Windows Analysis Report
7AYsP32Q7Y

Overview

General Information

Sample Name: 7AYsP32Q7Y (renamed file extension from none to exe)
Analysis ID: 562059
MD5: 6ae185ce909f0b66306100824c28bad1
SHA1: 5f23a2d4b2c564c95606e537e557aa8251087746
SHA256: 074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867
Tags: 32exeFormbooktrojan
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Writes to foreign memory regions
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Sigma detected: Autorun Keys Modification
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Found malware configuration
Source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.fyonkaly.com/ahc8/"], "decoy": ["methodicalservices.com", "lojahelius.com", "dxadxc.com", "keshaunharris.club", "hockeyengolfshop.online", "sherranmanning.com", "instylelimos.net", "plick-click.com", "tntexplode.com", "movement-practice.net", "nftlake.digital", "134171.com", "newhorizonseo.com", "lm-solar.com", "fahrrad-markt24.com", "creatologiest.com", "juststartmessy.com", "sady-rossii-ural.com", "blockchain-salt.com", "bestoflakegeorge.guide", "infinitymoversllc.com", "javelephant.com", "promocaozeraestoque.online", "p60p.com", "kreditineskorteleslt.com", "chronicfit.store", "onzep.store", "shafiqandmudasir.com", "vivemanku.online", "chengfengdh.xyz", "bets-bc-zrkqf.xyz", "cellparts10.com", "guardions.com", "talenue.store", "graffity-aws.com", "buddingwsetcg.top", "erikakorma.com", "playex.ltd", "jamaicarailways.com", "nfthunter.art", "ml-pilot.com", "athleteteas.com", "ruthdeliverance.info", "medicmir.store", "procurovariedades.com", "undermour01.club", "sneakeryeezy.com", "dallmann.info", "edm69.net", "micj7870.com", "silviomicalikush.xyz", "activa.store", "adeelnawaznj.com", "travispilat.com", "mercyships.kiwi", "amazon939.com", "talenterzllc.com", "sbxip.com", "phasernet.net", "taggalla.com", "pbspoolservices.com", "34gjm.xyz", "nuevochile.net", "busdijogja.com"]}
Multi AV Scanner detection for submitted file
Source: 7AYsP32Q7Y.exe Virustotal: Detection: 20% Perma Link
Yara detected FormBook
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Multi AV Scanner detection for dropped file
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Virustotal: Detection: 20% Perma Link
Antivirus or Machine Learning detection for unpacked file
Source: 7.0.DpiScaling.exe.72480000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 19.0.DpiScaling.exe.72480000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 22.2.msiexec.exe.2eac4e8.1.unpack Avira: Label: TR/Patched.Ren.Gen8
Source: 20.0.logagent.exe.72480000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 7.2.DpiScaling.exe.72480000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 19.2.DpiScaling.exe.72480000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 7.0.DpiScaling.exe.72480000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 20.0.logagent.exe.72480000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 19.0.DpiScaling.exe.72480000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 20.0.logagent.exe.72480000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 20.0.logagent.exe.72480000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 20.2.logagent.exe.72480000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 19.0.DpiScaling.exe.72480000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 19.0.DpiScaling.exe.72480000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 7.0.DpiScaling.exe.72480000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 7.0.DpiScaling.exe.72480000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance
barindex
Uses 32bit PE files
Source: 7AYsP32Q7Y.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
Source: Binary string: cscript.pdbUGP source: DpiScaling.exe, 00000007.00000002.550569455.00000000008C0000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: DpiScaling.exe, 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, DpiScaling.exe, 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmp, DpiScaling.exe, 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, 00000016.00000002.579194787.0000000004E3F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: DpiScaling.exe, DpiScaling.exe, 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, 00000016.00000002.579194787.0000000004E3F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: cscript.pdb source: DpiScaling.exe, 00000007.00000002.550569455.00000000008C0000.00000040.10000000.00040000.00000000.sdmp

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.fyonkaly.com/ahc8/
Source: 7AYsP32Q7Y.exe, 00000001.00000003.309723740.0000000000768000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.312295068.000000000075F000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Iodqgrdelf.exe, 00000009.00000003.412972906.000000000074F000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/
Source: 7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/D
Source: Iodqgrdelf.exe, 00000009.00000003.408286510.000000000074F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/download?cid=C38D15779
Source: Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/download?cid=C38D15779AFD1231&resid=C38D15779AFD1231%21112&authkey=AJglnSs
Source: 7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 00000009.00000003.412972906.000000000074F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/ownload?cid=C38D15779AFD1231&resid=C38D15779AFD1231%21112&authkey=AJglnSs0
Source: Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/ve.live.com/
Source: 7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.312295068.000000000075F000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.432603036.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.438634245.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vru2ia.am.files.1drv.com/
Source: 7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.312295068.000000000075F000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vru2ia.am.files.1drv.com/J
Source: 7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.312295068.000000000075F000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vru2ia.am.files.1drv.com/y
Source: 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 00000009.00000003.410519278.000000000075D000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 00000009.00000003.410740246.000000000075D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vru2ia.am.files.1drv.com/y4m423aJ2r6bprjijqR9Zhv79BsqXWchgBZ_yRRKAukc5TAIPNB4BdYAYidrCTJ4BkE
Source: Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vru2ia.am.files.1drv.com/y4m4qzuMb9gIarzlKBTf0D1umDohf9Y3sIpL-K8zvk8UHM6XBD2Ajct4M-j4Gm20nJT
Source: Iodqgrdelf.exe, 00000009.00000003.412998037.000000000075A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vru2ia.am.files.1drv.com/y4m8TXF6mlgGvccZFUvhwUh-l9zz_V1hgmOQiTI_douTr2wu7UlvtGbODDxtwhN0e5H
Source: Iodqgrdelf.exe, 00000009.00000003.408295630.0000000000753000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vru2ia.am.files.1drv.com/y4mC-JI5vs5pbHFPeZ5KI8vSY-Zm0BYG_DfYRphHWKBbqd0ouSRcXTjDbP2g5pIoI5u
Source: 7AYsP32Q7Y.exe, 00000001.00000003.309723740.0000000000768000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.312295068.000000000075F000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vru2ia.am.files.1drv.com/y4mPL6EaGmr7d1CmnxP8LzgR3rcH9luOFpR5APvojUZtRQCdMAq2C-_uZddZ6W0R9-N
Source: 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vru2ia.am.files.1drv.com/y4mXdCXgV78z93QBfcFjKJ0ucHs8CARh8saaIpZ0Zw4IJExL4V9d7aCID-8TYoLJ0Qx
Source: Iodqgrdelf.exe, 0000000D.00000003.432603036.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.438634245.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.432635294.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.432387332.00000000007CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vru2ia.am.files.1drv.com/y4mqmZSB7T13rwuDyCkOltxUalsuuekof9Mak2JfMqUquSjRzSFu0dx_u0qHh2VQFIg
