Windows Analysis Report Nova narudzba u prilogu.exe

Overview

General Information

Sample Name: Nova narudzba u prilogu.exe
Analysis ID: 553139
MD5: 97d7bf836142b0ebb1ebfc1a4173dc9d
SHA1: dc734d5d74bee644fb1028ede0adcd34be3f98f8
SHA256: feb40c343aa65f5f5c0a32443535effa22652067c576416857e4d7280ce85e11
Tags: exeFormbookgeoHRV
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Writes to foreign memory regions
Machine Learning detection for sample
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Found large amount of non-executed APIs
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 0000000F.00000000.810820140.0000000072480000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.finetipster.com/pvxz/"], "decoy": ["imt-token.club", "abravewayocen.online", "shcloudcar.com", "mshoppingworld.online", "ncgf08.xyz", "stuinfo.xyz", "wesavetheplanetofficial.com", "tourbox.xyz", "believeinyourselftraining.com", "jsboyat.com", "aaeconomy.info", "9etmorea.info", "purosepeti7.com", "goticketly.com", "pinkmemorypt.com", "mylifewellnesscentre.com", "iridina.online", "petrestore.online", "neema.xyz", "novelfooditalia.com", "enterprisedaas.computer", "tzkaxh.com", "brainfarter.com", "youniquegal.com", "piiqrio.com", "mdaszb.com", "boldmale.com", "era636.com", "castleinsuranceco.com", "woodennickelmusicfortwayne.com", "customer-servis-kredivo.com", "high-clicks.com", "greetwithgadgets.com", "hfsd1.com", "insureagainstearthquakes.net", "ultimatejump.rest", "parivartanyogeshstore.com", "handmanagementblog.com", "meishangtianhua.com", "michaelscottinsurance.net", "kershoes.com", "atomiccharmworks.com", "conciergecompare.com", "zeal-hashima.com", "coachianscott.com", "hwkm.net", "019skz.xyz", "jardingenesis.com", "sumikkoremon.com", "tjpengyun.com", "sectionpor.xyz", "46t.xyz", "sa-pontianak.com", "localproperty.team", "dotexposed.com", "cis136-tgarza.com", "eiestilo.com", "youknowhowtolive.com", "phalcosnusa.com", "qaticv93iy.com", "hbjngs.com", "ocean-nettoyage.com", "jenuwinclothes.net", "anadoluatvoffroad.com"]}
Multi AV Scanner detection for submitted file
Source: Nova narudzba u prilogu.exe ReversingLabs: Detection: 32%
Yara detected FormBook
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000000.810820140.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.980408969.0000000002C60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.826394913.0000000004B90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.772008503.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.714097353.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.979059154.0000000000800000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.749509351.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.836253520.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.860879140.0000000000E90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.810315428.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.864516356.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.811363392.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.714755943.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.860188435.0000000000E60000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.844946988.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.714442633.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.980367511.0000000002C30000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.811926457.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.713760138.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.826540547.0000000004BF0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.830080872.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.835723366.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.863247728.0000000003280000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.836796283.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.837305764.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Multi AV Scanner detection for domain / URL
Source: www.finetipster.com/pvxz/ Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\Contacts\Ajshkennyc.exe Virustotal: Detection: 27% Perma Link
Source: C:\Users\user\Contacts\Ajshkennyc.exe ReversingLabs: Detection: 32%
Machine Learning detection for sample
Source: Nova narudzba u prilogu.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\Contacts\Ajshkennyc.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 26.2.explorer.exe.bc3796c.1.unpack Avira: Label: TR/Patched.Ren.Gen8
Source: 15.0.DpiScaling.exe.72480000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.DpiScaling.exe.72480000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.0.DpiScaling.exe.72480000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 20.0.logagent.exe.72480000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 16.2.colorcpl.exe.2a94670.1.unpack Avira: Label: TR/Patched.Ren.Gen8
Source: 20.0.logagent.exe.72480000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.DpiScaling.exe.72480000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.0.DpiScaling.exe.72480000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.0.DpiScaling.exe.72480000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 26.0.explorer.exe.bc3796c.1.unpack Avira: Label: TR/Patched.Ren.Gen8
Source: 20.0.logagent.exe.72480000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 16.2.colorcpl.exe.4ce796c.4.unpack Avira: Label: TR/Patched.Ren.Gen8
Source: 20.0.logagent.exe.72480000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.DpiScaling.exe.72480000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.0.DpiScaling.exe.72480000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.2.DpiScaling.exe.72480000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 20.2.logagent.exe.72480000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.2.DpiScaling.exe.72480000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: Nova narudzba u prilogu.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
Source: unknown HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: Binary string: colorcpl.pdbGCTL source: DpiScaling.exe, 00000005.00000002.829989653.00000000053A0000.00000040.00020000.sdmp
Source: Binary string: colorcpl.pdb source: DpiScaling.exe, 00000005.00000002.829989653.00000000053A0000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: DpiScaling.exe, 00000005.00000002.827879975.000000000504F000.00000040.00000001.sdmp, DpiScaling.exe, 00000005.00000002.827366166.0000000004F30000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: DpiScaling.exe

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.finetipster.com/pvxz/
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 162.159.135.233 162.159.135.233
Source: Joe Sandbox View IP Address: 162.159.135.233 162.159.135.233
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown DNS traffic detected: queries for: cdn.discordapp.com
Source: global traffic HTTP traffic detected: GET /attachments/909752051695775778/931434691809124392/Ajshkennychvrlvyqvxklxbhfqfzgvr HTTP/1.1User-Agent: lValiHost: cdn.discordapp.com
Source: global traffic HTTP traffic detected: GET /attachments/909752051695775778/931434691809124392/Ajshkennychvrlvyqvxklxbhfqfzgvr HTTP/1.1User-Agent: 88Host: cdn.discordapp.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /attachments/909752051695775778/931434691809124392/Ajshkennychvrlvyqvxklxbhfqfzgvr HTTP/1.1User-Agent: 42Host: cdn.discordapp.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /attachments/909752051695775778/931434691809124392/Ajshkennychvrlvyqvxklxbhfqfzgvr HTTP/1.1User-Agent: 60Host: cdn.discordapp.comCache-Control: no-cache
Source: unknown HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49779 version: TLS 1.2

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000000.810820140.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.980408969.0000000002C60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.826394913.0000000004B90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.772008503.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.714097353.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.979059154.0000000000800000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.749509351.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.836253520.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.860879140.0000000000E90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.810315428.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.864516356.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.811363392.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.714755943.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.860188435.0000000000E60000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.844946988.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.714442633.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.980367511.0000000002C30000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.811926457.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.713760138.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.826540547.0000000004BF0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.830080872.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.835723366.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.863247728.0000000003280000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.836796283.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.837305764.0000000072480000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 15.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 15.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 15.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 15.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 15.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 15.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 15.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.2.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.2.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 15.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 15.2.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.2.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 15.2.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 15.2.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.2.logagent.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.2.logagent.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000000.810820140.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000000.810820140.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.980408969.0000000002C60000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.980408969.0000000002C60000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.826394913.0000000004B90000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.826394913.0000000004B90000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.772008503.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.772008503.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.714097353.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.714097353.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.979059154.0000000000800000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.979059154.0000000000800000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.749509351.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.749509351.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000000.836253520.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000000.836253520.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.860879140.0000000000E90000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.860879140.0000000000E90000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000000.810315428.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000000.810315428.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.864516356.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.864516356.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000000.811363392.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000000.811363392.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.714755943.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.714755943.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.860188435.0000000000E60000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.860188435.0000000000E60000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000002.844946988.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000002.844946988.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.714442633.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.714442633.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.980367511.0000000002C30000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.980367511.0000000002C30000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000000.811926457.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000000.811926457.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.713760138.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.713760138.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.826540547.0000000004BF0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.826540547.0000000004BF0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.830080872.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.830080872.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000000.835723366.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000000.835723366.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000016.00000002.863247728.0000000003280000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000016.00000002.863247728.0000000003280000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000000.836796283.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000000.836796283.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000000.837305764.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000000.837305764.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: Nova narudzba u prilogu.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
