4 push 0295630Fh; ret	4_2_02956307
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02933210 push eax; ret	4_2_0293324C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_029560AC push 02956125h; ret	4_2_0295611D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_0294A018 push ecx; mov dword ptr [esp], edx	4_2_0294A01D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_0294606C push 029460A4h; ret	4_2_0294609C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_0293C1F4 push 0293C61Eh; ret	4_2_0293C616
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_029561F8 push 02956288h; ret	4_2_02956280
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02956144 push 029561ECh; ret	4_2_029561E4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_0293617A push 029361BEh; ret	4_2_029361B6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_0293617C push 029361BEh; ret	4_2_029361B6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_0293F600 push 0293F64Dh; ret	4_2_0293F645
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_0293C498 push 0293C61Eh; ret	4_2_0293C616
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_0293F4F4 push 0293F56Ah; ret	4_2_0293F562
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02942410 push ecx; mov dword ptr [esp], edx	4_2_02942412
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_0293F5FF push 0293F64Dh; ret	4_2_0293F645
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02955504 push 029556E0h; ret	4_2_029556D8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02942EDC push 02942F87h; ret	4_2_02942F7F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02942EDA push 02942F87h; ret	4_2_02942F7F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_0293BE18 push ecx; mov dword ptr [esp], edx	4_2_0293BE1D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02943F84 push 02943FBCh; ret	4_2_02943FB4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02949FB4 push ecx; mov dword ptr [esp], edx	4_2_02949FB9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02935D9E push 02935DFBh; ret	4_2_02935DF3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02935DA0 push 02935DFBh; ret	4_2_02935DF3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_0293CDE0 push 0293CE0Ch; ret	4_2_0293CE04
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_02943D40 push 02943D82h; ret	4_2_02943D7A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_004570CF push ecx; ret	6_2_004570E2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00435226 push ecx; ret	6_2_00435239
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0045D9ED push esi; ret	6_2_0045D9F6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00457A00 push eax; ret	6_2_00457A1E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071D86BF push eax; ret	6_2_071D86DD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071B5EE5 push ecx; ret	6_2_071B5EF8

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\AppData\Local\Temp\x.exe

File created: C:\Users\user\Links\Ugisfxtz.PIF

Jump to dropped file

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_004062E2 ShellExecuteW,URLDownloadToFileW,

6_2_004062E2

Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\user\AppData\Local\Temp\x.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Users\user\Links\Ugisfxtz.PIF			Jump to dropped file

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_0041AC43 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

6_2_0041AC43

Source: C:\Users\user\AppData\Local\Temp\x.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ugisfxtz			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ugisfxtz			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 4_2_029464E4 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_029464E4

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	6_2_0041A941
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	6_2_0719B600
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	9_2_0041A941
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	9_2_0513B600

Source: C:\Windows\SysWOW64\colorcpl.exe	Window / User API: threadDelayed 824	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Window / User API: threadDelayed 8837	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Window / User API: foregroundWindowGot 1746	Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_6-102246

Source: C:\Windows\SysWOW64\colorcpl.exe	API coverage: 9.2 %
Source: C:\Windows\SysWOW64\SndVol.exe	API coverage: 3.3 %