Source: unknown DNS traffic detected: queries for: onedrive.live.com

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: 7AYsP32Q7Y.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
Yara signature match
Source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: C:\Users\user\Contacts\fledrgqdoI.url, type: DROPPED Matched rule: Methodology_Shortcut_HotKey author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: C:\Users\user\Contacts\fledrgqdoI.url, type: DROPPED Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Detected potential crypto function
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047DD466 7_2_047DD466
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472841F 7_2_0472841F
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E1D55 7_2_047E1D55
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04710D20 7_2_04710D20
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E2D07 7_2_047E2D07
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472D5E0 7_2_0472D5E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E25DD 7_2_047E25DD
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04742581 7_2_04742581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04736E30 7_2_04736E30
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047DD616 7_2_047DD616
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E2EF7 7_2_047E2EF7
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E1FF1 7_2_047E1FF1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047EDFCE 7_2_047EDFCE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047EE824 7_2_047EE824
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1002 7_2_047D1002
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E28EC 7_2_047E28EC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047420A0 7_2_047420A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E20A8 7_2_047E20A8
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472B090 7_2_0472B090
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04734120 7_2_04734120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471F900 7_2_0471F900
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E22AE 7_2_047E22AE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E2B28 7_2_047E2B28
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D03DA 7_2_047D03DA
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047DDBD2 7_2_047DDBD2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474EBB0 7_2_0474EBB0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E841F 19_2_042E841F
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391002 19_2_04391002
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043020A0 19_2_043020A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A20A8 19_2_043A20A8
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042EB090 19_2_042EB090
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D0D20 19_2_042D0D20
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042F4120 19_2_042F4120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DF900 19_2_042DF900
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A2D07 19_2_043A2D07
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A1D55 19_2_043A1D55
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04302581 19_2_04302581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042ED5E0 19_2_042ED5E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042F6E30 19_2_042F6E30
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A2EF7 19_2_043A2EF7
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430EBB0 19_2_0430EBB0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A1FF1 19_2_043A1FF1
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: String function: 0471B150 appears 45 times
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: String function: 042DB150 appears 35 times
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759540 NtReadFile,LdrInitializeThunk, 7_2_04759540
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047595D0 NtClose,LdrInitializeThunk, 7_2_047595D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759660 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_04759660
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047596E0 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_047596E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759710 NtQueryInformationToken,LdrInitializeThunk, 7_2_04759710
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759FE0 NtCreateMutant,LdrInitializeThunk, 7_2_04759FE0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047597A0 NtUnmapViewOfSection,LdrInitializeThunk, 7_2_047597A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759780 NtMapViewOfSection,LdrInitializeThunk, 7_2_04759780
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759860 NtQuerySystemInformation,LdrInitializeThunk, 7_2_04759860
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759840 NtDelayExecution,LdrInitializeThunk, 7_2_04759840
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047598F0 NtReadVirtualMemory,LdrInitializeThunk, 7_2_047598F0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759910 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_04759910
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047599A0 NtCreateSection,LdrInitializeThunk, 7_2_047599A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759A50 NtCreateFile,LdrInitializeThunk, 7_2_04759A50
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759A20 NtResumeThread,LdrInitializeThunk, 7_2_04759A20
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759A00 NtProtectVirtualMemory,LdrInitializeThunk, 7_2_04759A00
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759560 NtWriteFile, 7_2_04759560
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0475AD30 NtSetContextThread, 7_2_0475AD30
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759520 NtWaitForSingleObject, 7_2_04759520
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047595F0 NtQueryInformationFile, 7_2_047595F0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759670 NtQueryInformationProcess, 7_2_04759670
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759650 NtQueryValueKey, 7_2_04759650
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759610 NtEnumerateValueKey, 7_2_04759610
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047596D0 NtCreateKey, 7_2_047596D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0475A770 NtOpenThread, 7_2_0475A770
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759770 NtSetInformationFile, 7_2_04759770
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759760 NtOpenProcess, 7_2_04759760
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759730 NtQueryVirtualMemory, 7_2_04759730
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0475A710 NtOpenProcessToken, 7_2_0475A710
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0475B040 NtSuspendThread, 7_2_0475B040
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759820 NtEnumerateKey, 7_2_04759820
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047598A0 NtWriteVirtualMemory, 7_2_047598A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759950 NtQueueApcThread, 7_2_04759950
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047599D0 NtCreateProcessEx, 7_2_047599D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759A10 NtQuerySection, 7_2_04759A10
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759A80 NtOpenDirectoryObject, 7_2_04759A80
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759B00 NtSetValueKey, 7_2_04759B00
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0475A3B0 NtGetContextThread, 7_2_0475A3B0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319860 NtQuerySystemInformation,LdrInitializeThunk, 19_2_04319860