Yara signature match
Source: 15.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 15.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 15.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 15.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 15.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 15.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 15.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.2.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.2.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 15.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 15.2.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.2.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 15.2.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 15.2.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.2.logagent.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.2.logagent.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000000.810820140.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000000.810820140.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.980408969.0000000002C60000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.980408969.0000000002C60000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.826394913.0000000004B90000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.826394913.0000000004B90000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.772008503.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.772008503.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.714097353.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.714097353.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.979059154.0000000000800000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.979059154.0000000000800000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.749509351.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.749509351.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000000.836253520.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000000.836253520.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.860879140.0000000000E90000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.860879140.0000000000E90000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000000.810315428.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000000.810315428.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.864516356.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.864516356.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000000.811363392.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000000.811363392.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.714755943.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.714755943.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.860188435.0000000000E60000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.860188435.0000000000E60000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000002.844946988.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000002.844946988.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.714442633.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.714442633.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.980367511.0000000002C30000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.980367511.0000000002C30000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000000.811926457.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000000.811926457.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.713760138.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.713760138.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.826540547.0000000004BF0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.826540547.0000000004BF0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.830080872.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.830080872.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000000.835723366.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000000.835723366.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000016.00000002.863247728.0000000003280000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000016.00000002.863247728.0000000003280000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000000.836796283.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000000.836796283.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000000.837305764.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000000.837305764.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: C:\Users\user\Contacts\cynnekhsjA.url, type: DROPPED Matched rule: Methodology_Shortcut_HotKey author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: C:\Users\user\Contacts\cynnekhsjA.url, type: DROPPED Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Detected potential crypto function
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05022D07 5_2_05022D07
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05021D55 5_2_05021D55
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_050225DD 5_2_050225DD
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6841F 5_2_04F6841F
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6D5E0 5_2_04F6D5E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501D466 5_2_0501D466
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F82581 5_2_04F82581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F50D20 5_2_04F50D20
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F76E30 5_2_04F76E30
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0502DFCE 5_2_0502DFCE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05021FF1 5_2_05021FF1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501D616 5_2_0501D616
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05022EF7 5_2_05022EF7
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F820A0 5_2_04F820A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6B090 5_2_04F6B090
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7A830 5_2_04F7A830
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011002 5_2_05011002
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0502E824 5_2_0502E824
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_050220A8 5_2_050220A8
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F74120 5_2_04F74120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_050228EC 5_2_050228EC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5F900 5_2_04F5F900
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05022B28 5_2_05022B28
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501DBD2 5_2_0501DBD2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_050103DA 5_2_050103DA
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0500FA2B 5_2_0500FA2B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8EBB0 5_2_04F8EBB0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_050222AE 5_2_050222AE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7AB40 5_2_04F7AB40
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E6D466 15_2_04E6D466
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB841F 15_2_04DB841F
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E725DD 15_2_04E725DD
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DBD5E0 15_2_04DBD5E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD2581 15_2_04DD2581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E71D55 15_2_04E71D55
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E72D07 15_2_04E72D07
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DA0D20 15_2_04DA0D20
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E72EF7 15_2_04E72EF7
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DC6E30 15_2_04DC6E30
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E6D616 15_2_04E6D616
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E71FF1 15_2_04E71FF1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E7DFCE 15_2_04E7DFCE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E728EC 15_2_04E728EC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DBB090 15_2_04DBB090
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E720A8 15_2_04E720A8
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD20A0 15_2_04DD20A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E7E824 15_2_04E7E824
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61002 15_2_04E61002
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCA830 15_2_04DCA830
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DC99BF 15_2_04DC99BF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DAF900 15_2_04DAF900
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DC4120 15_2_04DC4120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E64AEF 15_2_04E64AEF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E722AE 15_2_04E722AE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E5FA2B 15_2_04E5FA2B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDABD8 15_2_04DDABD8
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E523E3 15_2_04E523E3
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E6DBD2 15_2_04E6DBD2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E603DA 15_2_04E603DA
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDEBB0 15_2_04DDEBB0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCAB40 15_2_04DCAB40
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E72B28 15_2_04E72B28
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCA309 15_2_04DCA309
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: String function: 04F5B150 appears 54 times
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: String function: 04DAB150 appears 107 times
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F995D0 NtClose,LdrInitializeThunk, 5_2_04F995D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99540 NtReadFile,LdrInitializeThunk, 5_2_04F99540
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F996E0 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_04F996E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99660 NtAllocateVirtualMemory,LdrInitializeThunk, 5_2_04F99660
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99FE0 NtCreateMutant,LdrInitializeThunk, 5_2_04F99FE0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F997A0 NtUnmapViewOfSection,LdrInitializeThunk, 5_2_04F997A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99780 NtMapViewOfSection,LdrInitializeThunk, 5_2_04F99780
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99710 NtQueryInformationToken,LdrInitializeThunk, 5_2_04F99710
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F998F0 NtReadVirtualMemory,LdrInitializeThunk, 5_2_04F998F0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99860 NtQuerySystemInformation,LdrInitializeThunk, 5_2_04F99860
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99840 NtDelayExecution,LdrInitializeThunk, 5_2_04F99840
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F999A0 NtCreateSection,LdrInitializeThunk, 5_2_04F999A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99910 NtAdjustPrivilegesToken,LdrInitializeThunk, 5_2_04F99910
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99A50 NtCreateFile,LdrInitializeThunk, 5_2_04F99A50
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99A20 NtResumeThread,LdrInitializeThunk, 5_2_04F99A20
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99A00 NtProtectVirtualMemory,LdrInitializeThunk, 5_2_04F99A00
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F995F0 NtQueryInformationFile, 5_2_04F995F0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99560 NtWriteFile, 5_2_04F99560
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F9AD30 NtSetContextThread, 5_2_04F9AD30
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99520 NtWaitForSingleObject, 5_2_04F99520