Source: C:\Windows\SysWOW64\colorcpl.exe TID: 6324	Thread sleep time: -60500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 5376	Thread sleep time: -2472000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 5376	Thread sleep time: -26511000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_029352F8 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	4_2_029352F8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_004090DC __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	6_2_004090DC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0040B6B5 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	6_2_0040B6B5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0041C7E5 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	6_2_0041C7E5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0040B8BA FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	6_2_0040B8BA
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0044E989 FindFirstFileExA,	6_2_0044E989
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00408CDE __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	6_2_00408CDE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00419CEE FindFirstFileW,FindNextFileW,FindNextFileW,	6_2_00419CEE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00407EDD __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	6_2_00407EDD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00406F13 FindFirstFileW,FindNextFileW,	6_2_00406F13
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0718C579 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	6_2_0718C579
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0718C374 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	6_2_0718C374
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_07188B9C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	6_2_07188B9C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0719A9AD FindFirstFileW,	6_2_0719A9AD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071CF648 FindFirstFileExA,	6_2_071CF648
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0719D4A4 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	6_2_0719D4A4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_07189D9B __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	6_2_07189D9B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_07187BD2 FindFirstFileW,FindNextFileW,	6_2_07187BD2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0718999D __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	6_2_0718999D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_054910F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	6_2_054910F1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_05496580 FindFirstFileExA,	6_2_05496580
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_004090DC __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	9_2_004090DC
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0040B6B5 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	9_2_0040B6B5
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0041C7E5 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	9_2_0041C7E5
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0040B8BA FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	9_2_0040B8BA
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0044E989 FindFirstFileExA,	9_2_0044E989
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00408CDE __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	9_2_00408CDE
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00419CEE FindFirstFileW,FindNextFileW,FindNextFileW,	9_2_00419CEE
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00407EDD __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	9_2_00407EDD
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00406F13 FindFirstFileW,FindNextFileW,	9_2_00406F13
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0512C579 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	9_2_0512C579
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0512C374 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	9_2_0512C374
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0513A9AD FindFirstFileW,	9_2_0513A9AD
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05128B9C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	9_2_05128B9C
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0513D4A4 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	9_2_0513D4A4
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0516F648 FindFirstFileExA,	9_2_0516F648
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05129D9B __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	9_2_05129D9B
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0512999D __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	9_2_0512999D
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05127BD2 FindFirstFileW,FindNextFileW,	9_2_05127BD2

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_00407357 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

6_2_00407357

Source: recover.exe, 0000000D.00000003.2514682781.0000000004F31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0Vhp
Source: x.exe, 00000004.00000002.2306245246.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll/
Source: colorcpl.exe, 00000006.00000003.2464561625.0000000003444000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2371140961.0000000003444000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4752885939.0000000003444000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520874945.0000000003444000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520445252.0000000003444000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2497405371.0000000003444000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2521351534.0000000003444000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: bhv8238.tmp.13.dr	Binary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: colorcpl.exe, 00000006.00000002.4752638021.00000000033E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: Ugisfxtz.PIF, 00000008.00000002.2403710839.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllL
Source: Ugisfxtz.PIF, 0000000B.00000002.2481130880.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\x.exe	API call chain: ExitProcess graph end node	graph_4-22738
Source: C:\Windows\SysWOW64\colorcpl.exe	API call chain: ExitProcess graph end node	graph_6-102908
Source: C:\Users\user\Links\Ugisfxtz.PIF	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\x.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 4_2_0294A5B0 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

4_2_0294A5B0

Source: C:\Users\user\AppData\Local\Temp\x.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_0043B88D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_0043B88D

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 4_2_02943E20 LoadLibraryW,GetProcAddress,WriteProcessMemory,FreeLibrary,

4_2_02943E20

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_004438F4 mov eax, dword ptr fs:[00000030h]	6_2_004438F4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_07181126 mov eax, dword ptr fs:[00000030h]	6_2_07181126
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_07181126 mov eax, dword ptr fs:[00000030h]	6_2_07181126
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071C45B3 mov eax, dword ptr fs:[00000030h]	6_2_071C45B3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_05494AB4 mov eax, dword ptr fs:[00000030h]	6_2_05494AB4
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_004438F4 mov eax, dword ptr fs:[00000030h]	9_2_004438F4
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05121126 mov eax, dword ptr fs:[00000030h]	9_2_05121126
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05121126 mov eax, dword ptr fs:[00000030h]	9_2_05121126
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_051645B3 mov eax, dword ptr fs:[00000030h]	9_2_051645B3

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_00411999 GetNativeSystemInfo,GetProcessHeap,HeapAlloc,SetLastError,SetLastError,

6_2_00411999

Source: C:\Windows\SysWOW64\recover.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00435398 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00435398
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_0043B88D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0043B88D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00434D6E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00434D6E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_00434F01 SetUnhandledExceptionFilter,	6_2_00434F01
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071BC54C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_071BC54C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071B6057 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_071B6057
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071B5BC0 SetUnhandledExceptionFilter,	6_2_071B5BC0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_071B5A2D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_071B5A2D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_05492639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_05492639
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_054960E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_054960E2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 6_2_05492B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_05492B1C
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00435398 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00435398
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0043B88D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_0043B88D
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00434D6E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00434D6E
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_00434F01 SetUnhandledExceptionFilter,	9_2_00434F01
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_0515C54C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_0515C54C
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05156057 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_05156057
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05155BC0 SetUnhandledExceptionFilter,	9_2_05155BC0
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 9_2_05155A2D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_05155A2D