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319840 NtDelayExecution,LdrInitializeThunk, 19_2_04319840
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043198F0 NtReadVirtualMemory,LdrInitializeThunk, 19_2_043198F0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319910 NtAdjustPrivilegesToken,LdrInitializeThunk, 19_2_04319910
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319540 NtReadFile,LdrInitializeThunk, 19_2_04319540
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043199A0 NtCreateSection,LdrInitializeThunk, 19_2_043199A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043195D0 NtClose,LdrInitializeThunk, 19_2_043195D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319A20 NtResumeThread,LdrInitializeThunk, 19_2_04319A20
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319A00 NtProtectVirtualMemory,LdrInitializeThunk, 19_2_04319A00
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319660 NtAllocateVirtualMemory,LdrInitializeThunk, 19_2_04319660
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319A50 NtCreateFile,LdrInitializeThunk, 19_2_04319A50
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043196E0 NtFreeVirtualMemory,LdrInitializeThunk, 19_2_043196E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319710 NtQueryInformationToken,LdrInitializeThunk, 19_2_04319710
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043197A0 NtUnmapViewOfSection,LdrInitializeThunk, 19_2_043197A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319780 NtMapViewOfSection,LdrInitializeThunk, 19_2_04319780
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319FE0 NtCreateMutant,LdrInitializeThunk, 19_2_04319FE0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319820 NtEnumerateKey, 19_2_04319820
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0431B040 NtSuspendThread, 19_2_0431B040
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043198A0 NtWriteVirtualMemory, 19_2_043198A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0431AD30 NtSetContextThread, 19_2_0431AD30
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319520 NtWaitForSingleObject, 19_2_04319520
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319560 NtWriteFile, 19_2_04319560
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319950 NtQueueApcThread, 19_2_04319950
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043195F0 NtQueryInformationFile, 19_2_043195F0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043199D0 NtCreateProcessEx, 19_2_043199D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319610 NtEnumerateValueKey, 19_2_04319610
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319A10 NtQuerySection, 19_2_04319A10
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319670 NtQueryInformationProcess, 19_2_04319670
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319650 NtQueryValueKey, 19_2_04319650
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319A80 NtOpenDirectoryObject, 19_2_04319A80
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043196D0 NtCreateKey, 19_2_043196D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319730 NtQueryVirtualMemory, 19_2_04319730
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0431A710 NtOpenProcessToken, 19_2_0431A710
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319B00 NtSetValueKey, 19_2_04319B00
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319770 NtSetInformationFile, 19_2_04319770
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0431A770 NtOpenThread, 19_2_0431A770
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04319760 NtOpenProcess, 19_2_04319760
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0431A3B0 NtGetContextThread, 19_2_0431A3B0
Sample file is different than original file name gathered from version info
Source: 7AYsP32Q7Y.exe, 00000001.00000003.301545667.0000000003710000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWebPicker4 vs 7AYsP32Q7Y.exe
Source: 7AYsP32Q7Y.exe, 00000001.00000000.299731510.0000000000474000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameWebPicker4 vs 7AYsP32Q7Y.exe
PE file contains strange resources
Source: 7AYsP32Q7Y.exe Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 7AYsP32Q7Y.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Iodqgrdelf.exe.1.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Iodqgrdelf.exe.1.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ?l .dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???t.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??l.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??l.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ?l .dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??l.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??i.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??i.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??i.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??i.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Section loaded: ??l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l .dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???t.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l .dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??i.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??i.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??i.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??i.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l .dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???t.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?f???.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2?????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l .dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??i.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??i.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??i.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??i.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ????.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ?l.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???2.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ???b.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Section loaded: ??l.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Memory allocated: 72480000 page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Memory allocated: 72480000 page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Memory allocated: 72480000 page no access Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Memory allocated: 72480000 page read and write Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Memory allocated: 72481000 page read and write Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: 72480000 page execute and read and write Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: 72480000 page execute and read and write Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: 72480000 page no access Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: 72480000 page read and write Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: 72481000 page read and write Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: 72480000 page execute and read and write Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: 72480000 page execute and read and write Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: 72480000 page no access Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: 72480000 page read and write Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: 72481000 page read and write Jump to behavior
Source: 7AYsP32Q7Y.exe Virustotal: Detection: 20%