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F996D0 NtCreateKey, 5_2_04F996D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99670 NtQueryInformationProcess, 5_2_04F99670
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99650 NtQueryValueKey, 5_2_04F99650
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99610 NtEnumerateValueKey, 5_2_04F99610
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F9A770 NtOpenThread, 5_2_04F9A770
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99770 NtSetInformationFile, 5_2_04F99770
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99760 NtOpenProcess, 5_2_04F99760
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99730 NtQueryVirtualMemory, 5_2_04F99730
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F9A710 NtOpenProcessToken, 5_2_04F9A710
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F998A0 NtWriteVirtualMemory, 5_2_04F998A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F9B040 NtSuspendThread, 5_2_04F9B040
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99820 NtEnumerateKey, 5_2_04F99820
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F999D0 NtCreateProcessEx, 5_2_04F999D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99950 NtQueueApcThread, 5_2_04F99950
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99A80 NtOpenDirectoryObject, 5_2_04F99A80
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99A10 NtQuerySection, 5_2_04F99A10
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F9A3B0 NtGetContextThread, 5_2_04F9A3B0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F99B00 NtSetValueKey, 5_2_04F99B00
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE95D0 NtClose,LdrInitializeThunk, 15_2_04DE95D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9540 NtReadFile,LdrInitializeThunk, 15_2_04DE9540
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE96E0 NtFreeVirtualMemory,LdrInitializeThunk, 15_2_04DE96E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9660 NtAllocateVirtualMemory,LdrInitializeThunk, 15_2_04DE9660
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9FE0 NtCreateMutant,LdrInitializeThunk, 15_2_04DE9FE0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9780 NtMapViewOfSection,LdrInitializeThunk, 15_2_04DE9780
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE97A0 NtUnmapViewOfSection,LdrInitializeThunk, 15_2_04DE97A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9710 NtQueryInformationToken,LdrInitializeThunk, 15_2_04DE9710
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE98F0 NtReadVirtualMemory,LdrInitializeThunk, 15_2_04DE98F0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9840 NtDelayExecution,LdrInitializeThunk, 15_2_04DE9840
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9860 NtQuerySystemInformation,LdrInitializeThunk, 15_2_04DE9860
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE99A0 NtCreateSection,LdrInitializeThunk, 15_2_04DE99A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 15_2_04DE9910
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9A50 NtCreateFile,LdrInitializeThunk, 15_2_04DE9A50
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9A00 NtProtectVirtualMemory,LdrInitializeThunk, 15_2_04DE9A00
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9A20 NtResumeThread,LdrInitializeThunk, 15_2_04DE9A20
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE95F0 NtQueryInformationFile, 15_2_04DE95F0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9560 NtWriteFile, 15_2_04DE9560
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DEAD30 NtSetContextThread, 15_2_04DEAD30
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9520 NtWaitForSingleObject, 15_2_04DE9520
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE96D0 NtCreateKey, 15_2_04DE96D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9650 NtQueryValueKey, 15_2_04DE9650
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9670 NtQueryInformationProcess, 15_2_04DE9670
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9610 NtEnumerateValueKey, 15_2_04DE9610
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DEA770 NtOpenThread, 15_2_04DEA770
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9770 NtSetInformationFile, 15_2_04DE9770
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9760 NtOpenProcess, 15_2_04DE9760
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DEA710 NtOpenProcessToken, 15_2_04DEA710
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9730 NtQueryVirtualMemory, 15_2_04DE9730
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE98A0 NtWriteVirtualMemory, 15_2_04DE98A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DEB040 NtSuspendThread, 15_2_04DEB040
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9820 NtEnumerateKey, 15_2_04DE9820
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE99D0 NtCreateProcessEx, 15_2_04DE99D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9950 NtQueueApcThread, 15_2_04DE9950
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9A80 NtOpenDirectoryObject, 15_2_04DE9A80
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9A10 NtQuerySection, 15_2_04DE9A10
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DEA3B0 NtGetContextThread, 15_2_04DEA3B0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE9B00 NtSetValueKey, 15_2_04DE9B00
PE file contains strange resources
Source: Nova narudzba u prilogu.exe Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Nova narudzba u prilogu.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Ajshkennyc.exe.0.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Ajshkennyc.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wpnapps.dll
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Memory allocated: 72480000 page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Memory allocated: 72480000 page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Memory allocated: 72480000 page no access Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Memory allocated: 72480000 page read and write Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Memory allocated: 72481000 page read and write Jump to behavior
Source: Nova narudzba u prilogu.exe ReversingLabs: Detection: 32%
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe File read: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Nova narudzba u prilogu.exe "C:\Users\user\Desktop\Nova narudzba u prilogu.exe"
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\Contacts\Ajshkennyc.exe "C:\Users\user\Contacts\Ajshkennyc.exe"
Source: C:\Windows\explorer.exe Process created: C:\Users\user\Contacts\Ajshkennyc.exe "C:\Users\user\Contacts\Ajshkennyc.exe"
Source: C:\Users\user\Contacts\Ajshkennyc.exe Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\DpiScaling.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Contacts\Ajshkennyc.exe Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" /LOADSAVEDWINDOWS
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\Contacts\Ajshkennyc.exe "C:\Users\user\Contacts\Ajshkennyc.exe" Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\Contacts\Ajshkennyc.exe "C:\Users\user\Contacts\Ajshkennyc.exe" Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\DpiScaling.exe" Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Ajshkennychvrlvyqvxklxbhfqfzgvr[1] Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@17/6@3/2
Source: C:\Windows\explorer.exe File read: C:\Users\user\Searches\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2208:120:WilError_01
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\explorer.exe
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Binary string: colorcpl.pdbGCTL source: DpiScaling.exe, 00000005.00000002.829989653.00000000053A0000.00000040.00020000.sdmp
Source: Binary string: colorcpl.pdb source: DpiScaling.exe, 00000005.00000002.829989653.00000000053A0000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: DpiScaling.exe, 00000005.00000002.827879975.000000000504F000.00000040.00000001.sdmp, DpiScaling.exe, 00000005.00000002.827366166.0000000004F30000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: DpiScaling.exe

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02597A2A push 004064D8h; ret 0_3_02597A4E
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02594ABE push eax; ret 0_3_02594AFA
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_0259933E push ecx; mov dword ptr [esp], eax 0_3_0259933F
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02597BE0 push 00406690h; ret 0_3_02597C06
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02597BE2 push 00406690h; ret 0_3_02597C06
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_025979F0 push 004064A0h; ret 0_3_02597A16
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_025979F2 push 004064A0h; ret 0_3_02597A16
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02597EF2 push 004069A0h; ret 0_3_02597F16
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_0259DE88 push 0040C97Bh; ret 0_3_0259DEF1
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_0259DE8A push 0040C97Bh; ret 0_3_0259DEF1
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_0259DF70 push 0040CA20h; ret 0_3_0259DF96
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_0259DF72 push 0040CA20h; ret 0_3_0259DF96
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02597712 push 004061E5h; ret 0_3_0259775B
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_0259DF12 push 0040C9C0h; ret 0_3_0259DF36
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_0259DF02 push 0040C9C0h; ret 0_3_0259DF36
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_0259DFAA push 0040CA58h; ret 0_3_0259DFCE
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_0259E7AA push 0040D258h; ret 0_3_0259E7CE
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_0259DD0A push 0040C908h; ret 0_3_0259DE7E
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02D1A22E push 0040C908h; ret 0_3_02D1A3A2
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02D073C2 push ecx; mov dword ptr [esp], eax 0_3_02D073C3
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02D1A3AC push 0040C97Bh; ret 0_3_02D1A415
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02D1A3AE push 0040C97Bh; ret 0_3_02D1A415
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02D0C02E push 0040CA58h; ret 0_3_02D0C052
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02D14104 push 00406690h; ret 0_3_02D1412A
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02D14106 push 00406690h; ret 0_3_02D1412A
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02D05796 push 004061E5h; ret 0_3_02D057DF
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02D1A4CE push 0040CA58h; ret 0_3_02D1A4F2
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02D1A494 push 0040CA20h; ret 0_3_02D1A4BA
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02D1A496 push 0040CA20h; ret 0_3_02D1A4BA
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02D14416 push 004069A0h; ret 0_3_02D1443A
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Code function: 0_3_02D1A436 push 0040C9C0h; ret 0_3_02D1A45A

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe File created: C:\Users\user\Contacts\Ajshkennyc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Ajshkennyc Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Ajshkennyc Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Source: initial sample Icon embedded in binary file: icon matches a legit application icon: icon306.png
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\explorer.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\SysWOW64\DpiScaling.exe RDTSC instruction interceptor: First address: 0000000072488604 second address: 000000007248860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\DpiScaling.exe RDTSC instruction interceptor: First address: 000000007248899E second address: 00000000724889A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe RDTSC instruction interceptor: First address: 0000000000808604 second address: 000000000080860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe RDTSC instruction interceptor: First address: 000000000080899E second address: 00000000008089A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\logagent.exe RDTSC instruction interceptor: First address: 0000000072488604 second address: 000000007248860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\logagent.exe RDTSC instruction interceptor: First address: 000000007248899E second address: 00000000724889A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe RDTSC instruction interceptor: First address: 0000000003288604 second address: 000000000328860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe RDTSC instruction interceptor: First address: 000000000328899E second address: 00000000032889A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\colorcpl.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F96DE6 rdtsc 5_2_04F96DE6