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 7180000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Memory allocated: C:\Windows\SysWOW64\SndVol.exe base: 5120000 protect: page execute and read and write			Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_00418267 GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,GetLastError,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,

6_2_00418267

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread created: C:\Windows\SysWOW64\colorcpl.exe EIP: 71815BC			Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Thread created: C:\Windows\SysWOW64\SndVol.exe EIP: 51215BC			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 7180000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Memory written: C:\Windows\SysWOW64\SndVol.exe base: 5120000 value starts with: 4D5A			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: NULL target: C:\Windows\SysWOW64\recover.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: NULL target: C:\Windows\SysWOW64\recover.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: NULL target: C:\Windows\SysWOW64\recover.exe protection: execute and read and write	Jump to behavior

Sample uses process hollowing technique

Source: C:\Windows\SysWOW64\colorcpl.exe	Section unmapped: C:\Windows\SysWOW64\recover.exe base address: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section unmapped: C:\Windows\SysWOW64\recover.exe base address: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section unmapped: C:\Windows\SysWOW64\recover.exe base address: 400000	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 7180000	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Memory written: C:\Windows\SysWOW64\recover.exe base: 2A9A008	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Memory written: C:\Windows\SysWOW64\recover.exe base: 2AF4008	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Memory written: C:\Windows\SysWOW64\recover.exe base: 313C008	Jump to behavior
Source: C:\Users\user\Links\Ugisfxtz.PIF	Memory written: C:\Windows\SysWOW64\SndVol.exe base: 5120000	Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_004197D9 mouse_event,

6_2_004197D9

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\rDB_YAK_838327E.cmd" "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process created: C:\Windows\SysWOW64\recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\user\AppData\Local\Temp\xrkt"	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process created: C:\Windows\SysWOW64\recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\user\AppData\Local\Temp\atxlilk"	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process created: C:\Windows\SysWOW64\recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\user\AppData\Local\Temp\kndwjdukttx"	Jump to behavior

Source: colorcpl.exe, 00000006.00000002.4752885939.000000000342D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerGl
Source: colorcpl.exe, 00000006.00000002.4752885939.000000000342D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerGL
Source: colorcpl.exe, 00000006.00000002.4752885939.000000000342D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerG
Source: colorcpl.exe, 00000006.00000003.2497991322.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2464561625.000000000342D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managere
Source: colorcpl.exe, 00000006.00000003.2464561625.000000000342D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerneer
Source: colorcpl.exe, 00000006.00000002.4752885939.000000000342D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager#
Source: colorcpl.exe, 00000006.00000003.2520874945.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4752885939.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000003.2520445252.000000000342D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: colorcpl.exe, 00000006.00000003.2497991322.000000000342D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr]
Source: colorcpl.exe, 00000006.00000002.4752885939.000000000342D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: colorcpl.exe, 00000006.00000002.4752885939.000000000342D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manageres }
Source: colorcpl.exe, 00000006.00000002.4752885939.000000000342D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000006.00000002.4752885939.0000000003415000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: colorcpl.exe, 00000006.00000003.2464561625.000000000342D000.00000004.00000020.00020000.00000000.sdmp, myq.ocx.6.dr	Binary or memory string: [Program Manager]