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe File read: C:\Users\user\Desktop\7AYsP32Q7Y.exe Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\7AYsP32Q7Y.exe "C:\Users\user\Desktop\7AYsP32Q7Y.exe"
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\Contacts\Iodqgrdelf.exe "C:\Users\user\Contacts\Iodqgrdelf.exe"
Source: C:\Windows\explorer.exe Process created: C:\Users\user\Contacts\Iodqgrdelf.exe "C:\Users\user\Contacts\Iodqgrdelf.exe"
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\autochk.exe C:\Windows\SysWOW64\autochk.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cscript.exe
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\Contacts\Iodqgrdelf.exe "C:\Users\user\Contacts\Iodqgrdelf.exe" Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Iodqgrdelfemgrjgzrzpbewqyzpzqin[1] Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@13/6@7/0
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Binary string: cscript.pdbUGP source: DpiScaling.exe, 00000007.00000002.550569455.00000000008C0000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: DpiScaling.exe, 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, DpiScaling.exe, 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmp, DpiScaling.exe, 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, 00000016.00000002.579194787.0000000004E3F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: DpiScaling.exe, DpiScaling.exe, 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, 00000016.00000002.579194787.0000000004E3F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: cscript.pdb source: DpiScaling.exe, 00000007.00000002.550569455.00000000008C0000.00000040.10000000.00040000.00000000.sdmp

Data Obfuscation
barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0476D0D1 push ecx; ret 7_2_0476D0E4
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A85995 push eax; iretd 13_3_03A859A9
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A85995 push eax; iretd 13_3_03A859A9
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A85B44 push esi; iretd 13_3_03A85B47
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A85B44 push esi; iretd 13_3_03A85B47
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A870F6 push cs; iretd 13_3_03A87100
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A870F6 push cs; iretd 13_3_03A87100
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A8906B push esp; retf 13_3_03A8907E
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A8906B push esp; retf 13_3_03A8907E
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A8806C push es; retf 13_3_03A8806D
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A8806C push es; retf 13_3_03A8806D
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A87E6E push cs; iretd 13_3_03A87E73
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A87E6E push cs; iretd 13_3_03A87E73
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A87656 push esp; retf 13_3_03A87657
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A87656 push esp; retf 13_3_03A87657
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A85995 push eax; iretd 13_3_03A859A9
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A85995 push eax; iretd 13_3_03A859A9
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A85B44 push esi; iretd 13_3_03A85B47
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A85B44 push esi; iretd 13_3_03A85B47
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A870F6 push cs; iretd 13_3_03A87100
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A870F6 push cs; iretd 13_3_03A87100
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A8906B push esp; retf 13_3_03A8907E
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A8906B push esp; retf 13_3_03A8907E
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A8806C push es; retf 13_3_03A8806D
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A8806C push es; retf 13_3_03A8806D
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A87E6E push cs; iretd 13_3_03A87E73
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A87E6E push cs; iretd 13_3_03A87E73
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A87656 push esp; retf 13_3_03A87657
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Code function: 13_3_03A87656 push esp; retf 13_3_03A87657
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0432D0D1 push ecx; ret 19_2_0432D0E4

Persistence and Installation Behavior
barindex
Drops PE files
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe File created: C:\Users\user\Contacts\Iodqgrdelf.exe Jump to dropped file
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Iodqgrdelf Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Iodqgrdelf Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\SysWOW64\DpiScaling.exe RDTSC instruction interceptor: First address: 0000000072488604 second address: 000000007248860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\DpiScaling.exe RDTSC instruction interceptor: First address: 000000007248898E second address: 0000000072488994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\logagent.exe RDTSC instruction interceptor: First address: 0000000072488604 second address: 000000007248860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\logagent.exe RDTSC instruction interceptor: First address: 000000007248898E second address: 0000000072488994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 00000000008B8604 second address: 00000000008B860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 00000000008B898E second address: 00000000008B8994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04756DE6 rdtsc 7_2_04756DE6
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\DpiScaling.exe API coverage: 5.9 %
Source: C:\Windows\SysWOW64\DpiScaling.exe API coverage: 6.2 %
Source: C:\Windows\SysWOW64\DpiScaling.exe Process information queried: ProcessInformation Jump to behavior
Source: explorer.exe, 00000008.00000000.400081450.000000000EED4000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}bwe
Source: explorer.exe, 00000008.00000000.420887427.00000000086C9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.421067968.000000000875B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 00000008.00000000.420887427.00000000086C9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 00000008.00000000.392252295.00000000067C2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.392252295.00000000067C2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: 7AYsP32Q7Y.exe, 00000001.00000003.314786849.0000000000735000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363059633.0000000000735000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000008.00000000.400081450.000000000EED4000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: 1efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.427008416.000000000EF1B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}AppD
Source: explorer.exe, 00000008.00000000.400081450.000000000EED4000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: 0d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}sapps_1
Source: 7AYsP32Q7Y.exe, 00000001.00000003.314786849.0000000000735000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363059633.0000000000735000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW,
Source: explorer.exe, 00000008.00000000.420887427.00000000086C9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Anti Debugging
barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04756DE6 rdtsc 7_2_04756DE6
Enables debug privileges
Source: C:\Windows\SysWOW64\DpiScaling.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0473746D mov eax, dword ptr fs:[00000030h] 7_2_0473746D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047AC450 mov eax, dword ptr fs:[00000030h] 7_2_047AC450
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047AC450 mov eax, dword ptr fs:[00000030h] 7_2_047AC450