Contains capabilities to detect virtual machines
Source: C:\Windows\explorer.exe File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\DpiScaling.exe API coverage: 5.6 %
Source: C:\Windows\SysWOW64\DpiScaling.exe API coverage: 4.6 %
Source: C:\Windows\SysWOW64\DpiScaling.exe Process information queried: ProcessInformation Jump to behavior
Source: explorer.exe, 00000006.00000000.746235416.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.722681166.0000000006650000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.746235416.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.725780323.000000000A716000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATAa
Source: explorer.exe, 00000006.00000000.805412089.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000006.00000000.725780323.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000006.00000000.725780323.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F96DE6 rdtsc 5_2_04F96DE6
Enables debug privileges
Source: C:\Windows\SysWOW64\DpiScaling.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\logagent.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD6CF0 mov eax, dword ptr fs:[00000030h] 5_2_04FD6CF0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD6CF0 mov eax, dword ptr fs:[00000030h] 5_2_04FD6CF0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD6CF0 mov eax, dword ptr fs:[00000030h] 5_2_04FD6CF0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05028D34 mov eax, dword ptr fs:[00000030h] 5_2_05028D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501E539 mov eax, dword ptr fs:[00000030h] 5_2_0501E539
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05003D40 mov eax, dword ptr fs:[00000030h] 5_2_05003D40
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6849B mov eax, dword ptr fs:[00000030h] 5_2_04F6849B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7746D mov eax, dword ptr fs:[00000030h] 5_2_04F7746D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FEC450 mov eax, dword ptr fs:[00000030h] 5_2_04FEC450
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FEC450 mov eax, dword ptr fs:[00000030h] 5_2_04FEC450
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_050205AC mov eax, dword ptr fs:[00000030h] 5_2_050205AC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_050205AC mov eax, dword ptr fs:[00000030h] 5_2_050205AC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8A44B mov eax, dword ptr fs:[00000030h] 5_2_04F8A44B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8BC2C mov eax, dword ptr fs:[00000030h] 5_2_04F8BC2C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501FDE2 mov eax, dword ptr fs:[00000030h] 5_2_0501FDE2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501FDE2 mov eax, dword ptr fs:[00000030h] 5_2_0501FDE2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501FDE2 mov eax, dword ptr fs:[00000030h] 5_2_0501FDE2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501FDE2 mov eax, dword ptr fs:[00000030h] 5_2_0501FDE2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05008DF1 mov eax, dword ptr fs:[00000030h] 5_2_05008DF1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD6C0A mov eax, dword ptr fs:[00000030h] 5_2_04FD6C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD6C0A mov eax, dword ptr fs:[00000030h] 5_2_04FD6C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD6C0A mov eax, dword ptr fs:[00000030h] 5_2_04FD6C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD6C0A mov eax, dword ptr fs:[00000030h] 5_2_04FD6C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011C06 mov eax, dword ptr fs:[00000030h] 5_2_05011C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011C06 mov eax, dword ptr fs:[00000030h] 5_2_05011C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011C06 mov eax, dword ptr fs:[00000030h] 5_2_05011C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011C06 mov eax, dword ptr fs:[00000030h] 5_2_05011C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011C06 mov eax, dword ptr fs:[00000030h] 5_2_05011C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011C06 mov eax, dword ptr fs:[00000030h] 5_2_05011C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011C06 mov eax, dword ptr fs:[00000030h] 5_2_05011C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011C06 mov eax, dword ptr fs:[00000030h] 5_2_05011C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011C06 mov eax, dword ptr fs:[00000030h] 5_2_05011C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011C06 mov eax, dword ptr fs:[00000030h] 5_2_05011C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011C06 mov eax, dword ptr fs:[00000030h] 5_2_05011C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011C06 mov eax, dword ptr fs:[00000030h] 5_2_05011C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011C06 mov eax, dword ptr fs:[00000030h] 5_2_05011C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011C06 mov eax, dword ptr fs:[00000030h] 5_2_05011C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0502740D mov eax, dword ptr fs:[00000030h] 5_2_0502740D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0502740D mov eax, dword ptr fs:[00000030h] 5_2_0502740D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0502740D mov eax, dword ptr fs:[00000030h] 5_2_0502740D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6D5E0 mov eax, dword ptr fs:[00000030h] 5_2_04F6D5E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6D5E0 mov eax, dword ptr fs:[00000030h] 5_2_04F6D5E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD6DC9 mov eax, dword ptr fs:[00000030h] 5_2_04FD6DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD6DC9 mov eax, dword ptr fs:[00000030h] 5_2_04FD6DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD6DC9 mov eax, dword ptr fs:[00000030h] 5_2_04FD6DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD6DC9 mov ecx, dword ptr fs:[00000030h] 5_2_04FD6DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD6DC9 mov eax, dword ptr fs:[00000030h] 5_2_04FD6DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD6DC9 mov eax, dword ptr fs:[00000030h] 5_2_04FD6DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F81DB5 mov eax, dword ptr fs:[00000030h] 5_2_04F81DB5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F81DB5 mov eax, dword ptr fs:[00000030h] 5_2_04F81DB5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F81DB5 mov eax, dword ptr fs:[00000030h] 5_2_04F81DB5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F835A1 mov eax, dword ptr fs:[00000030h] 5_2_04F835A1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8FD9B mov eax, dword ptr fs:[00000030h] 5_2_04F8FD9B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8FD9B mov eax, dword ptr fs:[00000030h] 5_2_04F8FD9B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F82581 mov eax, dword ptr fs:[00000030h] 5_2_04F82581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F82581 mov eax, dword ptr fs:[00000030h] 5_2_04F82581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F82581 mov eax, dword ptr fs:[00000030h] 5_2_04F82581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F82581 mov eax, dword ptr fs:[00000030h] 5_2_04F82581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F52D8A mov eax, dword ptr fs:[00000030h] 5_2_04F52D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F52D8A mov eax, dword ptr fs:[00000030h] 5_2_04F52D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F52D8A mov eax, dword ptr fs:[00000030h] 5_2_04F52D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F52D8A mov eax, dword ptr fs:[00000030h] 5_2_04F52D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F52D8A mov eax, dword ptr fs:[00000030h] 5_2_04F52D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7C577 mov eax, dword ptr fs:[00000030h] 5_2_04F7C577
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7C577 mov eax, dword ptr fs:[00000030h] 5_2_04F7C577
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F77D50 mov eax, dword ptr fs:[00000030h] 5_2_04F77D50
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F93D43 mov eax, dword ptr fs:[00000030h] 5_2_04F93D43
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD3540 mov eax, dword ptr fs:[00000030h] 5_2_04FD3540
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F63D34 mov eax, dword ptr fs:[00000030h] 5_2_04F63D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F63D34 mov eax, dword ptr fs:[00000030h] 5_2_04F63D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F63D34 mov eax, dword ptr fs:[00000030h] 5_2_04F63D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F63D34 mov eax, dword ptr fs:[00000030h] 5_2_04F63D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F63D34 mov eax, dword ptr fs:[00000030h] 5_2_04F63D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F63D34 mov eax, dword ptr fs:[00000030h] 5_2_04F63D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F63D34 mov eax, dword ptr fs:[00000030h] 5_2_04F63D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F63D34 mov eax, dword ptr fs:[00000030h] 5_2_04F63D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F63D34 mov eax, dword ptr fs:[00000030h] 5_2_04F63D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F63D34 mov eax, dword ptr fs:[00000030h] 5_2_04F63D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F63D34 mov eax, dword ptr fs:[00000030h] 5_2_04F63D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F63D34 mov eax, dword ptr fs:[00000030h] 5_2_04F63D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F63D34 mov eax, dword ptr fs:[00000030h] 5_2_04F63D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F84D3B mov eax, dword ptr fs:[00000030h] 5_2_04F84D3B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F84D3B mov eax, dword ptr fs:[00000030h] 5_2_04F84D3B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F84D3B mov eax, dword ptr fs:[00000030h] 5_2_04F84D3B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5AD30 mov eax, dword ptr fs:[00000030h] 5_2_04F5AD30
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FDA537 mov eax, dword ptr fs:[00000030h] 5_2_04FDA537
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05028CD6 mov eax, dword ptr fs:[00000030h] 5_2_05028CD6
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_050114FB mov eax, dword ptr fs:[00000030h] 5_2_050114FB
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0502070D mov eax, dword ptr fs:[00000030h] 5_2_0502070D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0502070D mov eax, dword ptr fs:[00000030h] 5_2_0502070D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F676E2 mov eax, dword ptr fs:[00000030h] 5_2_04F676E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F816E0 mov ecx, dword ptr fs:[00000030h] 5_2_04F816E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F836CC mov eax, dword ptr fs:[00000030h] 5_2_04F836CC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F98EC7 mov eax, dword ptr fs:[00000030h] 5_2_04F98EC7
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD46A7 mov eax, dword ptr fs:[00000030h] 5_2_04FD46A7
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05028F6A mov eax, dword ptr fs:[00000030h] 5_2_05028F6A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FEFE87 mov eax, dword ptr fs:[00000030h] 5_2_04FEFE87
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7AE73 mov eax, dword ptr fs:[00000030h] 5_2_04F7AE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7AE73 mov eax, dword ptr fs:[00000030h] 5_2_04F7AE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7AE73 mov eax, dword ptr fs:[00000030h] 5_2_04F7AE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7AE73 mov eax, dword ptr fs:[00000030h] 5_2_04F7AE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7AE73 mov eax, dword ptr fs:[00000030h] 5_2_04F7AE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6766D mov eax, dword ptr fs:[00000030h] 5_2_04F6766D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F67E41 mov eax, dword ptr fs:[00000030h] 5_2_04F67E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F67E41 mov eax, dword ptr fs:[00000030h] 5_2_04F67E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F67E41 mov eax, dword ptr fs:[00000030h] 5_2_04F67E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F67E41 mov eax, dword ptr fs:[00000030h] 5_2_04F67E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F67E41 mov eax, dword ptr fs:[00000030h] 5_2_04F67E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F67E41 mov eax, dword ptr fs:[00000030h] 5_2_04F67E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5E620 mov eax, dword ptr fs:[00000030h] 5_2_04F5E620
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8A61C mov eax, dword ptr fs:[00000030h] 5_2_04F8A61C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8A61C mov eax, dword ptr fs:[00000030h] 5_2_04F8A61C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5C600 mov eax, dword ptr fs:[00000030h] 5_2_04F5C600