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_00435034 cpuid

6_2_00435034

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	4_2_029354BC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetLocaleInfoA,	4_2_0293A0B8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetLocaleInfoA,	4_2_0293A104
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	4_2_029355C8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	6_2_004520E2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	6_2_00452097
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	6_2_0045217D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoA,	6_2_0040F26B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_0045220A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	6_2_0044844E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	6_2_0045245A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_00452583
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	6_2_0045268A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_00452757
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	6_2_00448937
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	6_2_00451E1F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	6_2_071D2E3C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_071D2EC9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	6_2_071D2D56
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	6_2_071D2DA1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	6_2_071D2ADE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	6_2_071C95F6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_071D3416
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	6_2_071D3349
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_071D3242
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	6_2_071D3119
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	6_2_071C910D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoA,	6_2_0718FF2A
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	8_2_028F54BC
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: GetLocaleInfoA,	8_2_028FA104
Source: C:\Users\user\Links\Ugisfxtz.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	8_2_028F55C7
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: EnumSystemLocalesW,	9_2_004520E2
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: EnumSystemLocalesW,	9_2_00452097
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: EnumSystemLocalesW,	9_2_0045217D
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoA,	9_2_0040F26B
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_0045220A
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: EnumSystemLocalesW,	9_2_0044844E
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,	9_2_0045245A
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_00452583
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,	9_2_0045268A
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_00452757
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,	9_2_00448937
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	9_2_00451E1F
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: EnumSystemLocalesW,	9_2_05172D56
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: EnumSystemLocalesW,	9_2_05172DA1
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: EnumSystemLocalesW,	9_2_05172E3C
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_05172EC9
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	9_2_05172ADE
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,	9_2_051695F6
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_05173416
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,	9_2_05173119
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: EnumSystemLocalesW,	9_2_0516910D
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,	9_2_05173349
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_05173242
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoA,	9_2_0512FF2A

Source: C:\Windows\SysWOW64\recover.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 4_2_02938B38 GetLocalTime,

4_2_02938B38

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 4_2_02949F00 GetUserNameA,

4_2_02949F00

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 6_2_004491DA _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

6_2_004491DA

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 4_2_0293B038 GetVersionExA,

4_2_0293B038

Source: C:\Users\user\AppData\Local\Temp\x.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 6.2.colorcpl.exe.7180000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.71818bf.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.51218bf.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.7180000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.5120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.5120000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.71818bf.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.51218bf.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 5640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\myq.ocx, type: DROPPED

Contains functionality to steal Chrome passwords or cookies

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		6_2_0040B59B
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		9_2_0040B59B

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	6_2_0040B6B5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: \key3.db	6_2_0040B6B5
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	9_2_0040B6B5
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: \key3.db	9_2_0040B6B5

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\recover.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\SysWOW64\recover.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Key opened: HKEY_CURRENT_USER\Software\Paltalk	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\recover.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail	Jump to behavior

Yara detected WebBrowserPassView password recovery tool

Source: Yara match	File source: 6.2.colorcpl.exe.31790000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.colorcpl.exe.315f26a0.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.recover.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.colorcpl.exe.315f26a0.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.recover.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.colorcpl.exe.315f26a0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.colorcpl.exe.315f26a0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.colorcpl.exe.315f26a0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.colorcpl.exe.315f26a0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.31790000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2516763955.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2496181551.00000000318F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2521024701.0000000031B17000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2521089638.0000000031A55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2496591271.0000000031591000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2478603866.000000003179F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2521229038.00000000319A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4772691610.0000000031790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2520685430.00000000315F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2498082588.00000000318F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2521160715.0000000031824000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2520343856.0000000031591000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 5640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: recover.exe PID: 6252, type: MEMORYSTR

Remote Access Functionality

Yara detected Remcos RAT

Source: Yara match	File source: 6.2.colorcpl.exe.7180000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.71818bf.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.51218bf.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.7180000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.5120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.5120000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.71818bf.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.SndVol.exe.51218bf.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2403852969.0000000005120000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4749337631.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2403177094.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4755736828.0000000007180000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 5640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\myq.ocx, type: DROPPED

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: cmd.exe		6_2_00405091
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: cmd.exe		9_2_00405091

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Shared Modules	1 Valid Accounts	1 Bypass User Account Control	2 Obfuscated Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Valid Accounts	1 DLL Side-Loading	1 Credentials in Registry	1 System Service Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	1 Registry Run Keys / Startup Folder	11 Access Token Manipulation	1 Bypass User Account Control	3 Credentials In Files	3 File and Directory Discovery	Distributed Component Object Model	111 Input Capture	22 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Windows Service	11 Masquerading	LSA Secrets	37 System Information Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	712 Process Injection	1 Valid Accounts	Cached Domain Credentials	231 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Registry Run Keys / Startup Folder	2 Virtualization/Sandbox Evasion	DCSync	2 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Access Token Manipulation	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	712 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rDB_YAK_838327E.cmd

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
rDB_YAK_838327E.cmd