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474A44B mov eax, dword ptr fs:[00000030h] 7_2_0474A44B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474BC2C mov eax, dword ptr fs:[00000030h] 7_2_0474BC2C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E740D mov eax, dword ptr fs:[00000030h] 7_2_047E740D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E740D mov eax, dword ptr fs:[00000030h] 7_2_047E740D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E740D mov eax, dword ptr fs:[00000030h] 7_2_047E740D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04796C0A mov eax, dword ptr fs:[00000030h] 7_2_04796C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04796C0A mov eax, dword ptr fs:[00000030h] 7_2_04796C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04796C0A mov eax, dword ptr fs:[00000030h] 7_2_04796C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04796C0A mov eax, dword ptr fs:[00000030h] 7_2_04796C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h] 7_2_047D1C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h] 7_2_047D1C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h] 7_2_047D1C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h] 7_2_047D1C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h] 7_2_047D1C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h] 7_2_047D1C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h] 7_2_047D1C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h] 7_2_047D1C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h] 7_2_047D1C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h] 7_2_047D1C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h] 7_2_047D1C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h] 7_2_047D1C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h] 7_2_047D1C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h] 7_2_047D1C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D14FB mov eax, dword ptr fs:[00000030h] 7_2_047D14FB
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04796CF0 mov eax, dword ptr fs:[00000030h] 7_2_04796CF0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04796CF0 mov eax, dword ptr fs:[00000030h] 7_2_04796CF0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04796CF0 mov eax, dword ptr fs:[00000030h] 7_2_04796CF0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E8CD6 mov eax, dword ptr fs:[00000030h] 7_2_047E8CD6
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472849B mov eax, dword ptr fs:[00000030h] 7_2_0472849B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0473C577 mov eax, dword ptr fs:[00000030h] 7_2_0473C577
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0473C577 mov eax, dword ptr fs:[00000030h] 7_2_0473C577
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04737D50 mov eax, dword ptr fs:[00000030h] 7_2_04737D50
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04753D43 mov eax, dword ptr fs:[00000030h] 7_2_04753D43
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04793540 mov eax, dword ptr fs:[00000030h] 7_2_04793540
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047C3D40 mov eax, dword ptr fs:[00000030h] 7_2_047C3D40
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471AD30 mov eax, dword ptr fs:[00000030h] 7_2_0471AD30
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047DE539 mov eax, dword ptr fs:[00000030h] 7_2_047DE539
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h] 7_2_04723D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h] 7_2_04723D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h] 7_2_04723D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h] 7_2_04723D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h] 7_2_04723D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h] 7_2_04723D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h] 7_2_04723D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h] 7_2_04723D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h] 7_2_04723D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h] 7_2_04723D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h] 7_2_04723D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h] 7_2_04723D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h] 7_2_04723D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E8D34 mov eax, dword ptr fs:[00000030h] 7_2_047E8D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0479A537 mov eax, dword ptr fs:[00000030h] 7_2_0479A537
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04744D3B mov eax, dword ptr fs:[00000030h] 7_2_04744D3B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04744D3B mov eax, dword ptr fs:[00000030h] 7_2_04744D3B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04744D3B mov eax, dword ptr fs:[00000030h] 7_2_04744D3B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047C8DF1 mov eax, dword ptr fs:[00000030h] 7_2_047C8DF1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472D5E0 mov eax, dword ptr fs:[00000030h] 7_2_0472D5E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472D5E0 mov eax, dword ptr fs:[00000030h] 7_2_0472D5E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047DFDE2 mov eax, dword ptr fs:[00000030h] 7_2_047DFDE2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047DFDE2 mov eax, dword ptr fs:[00000030h] 7_2_047DFDE2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047DFDE2 mov eax, dword ptr fs:[00000030h] 7_2_047DFDE2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047DFDE2 mov eax, dword ptr fs:[00000030h] 7_2_047DFDE2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04796DC9 mov eax, dword ptr fs:[00000030h] 7_2_04796DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04796DC9 mov eax, dword ptr fs:[00000030h] 7_2_04796DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04796DC9 mov eax, dword ptr fs:[00000030h] 7_2_04796DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04796DC9 mov ecx, dword ptr fs:[00000030h] 7_2_04796DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04796DC9 mov eax, dword ptr fs:[00000030h] 7_2_04796DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04796DC9 mov eax, dword ptr fs:[00000030h] 7_2_04796DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04741DB5 mov eax, dword ptr fs:[00000030h] 7_2_04741DB5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04741DB5 mov eax, dword ptr fs:[00000030h] 7_2_04741DB5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04741DB5 mov eax, dword ptr fs:[00000030h] 7_2_04741DB5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E05AC mov eax, dword ptr fs:[00000030h] 7_2_047E05AC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E05AC mov eax, dword ptr fs:[00000030h] 7_2_047E05AC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047435A1 mov eax, dword ptr fs:[00000030h] 7_2_047435A1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474FD9B mov eax, dword ptr fs:[00000030h] 7_2_0474FD9B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474FD9B mov eax, dword ptr fs:[00000030h] 7_2_0474FD9B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04742581 mov eax, dword ptr fs:[00000030h] 7_2_04742581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04742581 mov eax, dword ptr fs:[00000030h] 7_2_04742581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04742581 mov eax, dword ptr fs:[00000030h] 7_2_04742581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04742581 mov eax, dword ptr fs:[00000030h] 7_2_04742581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04712D8A mov eax, dword ptr fs:[00000030h] 7_2_04712D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04712D8A mov eax, dword ptr fs:[00000030h] 7_2_04712D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04712D8A mov eax, dword ptr fs:[00000030h] 