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5C600 mov eax, dword ptr fs:[00000030h] 5_2_04F5C600
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5C600 mov eax, dword ptr fs:[00000030h] 5_2_04F5C600
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F88E00 mov eax, dword ptr fs:[00000030h] 5_2_04F88E00
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05011608 mov eax, dword ptr fs:[00000030h] 5_2_05011608
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F937F5 mov eax, dword ptr fs:[00000030h] 5_2_04F937F5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0500FE3F mov eax, dword ptr fs:[00000030h] 5_2_0500FE3F
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501AE44 mov eax, dword ptr fs:[00000030h] 5_2_0501AE44
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501AE44 mov eax, dword ptr fs:[00000030h] 5_2_0501AE44
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F68794 mov eax, dword ptr fs:[00000030h] 5_2_04F68794
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD7794 mov eax, dword ptr fs:[00000030h] 5_2_04FD7794
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD7794 mov eax, dword ptr fs:[00000030h] 5_2_04FD7794
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD7794 mov eax, dword ptr fs:[00000030h] 5_2_04FD7794
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6FF60 mov eax, dword ptr fs:[00000030h] 5_2_04F6FF60
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05020EA5 mov eax, dword ptr fs:[00000030h] 5_2_05020EA5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05020EA5 mov eax, dword ptr fs:[00000030h] 5_2_05020EA5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05020EA5 mov eax, dword ptr fs:[00000030h] 5_2_05020EA5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6EF40 mov eax, dword ptr fs:[00000030h] 5_2_04F6EF40
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0500FEC0 mov eax, dword ptr fs:[00000030h] 5_2_0500FEC0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8E730 mov eax, dword ptr fs:[00000030h] 5_2_04F8E730
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05028ED6 mov eax, dword ptr fs:[00000030h] 5_2_05028ED6
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F54F2E mov eax, dword ptr fs:[00000030h] 5_2_04F54F2E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F54F2E mov eax, dword ptr fs:[00000030h] 5_2_04F54F2E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7F716 mov eax, dword ptr fs:[00000030h] 5_2_04F7F716
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FEFF10 mov eax, dword ptr fs:[00000030h] 5_2_04FEFF10
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FEFF10 mov eax, dword ptr fs:[00000030h] 5_2_04FEFF10
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8A70E mov eax, dword ptr fs:[00000030h] 5_2_04F8A70E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8A70E mov eax, dword ptr fs:[00000030h] 5_2_04F8A70E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F540E1 mov eax, dword ptr fs:[00000030h] 5_2_04F540E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F540E1 mov eax, dword ptr fs:[00000030h] 5_2_04F540E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F540E1 mov eax, dword ptr fs:[00000030h] 5_2_04F540E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F558EC mov eax, dword ptr fs:[00000030h] 5_2_04F558EC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FEB8D0 mov eax, dword ptr fs:[00000030h] 5_2_04FEB8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FEB8D0 mov ecx, dword ptr fs:[00000030h] 5_2_04FEB8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FEB8D0 mov eax, dword ptr fs:[00000030h] 5_2_04FEB8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FEB8D0 mov eax, dword ptr fs:[00000030h] 5_2_04FEB8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FEB8D0 mov eax, dword ptr fs:[00000030h] 5_2_04FEB8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FEB8D0 mov eax, dword ptr fs:[00000030h] 5_2_04FEB8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8F0BF mov ecx, dword ptr fs:[00000030h] 5_2_04F8F0BF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8F0BF mov eax, dword ptr fs:[00000030h] 5_2_04F8F0BF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8F0BF mov eax, dword ptr fs:[00000030h] 5_2_04F8F0BF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F990AF mov eax, dword ptr fs:[00000030h] 5_2_04F990AF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F820A0 mov eax, dword ptr fs:[00000030h] 5_2_04F820A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F820A0 mov eax, dword ptr fs:[00000030h] 5_2_04F820A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F820A0 mov eax, dword ptr fs:[00000030h] 5_2_04F820A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F820A0 mov eax, dword ptr fs:[00000030h] 5_2_04F820A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F820A0 mov eax, dword ptr fs:[00000030h] 5_2_04F820A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F820A0 mov eax, dword ptr fs:[00000030h] 5_2_04F820A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F59080 mov eax, dword ptr fs:[00000030h] 5_2_04F59080
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD3884 mov eax, dword ptr fs:[00000030h] 5_2_04FD3884
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD3884 mov eax, dword ptr fs:[00000030h] 5_2_04FD3884
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_050149A4 mov eax, dword ptr fs:[00000030h] 5_2_050149A4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_050149A4 mov eax, dword ptr fs:[00000030h] 5_2_050149A4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_050149A4 mov eax, dword ptr fs:[00000030h] 5_2_050149A4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_050149A4 mov eax, dword ptr fs:[00000030h] 5_2_050149A4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F70050 mov eax, dword ptr fs:[00000030h] 5_2_04F70050
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F70050 mov eax, dword ptr fs:[00000030h] 5_2_04F70050
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7A830 mov eax, dword ptr fs:[00000030h] 5_2_04F7A830
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7A830 mov eax, dword ptr fs:[00000030h] 5_2_04F7A830
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7A830 mov eax, dword ptr fs:[00000030h] 5_2_04F7A830
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7A830 mov eax, dword ptr fs:[00000030h] 5_2_04F7A830
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8002D mov eax, dword ptr fs:[00000030h] 5_2_04F8002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8002D mov eax, dword ptr fs:[00000030h] 5_2_04F8002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8002D mov eax, dword ptr fs:[00000030h] 5_2_04F8002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8002D mov eax, dword ptr fs:[00000030h] 5_2_04F8002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8002D mov eax, dword ptr fs:[00000030h] 5_2_04F8002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6B02A mov eax, dword ptr fs:[00000030h] 5_2_04F6B02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6B02A mov eax, dword ptr fs:[00000030h] 5_2_04F6B02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6B02A mov eax, dword ptr fs:[00000030h] 5_2_04F6B02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6B02A mov eax, dword ptr fs:[00000030h] 5_2_04F6B02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD7016 mov eax, dword ptr fs:[00000030h] 5_2_04FD7016
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD7016 mov eax, dword ptr fs:[00000030h] 5_2_04FD7016
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD7016 mov eax, dword ptr fs:[00000030h] 5_2_04FD7016
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5B1E1 mov eax, dword ptr fs:[00000030h] 5_2_04F5B1E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5B1E1 mov eax, dword ptr fs:[00000030h] 5_2_04F5B1E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5B1E1 mov eax, dword ptr fs:[00000030h] 5_2_04F5B1E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FE41E8 mov eax, dword ptr fs:[00000030h] 5_2_04FE41E8
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05024015 mov eax, dword ptr fs:[00000030h] 5_2_05024015
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05024015 mov eax, dword ptr fs:[00000030h] 5_2_05024015
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD51BE mov eax, dword ptr fs:[00000030h] 5_2_04FD51BE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD51BE mov eax, dword ptr fs:[00000030h] 5_2_04FD51BE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD51BE mov eax, dword ptr fs:[00000030h] 5_2_04FD51BE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD51BE mov eax, dword ptr fs:[00000030h] 5_2_04FD51BE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F861A0 mov eax, dword ptr fs:[00000030h] 5_2_04F861A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F861A0 mov eax, dword ptr fs:[00000030h] 5_2_04F861A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD69A6 mov eax, dword ptr fs:[00000030h] 5_2_04FD69A6
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F82990 mov eax, dword ptr fs:[00000030h] 5_2_04F82990
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05012073 mov eax, dword ptr fs:[00000030h] 5_2_05012073
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7C182 mov eax, dword ptr fs:[00000030h] 5_2_04F7C182
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05021074 mov eax, dword ptr fs:[00000030h] 5_2_05021074
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8A185 mov eax, dword ptr fs:[00000030h] 5_2_04F8A185
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5B171 mov eax, dword ptr fs:[00000030h] 5_2_04F5B171
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5B171 mov eax, dword ptr fs:[00000030h] 5_2_04F5B171
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5C962 mov eax, dword ptr fs:[00000030h] 5_2_04F5C962
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7B944 mov eax, dword ptr fs:[00000030h] 5_2_04F7B944
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7B944 mov eax, dword ptr fs:[00000030h] 5_2_04F7B944
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8513A mov eax, dword ptr fs:[00000030h] 5_2_04F8513A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8513A mov eax, dword ptr fs:[00000030h] 5_2_04F8513A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F74120 mov eax, dword ptr fs:[00000030h] 5_2_04F74120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F74120 mov eax, dword ptr fs:[00000030h] 5_2_04F74120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F74120 mov eax, dword ptr fs:[00000030h] 5_2_04F74120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F74120 mov eax, dword ptr fs:[00000030h] 5_2_04F74120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F74120 mov ecx, dword ptr fs:[00000030h] 5_2_04F74120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F59100 mov eax, dword ptr fs:[00000030h] 5_2_04F59100
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F59100 mov eax, dword ptr fs:[00000030h] 5_2_04F59100
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F59100 mov eax, dword ptr fs:[00000030h] 5_2_04F59100
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501131B mov eax, dword ptr fs:[00000030h] 5_2_0501131B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F82AE4 mov eax, dword ptr fs:[00000030h] 5_2_04F82AE4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F82ACB mov eax, dword ptr fs:[00000030h] 5_2_04F82ACB
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6AAB0 mov eax, dword ptr fs:[00000030h] 5_2_04F6AAB0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F6AAB0 mov eax, dword ptr fs:[00000030h] 5_2_04F6AAB0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8FAB0 mov eax, dword ptr fs:[00000030h] 5_2_04F8FAB0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F552A5 mov eax, dword ptr fs:[00000030h] 5_2_04F552A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F552A5 mov eax, dword ptr fs:[00000030h] 5_2_04F552A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F552A5 mov eax, dword ptr fs:[00000030h] 5_2_04F552A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F552A5 mov eax, dword ptr fs:[00000030h] 5_2_04F552A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F552A5 mov eax, dword ptr fs:[00000030h] 5_2_04F552A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05028B58 mov eax, dword ptr fs:[00000030h] 5_2_05028B58
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8D294 mov eax, dword ptr fs:[00000030h] 5_2_04F8D294
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8D294 mov eax, dword ptr fs:[00000030h] 5_2_04F8D294
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0500D380 mov ecx, dword ptr fs:[00000030h] 5_2_0500D380
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F9927A mov eax, dword ptr fs:[00000030h] 5_2_04F9927A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501138A mov eax, dword ptr fs:[00000030h] 5_2_0501138A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05025BA5 mov eax, dword ptr fs:[00000030h] 5_2_05025BA5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FE4257 mov eax, dword ptr fs:[00000030h] 5_2_04FE4257
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F59240 mov eax, dword ptr fs:[00000030h] 5_2_04F59240
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F59240 mov eax, dword ptr fs:[00000030h] 5_2_04F59240
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F59240 mov eax, dword ptr fs:[00000030h] 5_2_04F59240
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F59240 mov eax, dword ptr fs:[00000030h] 5_2_04F59240
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F94A2C mov eax, dword ptr fs:[00000030h] 5_2_04F94A2C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F94A2C mov eax, dword ptr fs:[00000030h] 5_2_04F94A2C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7A229 mov eax, dword ptr fs:[00000030h] 5_2_04F7A229
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7A229 mov eax, dword ptr fs:[00000030h] 5_2_04F7A229
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7A229 mov eax, dword ptr fs:[00000030h] 5_2_04F7A229
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7A229 mov eax, dword ptr fs:[00000030h] 5_2_04F7A229
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7A229 mov eax, dword ptr fs:[00000030h] 5_2_04F7A229
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7A229 mov eax, dword ptr fs:[00000030h] 5_2_04F7A229
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7A229 mov eax, dword ptr fs:[00000030h] 5_2_04F7A229
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7A229 mov eax, dword ptr fs:[00000030h] 5_2_04F7A229
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7A229 mov eax, dword ptr fs:[00000030h] 5_2_04F7A229
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5AA16 mov eax, dword ptr fs:[00000030h] 5_2_04F5AA16
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5AA16 mov eax, dword ptr fs:[00000030h] 5_2_04F5AA16
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F55210 mov eax, dword ptr fs:[00000030h] 5_2_04F55210
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F55210 mov ecx, dword ptr fs:[00000030h] 5_2_04F55210
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F55210 mov eax, dword ptr fs:[00000030h] 5_2_04F55210
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F55210 mov eax, dword ptr fs:[00000030h] 5_2_04F55210
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F73A1C mov eax, dword ptr fs:[00000030h] 5_2_04F73A1C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F68A0A mov eax, dword ptr fs:[00000030h] 5_2_04F68A0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501AA16 mov eax, dword ptr fs:[00000030h] 5_2_0501AA16
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501AA16 mov eax, dword ptr fs:[00000030h] 5_2_0501AA16
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F803E2 mov eax, dword ptr fs:[00000030h] 5_2_04F803E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F803E2 mov eax, dword ptr fs:[00000030h] 5_2_04F803E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F803E2 mov eax, dword ptr fs:[00000030h] 5_2_04F803E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F803E2 mov eax, dword ptr fs:[00000030h] 5_2_04F803E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F803E2 mov eax, dword ptr fs:[00000030h] 5_2_04F803E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F803E2 mov eax, dword ptr fs:[00000030h] 5_2_04F803E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F7DBE9 mov eax, dword ptr fs:[00000030h] 5_2_04F7DBE9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD53CA mov eax, dword ptr fs:[00000030h] 5_2_04FD53CA
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04FD53CA mov eax, dword ptr fs:[00000030h] 5_2_04FD53CA
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0501EA55 mov eax, dword ptr fs:[00000030h] 5_2_0501EA55
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F84BAD mov eax, dword ptr fs:[00000030h] 5_2_04F84BAD
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F84BAD mov eax, dword ptr fs:[00000030h] 5_2_04F84BAD
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F84BAD mov eax, dword ptr fs:[00000030h] 5_2_04F84BAD
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0500B260 mov eax, dword ptr fs:[00000030h] 5_2_0500B260
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_0500B260 mov eax, dword ptr fs:[00000030h] 5_2_0500B260
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_05028A62 mov eax, dword ptr fs:[00000030h] 5_2_05028A62
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F8B390 mov eax, dword ptr fs:[00000030h] 5_2_04F8B390
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F82397 mov eax, dword ptr fs:[00000030h] 5_2_04F82397
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F61B8F mov eax, dword ptr fs:[00000030h] 5_2_04F61B8F
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F61B8F mov eax, dword ptr fs:[00000030h] 5_2_04F61B8F
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F83B7A mov eax, dword ptr fs:[00000030h] 5_2_04F83B7A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F83B7A mov eax, dword ptr fs:[00000030h] 5_2_04F83B7A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5DB60 mov ecx, dword ptr fs:[00000030h] 5_2_04F5DB60
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5F358 mov eax, dword ptr fs:[00000030h] 5_2_04F5F358
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F5DB40 mov eax, dword ptr fs:[00000030h] 5_2_04F5DB40
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E26CF0 mov eax, dword ptr fs:[00000030h] 15_2_04E26CF0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E26CF0 mov eax, dword ptr fs:[00000030h] 15_2_04E26CF0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E26CF0 mov eax, dword ptr fs:[00000030h] 15_2_04E26CF0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E614FB mov eax, dword ptr fs:[00000030h] 15_2_04E614FB
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E78CD6 mov eax, dword ptr fs:[00000030h] 15_2_04E78CD6
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB849B mov eax, dword ptr fs:[00000030h] 15_2_04DB849B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDA44B mov eax, dword ptr fs:[00000030h] 15_2_04DDA44B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDAC7B mov eax, dword ptr fs:[00000030h] 15_2_04DDAC7B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDAC7B mov eax, dword ptr fs:[00000030h] 15_2_04DDAC7B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDAC7B mov eax, dword ptr fs:[00000030h] 15_2_04DDAC7B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDAC7B mov eax, dword ptr fs:[00000030h] 15_2_04DDAC7B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDAC7B mov eax, dword ptr fs:[00000030h] 15_2_04DDAC7B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDAC7B mov eax, dword ptr fs:[00000030h] 15_2_04DDAC7B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDAC7B mov eax, dword ptr fs:[00000030h] 15_2_04DDAC7B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDAC7B mov eax, dword ptr fs:[00000030h] 15_2_04DDAC7B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDAC7B mov eax, dword ptr fs:[00000030h] 15_2_04DDAC7B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDAC7B mov eax, dword ptr fs:[00000030h] 15_2_04DDAC7B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDAC7B mov eax, dword ptr fs:[00000030h] 15_2_04DDAC7B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DC746D mov eax, dword ptr fs:[00000030h] 15_2_04DC746D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E3C450 mov eax, dword ptr fs:[00000030h] 15_2_04E3C450
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E3C450 mov eax, dword ptr fs:[00000030h] 15_2_04E3C450
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61C06 mov eax, dword ptr fs:[00000030h] 15_2_04E61C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61C06 mov eax, dword ptr fs:[00000030h] 15_2_04E61C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61C06 mov eax, dword ptr fs:[00000030h] 15_2_04E61C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61C06 mov eax, dword ptr fs:[00000030h] 15_2_04E61C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61C06 mov eax, dword ptr fs:[00000030h] 15_2_04E61C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61C06 mov eax, dword ptr fs:[00000030h] 15_2_04E61C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61C06 mov eax, dword ptr fs:[00000030h] 15_2_04E61C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61C06 mov eax, dword ptr fs:[00000030h] 15_2_04E61C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61C06 mov eax, dword ptr fs:[00000030h] 15_2_04E61C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61C06 mov eax, dword ptr fs:[00000030h] 15_2_04E61C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61C06 mov eax, dword ptr fs:[00000030h] 15_2_04E61C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61C06 mov eax, dword ptr fs:[00000030h] 15_2_04E61C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61C06 mov eax, dword ptr fs:[00000030h] 15_2_04E61C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61C06 mov eax, dword ptr fs:[00000030h] 15_2_04E61C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E26C0A mov eax, dword ptr fs:[00000030h] 15_2_04E26C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E26C0A mov eax, dword ptr fs:[00000030h] 15_2_04E26C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E26C0A mov eax, dword ptr fs:[00000030h] 15_2_04E26C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E26C0A mov eax, dword ptr fs:[00000030h] 15_2_04E26C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E7740D mov eax, dword ptr fs:[00000030h] 15_2_04E7740D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E7740D mov eax, dword ptr fs:[00000030h] 15_2_04E7740D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E7740D mov eax, dword ptr fs:[00000030h] 15_2_04E7740D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDBC2C mov eax, dword ptr fs:[00000030h] 15_2_04DDBC2C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E6FDE2 mov eax, dword ptr fs:[00000030h] 15_2_04E6FDE2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E6FDE2 mov eax, dword ptr fs:[00000030h] 15_2_04E6FDE2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E6FDE2 mov eax, dword ptr fs:[00000030h] 15_2_04E6FDE2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E6FDE2 mov eax, dword ptr fs:[00000030h] 15_2_04E6FDE2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E58DF1 mov eax, dword ptr fs:[00000030h] 15_2_04E58DF1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E26DC9 mov eax, dword ptr fs:[00000030h] 15_2_04E26DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E26DC9 mov eax, dword ptr fs:[00000030h] 15_2_04E26DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E26DC9 mov eax, dword ptr fs:[00000030h] 15_2_04E26DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E26DC9 mov ecx, dword ptr fs:[00000030h] 15_2_04E26DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E26DC9 mov eax, dword ptr fs:[00000030h] 15_2_04E26DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E26DC9 mov eax, dword ptr fs:[00000030h] 15_2_04E26DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DBD5E0 mov eax, dword ptr fs:[00000030h] 15_2_04DBD5E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DBD5E0 mov eax, dword ptr fs:[00000030h] 15_2_04DBD5E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDFD9B mov eax, dword ptr fs:[00000030h] 15_2_04DDFD9B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDFD9B mov eax, dword ptr fs:[00000030h] 15_2_04DDFD9B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E705AC mov eax, dword ptr fs:[00000030h] 15_2_04E705AC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E705AC mov eax, dword ptr fs:[00000030h] 15_2_04E705AC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DA2D8A mov eax, dword ptr fs:[00000030h] 15_2_04DA2D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DA2D8A mov eax, dword ptr fs:[00000030h] 15_2_04DA2D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DA2D8A mov eax, dword ptr fs:[00000030h] 15_2_04DA2D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DA2D8A mov eax, dword ptr fs:[00000030h] 15_2_04DA2D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DA2D8A mov eax, dword ptr fs:[00000030h] 15_2_04DA2D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD2581 mov eax, dword ptr fs:[00000030h] 15_2_04DD2581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD2581 mov eax, dword ptr fs:[00000030h] 15_2_04DD2581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD2581 mov eax, dword ptr fs:[00000030h] 15_2_04DD2581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD2581 mov eax, dword ptr fs:[00000030h] 15_2_04DD2581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD1DB5 mov eax, dword ptr fs:[00000030h] 15_2_04DD1DB5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD1DB5 mov eax, dword ptr fs:[00000030h] 15_2_04DD1DB5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD1DB5 mov eax, dword ptr fs:[00000030h] 15_2_04DD1DB5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD35A1 mov eax, dword ptr fs:[00000030h] 15_2_04DD35A1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DC7D50 mov eax, dword ptr fs:[00000030h] 15_2_04DC7D50