7_2_04712D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04712D8A mov eax, dword ptr fs:[00000030h] 7_2_04712D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04712D8A mov eax, dword ptr fs:[00000030h] 7_2_04712D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0473AE73 mov eax, dword ptr fs:[00000030h] 7_2_0473AE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0473AE73 mov eax, dword ptr fs:[00000030h] 7_2_0473AE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0473AE73 mov eax, dword ptr fs:[00000030h] 7_2_0473AE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0473AE73 mov eax, dword ptr fs:[00000030h] 7_2_0473AE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0473AE73 mov eax, dword ptr fs:[00000030h] 7_2_0473AE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472766D mov eax, dword ptr fs:[00000030h] 7_2_0472766D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04727E41 mov eax, dword ptr fs:[00000030h] 7_2_04727E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04727E41 mov eax, dword ptr fs:[00000030h] 7_2_04727E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04727E41 mov eax, dword ptr fs:[00000030h] 7_2_04727E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04727E41 mov eax, dword ptr fs:[00000030h] 7_2_04727E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04727E41 mov eax, dword ptr fs:[00000030h] 7_2_04727E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04727E41 mov eax, dword ptr fs:[00000030h] 7_2_04727E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047DAE44 mov eax, dword ptr fs:[00000030h] 7_2_047DAE44
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047DAE44 mov eax, dword ptr fs:[00000030h] 7_2_047DAE44
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047CFE3F mov eax, dword ptr fs:[00000030h] 7_2_047CFE3F
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471E620 mov eax, dword ptr fs:[00000030h] 7_2_0471E620
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474A61C mov eax, dword ptr fs:[00000030h] 7_2_0474A61C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474A61C mov eax, dword ptr fs:[00000030h] 7_2_0474A61C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471C600 mov eax, dword ptr fs:[00000030h] 7_2_0471C600
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471C600 mov eax, dword ptr fs:[00000030h] 7_2_0471C600
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471C600 mov eax, dword ptr fs:[00000030h] 7_2_0471C600
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04748E00 mov eax, dword ptr fs:[00000030h] 7_2_04748E00
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D1608 mov eax, dword ptr fs:[00000030h] 7_2_047D1608
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047276E2 mov eax, dword ptr fs:[00000030h] 7_2_047276E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047416E0 mov ecx, dword ptr fs:[00000030h] 7_2_047416E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E8ED6 mov eax, dword ptr fs:[00000030h] 7_2_047E8ED6
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04758EC7 mov eax, dword ptr fs:[00000030h] 7_2_04758EC7
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047436CC mov eax, dword ptr fs:[00000030h] 7_2_047436CC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047CFEC0 mov eax, dword ptr fs:[00000030h] 7_2_047CFEC0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E0EA5 mov eax, dword ptr fs:[00000030h] 7_2_047E0EA5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E0EA5 mov eax, dword ptr fs:[00000030h] 7_2_047E0EA5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E0EA5 mov eax, dword ptr fs:[00000030h] 7_2_047E0EA5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047946A7 mov eax, dword ptr fs:[00000030h] 7_2_047946A7
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047AFE87 mov eax, dword ptr fs:[00000030h] 7_2_047AFE87
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472FF60 mov eax, dword ptr fs:[00000030h] 7_2_0472FF60
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E8F6A mov eax, dword ptr fs:[00000030h] 7_2_047E8F6A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472EF40 mov eax, dword ptr fs:[00000030h] 7_2_0472EF40
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474E730 mov eax, dword ptr fs:[00000030h] 7_2_0474E730
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04714F2E mov eax, dword ptr fs:[00000030h] 7_2_04714F2E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04714F2E mov eax, dword ptr fs:[00000030h] 7_2_04714F2E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0473F716 mov eax, dword ptr fs:[00000030h] 7_2_0473F716
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047AFF10 mov eax, dword ptr fs:[00000030h] 7_2_047AFF10
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047AFF10 mov eax, dword ptr fs:[00000030h] 7_2_047AFF10
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E070D mov eax, dword ptr fs:[00000030h] 7_2_047E070D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E070D mov eax, dword ptr fs:[00000030h] 7_2_047E070D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474A70E mov eax, dword ptr fs:[00000030h] 7_2_0474A70E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474A70E mov eax, dword ptr fs:[00000030h] 7_2_0474A70E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047537F5 mov eax, dword ptr fs:[00000030h] 7_2_047537F5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04728794 mov eax, dword ptr fs:[00000030h] 7_2_04728794
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04797794 mov eax, dword ptr fs:[00000030h] 7_2_04797794
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04797794 mov eax, dword ptr fs:[00000030h] 7_2_04797794
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04797794 mov eax, dword ptr fs:[00000030h] 7_2_04797794
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E1074 mov eax, dword ptr fs:[00000030h] 7_2_047E1074
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D2073 mov eax, dword ptr fs:[00000030h] 7_2_047D2073
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04730050 mov eax, dword ptr fs:[00000030h] 7_2_04730050
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04730050 mov eax, dword ptr fs:[00000030h] 7_2_04730050
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472B02A mov eax, dword ptr fs:[00000030h] 7_2_0472B02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472B02A mov eax, dword ptr fs:[00000030h] 7_2_0472B02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472B02A mov eax, dword ptr fs:[00000030h] 7_2_0472B02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472B02A mov eax, dword ptr fs:[00000030h] 7_2_0472B02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474002D mov eax, dword ptr fs:[00000030h] 7_2_0474002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474002D mov eax, dword ptr fs:[00000030h] 7_2_0474002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474002D mov eax, dword ptr fs:[00000030h] 7_2_0474002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474002D mov eax, dword ptr fs:[00000030h] 7_2_0474002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474002D mov eax, dword ptr fs:[00000030h] 7_2_0474002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E4015 mov eax, dword ptr fs:[00000030h] 7_2_047E4015
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E4015 mov eax, dword ptr fs:[00000030h] 7_2_047E4015
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04797016 mov eax, dword ptr fs:[00000030h] 7_2_04797016
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04797016 mov eax, dword ptr fs:[00000030h] 7_2_04797016
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04797016 mov eax, dword ptr fs:[00000030h] 7_2_04797016
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047140E1 mov eax, dword ptr fs:[00000030h] 7_2_047140E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047140E1 mov eax, dword ptr fs:[00000030h] 7_2_047140E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047140E1 mov eax, dword ptr fs:[00000030h] 7_2_047140E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047158EC mov eax, dword ptr fs:[00000030h] 7_2_047158EC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047AB8D0 mov eax, dword ptr fs:[00000030h] 7_2_047AB8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047AB8D0 mov ecx, dword ptr fs:[00000030h] 7_2_047AB8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047AB8D0 mov eax, dword ptr fs:[00000030h] 7_2_047AB8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047AB8D0 mov eax, dword ptr fs:[00000030h] 7_2_047AB8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047AB8D0 mov eax, dword ptr fs:[00000030h] 7_2_047AB8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047AB8D0 mov eax, dword ptr fs:[00000030h] 7_2_047AB8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474F0BF mov ecx, dword ptr fs:[00000030h] 7_2_0474F0BF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474F0BF mov eax, dword ptr fs:[00000030h] 7_2_0474F0BF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474F0BF mov eax, dword ptr fs:[00000030h] 7_2_0474F0BF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047420A0 mov eax, dword ptr fs:[00000030h] 7_2_047420A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047420A0 mov eax, dword ptr fs:[00000030h] 7_2_047420A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047420A0 mov eax, dword ptr fs:[00000030h] 7_2_047420A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047420A0 mov eax, dword ptr fs:[00000030h] 7_2_047420A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047420A0 mov eax, dword ptr fs:[00000030h] 7_2_047420A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047420A0 mov eax, dword ptr fs:[00000030h] 7_2_047420A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047590AF mov eax, dword ptr fs:[00000030h] 7_2_047590AF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04719080 mov eax, dword ptr fs:[00000030h] 7_2_04719080
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04793884 mov eax, dword ptr fs:[00000030h] 7_2_04793884
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04793884 mov eax, dword ptr fs:[00000030h] 7_2_04793884
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471B171 mov eax, dword ptr fs:[00000030h] 7_2_0471B171
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471B171 mov eax, dword ptr fs:[00000030h] 7_2_0471B171
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471C962 mov eax, dword ptr fs:[00000030h] 7_2_0471C962
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0473B944 mov eax, dword ptr fs:[00000030h] 7_2_0473B944
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0473B944 mov eax, dword ptr fs:[00000030h] 7_2_0473B944
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474513A mov eax, dword ptr fs:[00000030h] 7_2_0474513A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474513A mov eax, dword ptr fs:[00000030h] 7_2_0474513A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04734120 mov eax, dword ptr fs:[00000030h] 7_2_04734120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04734120 mov eax, dword ptr fs:[00000030h] 7_2_04734120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04734120 mov eax, dword ptr fs:[00000030h] 7_2_04734120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04734120 mov eax, dword ptr fs:[00000030h] 7_2_04734120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04734120 mov ecx, dword ptr fs:[00000030h] 7_2_04734120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04719100 mov eax, dword ptr fs:[00000030h] 7_2_04719100
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04719100 mov eax, dword ptr fs:[00000030h] 7_2_04719100
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04719100 mov eax, dword ptr fs:[00000030h] 7_2_04719100
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0471B1E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0471B1E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0471B1E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047A41E8 mov eax, dword ptr fs:[00000030h] 7_2_047A41E8
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047951BE mov eax, dword ptr fs:[00000030h] 7_2_047951BE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047951BE mov eax, dword ptr fs:[00000030h] 7_2_047951BE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047951BE mov eax, dword ptr fs:[00000030h] 7_2_047951BE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047951BE mov eax, dword ptr fs:[00000030h] 7_2_047951BE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047461A0 mov eax, dword ptr fs:[00000030h] 7_2_047461A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047461A0 mov eax, dword ptr fs:[00000030h] 7_2_047461A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D49A4 mov eax, dword ptr fs:[00000030h] 7_2_047D49A4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D49A4 mov eax, dword ptr fs:[00000030h] 7_2_047D49A4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D49A4 mov eax, dword ptr fs:[00000030h] 7_2_047D49A4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D49A4 mov eax, dword ptr fs:[00000030h] 7_2_047D49A4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047969A6 mov eax, dword ptr fs:[00000030h] 7_2_047969A6
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04742990 mov eax, dword ptr fs:[00000030h] 7_2_04742990
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0473C182 mov eax, dword ptr fs:[00000030h] 7_2_0473C182
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474A185 mov eax, dword ptr fs:[00000030h] 7_2_0474A185
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0475927A mov eax, dword ptr fs:[00000030h] 7_2_0475927A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047CB260 mov eax, dword ptr fs:[00000030h] 7_2_047CB260
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047CB260 mov eax, dword ptr fs:[00000030h] 7_2_047CB260
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E8A62 mov eax, dword ptr fs:[00000030h] 7_2_047E8A62
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047DEA55 mov eax, dword ptr fs:[00000030h] 7_2_047DEA55
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047A4257 mov eax, dword ptr fs:[00000030h] 7_2_047A4257
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04719240 mov eax, dword ptr fs:[00000030h] 7_2_04719240
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04719240 mov eax, dword ptr fs:[00000030h] 7_2_04719240
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04719240 mov eax, dword ptr fs:[00000030h] 7_2_04719240
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04719240 mov eax, dword ptr fs:[00000030h] 7_2_04719240
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04754A2C mov eax, dword ptr fs:[00000030h] 7_2_04754A2C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04754A2C mov eax, dword ptr fs:[00000030h] 7_2_04754A2C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04715210 mov eax, dword ptr fs:[00000030h] 7_2_04715210
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04715210 mov ecx, dword ptr fs:[00000030h] 7_2_04715210
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04715210 mov eax, dword ptr fs:[00000030h] 7_2_04715210
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04715210 mov eax, dword ptr fs:[00000030h] 7_2_04715210
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471AA16 mov eax, dword ptr fs:[00000030h] 7_2_0471AA16
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471AA16 mov eax, dword ptr fs:[00000030h] 7_2_0471AA16
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047DAA16 mov eax, dword ptr fs:[00000030h] 7_2_047DAA16