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE3D43 mov eax, dword ptr fs:[00000030h] 15_2_04DE3D43
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E23540 mov eax, dword ptr fs:[00000030h] 15_2_04E23540
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E53D40 mov eax, dword ptr fs:[00000030h] 15_2_04E53D40
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCC577 mov eax, dword ptr fs:[00000030h] 15_2_04DCC577
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCC577 mov eax, dword ptr fs:[00000030h] 15_2_04DCC577
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E78D34 mov eax, dword ptr fs:[00000030h] 15_2_04E78D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E2A537 mov eax, dword ptr fs:[00000030h] 15_2_04E2A537
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E6E539 mov eax, dword ptr fs:[00000030h] 15_2_04E6E539
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD4D3B mov eax, dword ptr fs:[00000030h] 15_2_04DD4D3B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD4D3B mov eax, dword ptr fs:[00000030h] 15_2_04DD4D3B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD4D3B mov eax, dword ptr fs:[00000030h] 15_2_04DD4D3B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DAAD30 mov eax, dword ptr fs:[00000030h] 15_2_04DAAD30
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB3D34 mov eax, dword ptr fs:[00000030h] 15_2_04DB3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB3D34 mov eax, dword ptr fs:[00000030h] 15_2_04DB3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB3D34 mov eax, dword ptr fs:[00000030h] 15_2_04DB3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB3D34 mov eax, dword ptr fs:[00000030h] 15_2_04DB3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB3D34 mov eax, dword ptr fs:[00000030h] 15_2_04DB3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB3D34 mov eax, dword ptr fs:[00000030h] 15_2_04DB3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB3D34 mov eax, dword ptr fs:[00000030h] 15_2_04DB3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB3D34 mov eax, dword ptr fs:[00000030h] 15_2_04DB3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB3D34 mov eax, dword ptr fs:[00000030h] 15_2_04DB3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB3D34 mov eax, dword ptr fs:[00000030h] 15_2_04DB3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB3D34 mov eax, dword ptr fs:[00000030h] 15_2_04DB3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB3D34 mov eax, dword ptr fs:[00000030h] 15_2_04DB3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB3D34 mov eax, dword ptr fs:[00000030h] 15_2_04DB3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD36CC mov eax, dword ptr fs:[00000030h] 15_2_04DD36CC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE8EC7 mov eax, dword ptr fs:[00000030h] 15_2_04DE8EC7
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E5FEC0 mov eax, dword ptr fs:[00000030h] 15_2_04E5FEC0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E78ED6 mov eax, dword ptr fs:[00000030h] 15_2_04E78ED6
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB76E2 mov eax, dword ptr fs:[00000030h] 15_2_04DB76E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD16E0 mov ecx, dword ptr fs:[00000030h] 15_2_04DD16E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E70EA5 mov eax, dword ptr fs:[00000030h] 15_2_04E70EA5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E70EA5 mov eax, dword ptr fs:[00000030h] 15_2_04E70EA5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E70EA5 mov eax, dword ptr fs:[00000030h] 15_2_04E70EA5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E246A7 mov eax, dword ptr fs:[00000030h] 15_2_04E246A7
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E3FE87 mov eax, dword ptr fs:[00000030h] 15_2_04E3FE87
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB7E41 mov eax, dword ptr fs:[00000030h] 15_2_04DB7E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB7E41 mov eax, dword ptr fs:[00000030h] 15_2_04DB7E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB7E41 mov eax, dword ptr fs:[00000030h] 15_2_04DB7E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB7E41 mov eax, dword ptr fs:[00000030h] 15_2_04DB7E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB7E41 mov eax, dword ptr fs:[00000030h] 15_2_04DB7E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB7E41 mov eax, dword ptr fs:[00000030h] 15_2_04DB7E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E6AE44 mov eax, dword ptr fs:[00000030h] 15_2_04E6AE44
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E6AE44 mov eax, dword ptr fs:[00000030h] 15_2_04E6AE44
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCAE73 mov eax, dword ptr fs:[00000030h] 15_2_04DCAE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCAE73 mov eax, dword ptr fs:[00000030h] 15_2_04DCAE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCAE73 mov eax, dword ptr fs:[00000030h] 15_2_04DCAE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCAE73 mov eax, dword ptr fs:[00000030h] 15_2_04DCAE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCAE73 mov eax, dword ptr fs:[00000030h] 15_2_04DCAE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB766D mov eax, dword ptr fs:[00000030h] 15_2_04DB766D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDA61C mov eax, dword ptr fs:[00000030h] 15_2_04DDA61C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDA61C mov eax, dword ptr fs:[00000030h] 15_2_04DDA61C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E5FE3F mov eax, dword ptr fs:[00000030h] 15_2_04E5FE3F
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DAC600 mov eax, dword ptr fs:[00000030h] 15_2_04DAC600
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DAC600 mov eax, dword ptr fs:[00000030h] 15_2_04DAC600
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DAC600 mov eax, dword ptr fs:[00000030h] 15_2_04DAC600
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD8E00 mov eax, dword ptr fs:[00000030h] 15_2_04DD8E00
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E61608 mov eax, dword ptr fs:[00000030h] 15_2_04E61608
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DAE620 mov eax, dword ptr fs:[00000030h] 15_2_04DAE620
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE37F5 mov eax, dword ptr fs:[00000030h] 15_2_04DE37F5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DB8794 mov eax, dword ptr fs:[00000030h] 15_2_04DB8794
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E27794 mov eax, dword ptr fs:[00000030h] 15_2_04E27794
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E27794 mov eax, dword ptr fs:[00000030h] 15_2_04E27794
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E27794 mov eax, dword ptr fs:[00000030h] 15_2_04E27794
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E78F6A mov eax, dword ptr fs:[00000030h] 15_2_04E78F6A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DBEF40 mov eax, dword ptr fs:[00000030h] 15_2_04DBEF40
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DBFF60 mov eax, dword ptr fs:[00000030h] 15_2_04DBFF60
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCF716 mov eax, dword ptr fs:[00000030h] 15_2_04DCF716
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDA70E mov eax, dword ptr fs:[00000030h] 15_2_04DDA70E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDA70E mov eax, dword ptr fs:[00000030h] 15_2_04DDA70E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCB73D mov eax, dword ptr fs:[00000030h] 15_2_04DCB73D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCB73D mov eax, dword ptr fs:[00000030h] 15_2_04DCB73D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E7070D mov eax, dword ptr fs:[00000030h] 15_2_04E7070D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E7070D mov eax, dword ptr fs:[00000030h] 15_2_04E7070D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDE730 mov eax, dword ptr fs:[00000030h] 15_2_04DDE730
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E3FF10 mov eax, dword ptr fs:[00000030h] 15_2_04E3FF10
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E3FF10 mov eax, dword ptr fs:[00000030h] 15_2_04E3FF10
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DA4F2E mov eax, dword ptr fs:[00000030h] 15_2_04DA4F2E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DA4F2E mov eax, dword ptr fs:[00000030h] 15_2_04DA4F2E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E3B8D0 mov eax, dword ptr fs:[00000030h] 15_2_04E3B8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E3B8D0 mov ecx, dword ptr fs:[00000030h] 15_2_04E3B8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E3B8D0 mov eax, dword ptr fs:[00000030h] 15_2_04E3B8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E3B8D0 mov eax, dword ptr fs:[00000030h] 15_2_04E3B8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E3B8D0 mov eax, dword ptr fs:[00000030h] 15_2_04E3B8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E3B8D0 mov eax, dword ptr fs:[00000030h] 15_2_04E3B8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DA58EC mov eax, dword ptr fs:[00000030h] 15_2_04DA58EC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCB8E4 mov eax, dword ptr fs:[00000030h] 15_2_04DCB8E4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCB8E4 mov eax, dword ptr fs:[00000030h] 15_2_04DCB8E4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DA40E1 mov eax, dword ptr fs:[00000030h] 15_2_04DA40E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DA40E1 mov eax, dword ptr fs:[00000030h] 15_2_04DA40E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DA40E1 mov eax, dword ptr fs:[00000030h] 15_2_04DA40E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DA9080 mov eax, dword ptr fs:[00000030h] 15_2_04DA9080
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDF0BF mov ecx, dword ptr fs:[00000030h] 15_2_04DDF0BF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDF0BF mov eax, dword ptr fs:[00000030h] 15_2_04DDF0BF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDF0BF mov eax, dword ptr fs:[00000030h] 15_2_04DDF0BF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E23884 mov eax, dword ptr fs:[00000030h] 15_2_04E23884
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E23884 mov eax, dword ptr fs:[00000030h] 15_2_04E23884
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DE90AF mov eax, dword ptr fs:[00000030h] 15_2_04DE90AF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD20A0 mov eax, dword ptr fs:[00000030h] 15_2_04DD20A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD20A0 mov eax, dword ptr fs:[00000030h] 15_2_04DD20A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD20A0 mov eax, dword ptr fs:[00000030h] 15_2_04DD20A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD20A0 mov eax, dword ptr fs:[00000030h] 15_2_04DD20A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD20A0 mov eax, dword ptr fs:[00000030h] 15_2_04DD20A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD20A0 mov eax, dword ptr fs:[00000030h] 15_2_04DD20A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DC0050 mov eax, dword ptr fs:[00000030h] 15_2_04DC0050
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DC0050 mov eax, dword ptr fs:[00000030h] 15_2_04DC0050
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E71074 mov eax, dword ptr fs:[00000030h] 15_2_04E71074
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E62073 mov eax, dword ptr fs:[00000030h] 15_2_04E62073
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCA830 mov eax, dword ptr fs:[00000030h] 15_2_04DCA830
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCA830 mov eax, dword ptr fs:[00000030h] 15_2_04DCA830
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCA830 mov eax, dword ptr fs:[00000030h] 15_2_04DCA830
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DCA830 mov eax, dword ptr fs:[00000030h] 15_2_04DCA830
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD002D mov eax, dword ptr fs:[00000030h] 15_2_04DD002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD002D mov eax, dword ptr fs:[00000030h] 15_2_04DD002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD002D mov eax, dword ptr fs:[00000030h] 15_2_04DD002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD002D mov eax, dword ptr fs:[00000030h] 15_2_04DD002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD002D mov eax, dword ptr fs:[00000030h] 15_2_04DD002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DBB02A mov eax, dword ptr fs:[00000030h] 15_2_04DBB02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DBB02A mov eax, dword ptr fs:[00000030h] 15_2_04DBB02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DBB02A mov eax, dword ptr fs:[00000030h] 15_2_04DBB02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DBB02A mov eax, dword ptr fs:[00000030h] 15_2_04DBB02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E74015 mov eax, dword ptr fs:[00000030h] 15_2_04E74015
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E74015 mov eax, dword ptr fs:[00000030h] 15_2_04E74015
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E27016 mov eax, dword ptr fs:[00000030h] 15_2_04E27016
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E27016 mov eax, dword ptr fs:[00000030h] 15_2_04E27016
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E27016 mov eax, dword ptr fs:[00000030h] 15_2_04E27016
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E341E8 mov eax, dword ptr fs:[00000030h] 15_2_04E341E8
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DAB1E1 mov eax, dword ptr fs:[00000030h] 15_2_04DAB1E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DAB1E1 mov eax, dword ptr fs:[00000030h] 15_2_04DAB1E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DAB1E1 mov eax, dword ptr fs:[00000030h] 15_2_04DAB1E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E649A4 mov eax, dword ptr fs:[00000030h] 15_2_04E649A4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E649A4 mov eax, dword ptr fs:[00000030h] 15_2_04E649A4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E649A4 mov eax, dword ptr fs:[00000030h] 15_2_04E649A4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E649A4 mov eax, dword ptr fs:[00000030h] 15_2_04E649A4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E269A6 mov eax, dword ptr fs:[00000030h] 15_2_04E269A6
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DD2990 mov eax, dword ptr fs:[00000030h] 15_2_04DD2990
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04DDA185 mov eax, dword ptr fs:[00000030h] 15_2_04DDA185
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E251BE mov eax, dword ptr fs:[00000030h] 15_2_04E251BE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 15_2_04E251BE mov eax, dword ptr fs:[00000030h] 15_2_04E251BE
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\DpiScaling.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\logagent.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 5_2_04F995D0 NtClose,LdrInitializeThunk, 5_2_04F995D0

HIPS / PFW / Operating System Protection Evasion:

barindex
Sample uses process hollowing technique
Source: C:\Windows\SysWOW64\DpiScaling.exe Section unmapped: C:\Windows\SysWOW64\colorcpl.exe base address: 9A0000 Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section unmapped: C:\Windows\SysWOW64\msdt.exe base address: DC0000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: unknown protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: EE0000 Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: EF0000 Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 980000 Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 990000 Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Memory written: C:\Windows\SysWOW64\logagent.exe base: 72480000 Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Memory written: C:\Windows\SysWOW64\logagent.exe base: 2FB0000 Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Memory written: C:\Windows\SysWOW64\logagent.exe base: 2FC0000 Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: EE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: EF0000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Memory written: C:\Windows\SysWOW64\logagent.exe base: 72480000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\DpiScaling.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\DpiScaling.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Thread register set: target process: 3424 Jump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Thread created: C:\Windows\SysWOW64\DpiScaling.exe EIP: EF0000 Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Thread created: C:\Windows\SysWOW64\DpiScaling.exe EIP: 990000 Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 2FC0000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Nova narudzba u prilogu.exe Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe Jump to behavior
Source: C:\Users\user\Contacts\Ajshkennyc.exe Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\DpiScaling.exe" Jump to behavior
Source: explorer.exe, 00000006.00000000.755276192.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.734471103.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.800820766.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.719106933.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000006.00000000.802547452.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.734691170.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.756196706.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.719321064.0000000001080000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000000.743443342.0000000005E50000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.761662978.0000000005E50000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.722640032.0000000005E50000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.802547452.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.734691170.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.756196706.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.719321064.0000000001080000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.802547452.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.734691170.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.756196706.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.719321064.0000000001080000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.802547452.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.734691170.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.756196706.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.719321064.0000000001080000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000006.00000000.768231511.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.746630271.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.725780323.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D
Source: C:\Users\user\Contacts\Ajshkennyc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000000.810820140.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.980408969.0000000002C60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.826394913.0000000004B90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.772008503.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.714097353.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.979059154.0000000000800000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.749509351.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.836253520.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.860879140.0000000000E90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.810315428.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.864516356.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.811363392.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.714755943.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.860188435.0000000000E60000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.844946988.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.714442633.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.980367511.0000000002C30000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.811926457.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.713760138.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.826540547.0000000004BF0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.830080872.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.835723366.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.863247728.0000000003280000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.836796283.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.837305764.0000000072480000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000000.810820140.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.980408969.0000000002C60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.826394913.0000000004B90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.772008503.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.714097353.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.979059154.0000000000800000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.749509351.000000000E9DF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.836253520.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.860879140.0000000000E90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.810315428.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.864516356.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.811363392.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.714755943.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.860188435.0000000000E60000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.844946988.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.714442633.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.980367511.0000000002C30000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.811926457.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.713760138.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.826540547.0000000004BF0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.830080872.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.835723366.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.863247728.0000000003280000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.836796283.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.837305764.0000000072480000.00000040.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 553139 Sample: Nova narudzba u prilogu.exe Startdate: 14/01/2022 Architecture: WINDOWS Score: 100 53 Multi AV Scanner detection for domain / URL 2->53 55 Found malware configuration 2->55 57 Malicious sample detected (through community Yara rule) 2->57 59 5 other signatures 2->59 10 Nova narudzba u prilogu.exe 1 17 2->10         started        process3 dnsIp4 51 cdn.discordapp.com 162.159.135.233, 443, 49774, 49775 CLOUDFLARENETUS United States 10->51 41 C:\Users\user\Contacts\Ajshkennyc.exe, PE32 10->41 dropped 43 C:\Users\...\Ajshkennyc.exe:Zone.Identifier, ASCII 10->43 dropped 77 Writes to foreign memory regions 10->77 79 Allocates memory in foreign processes 10->79 81 Creates a thread in another existing process (thread injection) 10->81 83 Injects a PE file into a foreign processes 10->83 15 DpiScaling.exe 10->15         started        file5 signatures6 process7 signatures8 93 Modifies the context of a thread in another process (thread injection) 15->93 95 Maps a DLL or memory area into another process 15->95 97 Sample uses process hollowing technique 15->97 99 2 other signatures 15->99 18 explorer.exe 4 2 15->18 injected process9 process10 20 Ajshkennyc.exe 13 18->20         started        24 Ajshkennyc.exe 14 18->24         started        26 colorcpl.exe 18->26         started        28 msdt.exe 18->28         started        dnsIp11 45 cdn.discordapp.com 20->45 61 Multi AV Scanner detection for dropped file 20->61 63 Machine Learning detection for dropped file 20->63 65 Writes to foreign memory regions 20->65 30 DpiScaling.exe 20->30         started        47 162.159.134.233, 443, 49779 CLOUDFLARENETUS United States 24->47 49 cdn.discordapp.com 24->49 67 Creates a thread in another existing process (thread injection) 24->67 69 Injects a PE file into a foreign processes 24->69 33 logagent.exe 24->33         started        71 Modifies the context of a thread in another process (thread injection) 26->71 73 Maps a DLL or memory area into another process 26->73 75 Tries to detect virtualization through RDTSC time measurements 26->75 35 cmd.exe 1 26->35         started        37 explorer.exe 144 26->37         started        signatures12 process13 signatures14 85 Modifies the context of a thread in another process (thread injection) 30->85 87 Maps a DLL or memory area into another process 30->87 89 Sample uses process hollowing technique 30->89 91 Tries to detect virtualization through RDTSC time measurements 33->91 39 conhost.exe 35->39         started        process15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.159.135.233
 cdn.discordapp.com United States
13335 CLOUDFLARENETUS false
162.159.134.233
 unknown United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
cdn.discordapp.com 162.159.135.233 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.finetipster.com/pvxz/ true
  • 5%, Virustotal, Browse
  • Avira URL Cloud: safe
 low
https://cdn.discordapp.com/attachments/909752051695775778/931434691809124392/Ajshkennychvrlvyqvxklxbhfqfzgvr false
    		high