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047DAA16 mov eax, dword ptr fs:[00000030h] 7_2_047DAA16
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04733A1C mov eax, dword ptr fs:[00000030h] 7_2_04733A1C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04728A0A mov eax, dword ptr fs:[00000030h] 7_2_04728A0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04742AE4 mov eax, dword ptr fs:[00000030h] 7_2_04742AE4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04742ACB mov eax, dword ptr fs:[00000030h] 7_2_04742ACB
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472AAB0 mov eax, dword ptr fs:[00000030h] 7_2_0472AAB0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0472AAB0 mov eax, dword ptr fs:[00000030h] 7_2_0472AAB0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474FAB0 mov eax, dword ptr fs:[00000030h] 7_2_0474FAB0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047152A5 mov eax, dword ptr fs:[00000030h] 7_2_047152A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047152A5 mov eax, dword ptr fs:[00000030h] 7_2_047152A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047152A5 mov eax, dword ptr fs:[00000030h] 7_2_047152A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047152A5 mov eax, dword ptr fs:[00000030h] 7_2_047152A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047152A5 mov eax, dword ptr fs:[00000030h] 7_2_047152A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474D294 mov eax, dword ptr fs:[00000030h] 7_2_0474D294
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474D294 mov eax, dword ptr fs:[00000030h] 7_2_0474D294
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04743B7A mov eax, dword ptr fs:[00000030h] 7_2_04743B7A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04743B7A mov eax, dword ptr fs:[00000030h] 7_2_04743B7A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471DB60 mov ecx, dword ptr fs:[00000030h] 7_2_0471DB60
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E8B58 mov eax, dword ptr fs:[00000030h] 7_2_047E8B58
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471F358 mov eax, dword ptr fs:[00000030h] 7_2_0471F358
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0471DB40 mov eax, dword ptr fs:[00000030h] 7_2_0471DB40
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D131B mov eax, dword ptr fs:[00000030h] 7_2_047D131B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047403E2 mov eax, dword ptr fs:[00000030h] 7_2_047403E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047403E2 mov eax, dword ptr fs:[00000030h] 7_2_047403E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047403E2 mov eax, dword ptr fs:[00000030h] 7_2_047403E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047403E2 mov eax, dword ptr fs:[00000030h] 7_2_047403E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047403E2 mov eax, dword ptr fs:[00000030h] 7_2_047403E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047403E2 mov eax, dword ptr fs:[00000030h] 7_2_047403E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0473DBE9 mov eax, dword ptr fs:[00000030h] 7_2_0473DBE9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047953CA mov eax, dword ptr fs:[00000030h] 7_2_047953CA
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047953CA mov eax, dword ptr fs:[00000030h] 7_2_047953CA
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04744BAD mov eax, dword ptr fs:[00000030h] 7_2_04744BAD
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04744BAD mov eax, dword ptr fs:[00000030h] 7_2_04744BAD
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04744BAD mov eax, dword ptr fs:[00000030h] 7_2_04744BAD
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047E5BA5 mov eax, dword ptr fs:[00000030h] 7_2_047E5BA5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04742397 mov eax, dword ptr fs:[00000030h] 7_2_04742397
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_0474B390 mov eax, dword ptr fs:[00000030h] 7_2_0474B390
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047D138A mov eax, dword ptr fs:[00000030h] 7_2_047D138A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_047CD380 mov ecx, dword ptr fs:[00000030h] 7_2_047CD380
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04721B8F mov eax, dword ptr fs:[00000030h] 7_2_04721B8F
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04721B8F mov eax, dword ptr fs:[00000030h] 7_2_04721B8F
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042EB02A mov eax, dword ptr fs:[00000030h] 19_2_042EB02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042EB02A mov eax, dword ptr fs:[00000030h] 19_2_042EB02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042EB02A mov eax, dword ptr fs:[00000030h] 19_2_042EB02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042EB02A mov eax, dword ptr fs:[00000030h] 19_2_042EB02A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430BC2C mov eax, dword ptr fs:[00000030h] 19_2_0430BC2C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430002D mov eax, dword ptr fs:[00000030h] 19_2_0430002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430002D mov eax, dword ptr fs:[00000030h] 19_2_0430002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430002D mov eax, dword ptr fs:[00000030h] 19_2_0430002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430002D mov eax, dword ptr fs:[00000030h] 19_2_0430002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430002D mov eax, dword ptr fs:[00000030h] 19_2_0430002D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04357016 mov eax, dword ptr fs:[00000030h] 19_2_04357016
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04357016 mov eax, dword ptr fs:[00000030h] 19_2_04357016
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04357016 mov eax, dword ptr fs:[00000030h] 19_2_04357016
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A4015 mov eax, dword ptr fs:[00000030h] 19_2_043A4015
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A4015 mov eax, dword ptr fs:[00000030h] 19_2_043A4015
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A740D mov eax, dword ptr fs:[00000030h] 19_2_043A740D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A740D mov eax, dword ptr fs:[00000030h] 19_2_043A740D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A740D mov eax, dword ptr fs:[00000030h] 19_2_043A740D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h] 19_2_04391C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h] 19_2_04391C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h] 19_2_04391C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h] 19_2_04391C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h] 19_2_04391C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h] 19_2_04391C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h] 19_2_04391C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h] 19_2_04391C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h] 19_2_04391C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h] 19_2_04391C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h] 19_2_04391C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h] 19_2_04391C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h] 19_2_04391C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h] 19_2_04391C06
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04356C0A mov eax, dword ptr fs:[00000030h] 19_2_04356C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04356C0A mov eax, dword ptr fs:[00000030h] 19_2_04356C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04356C0A mov eax, dword ptr fs:[00000030h] 19_2_04356C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04356C0A mov eax, dword ptr fs:[00000030h] 19_2_04356C0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042F746D mov eax, dword ptr fs:[00000030h] 19_2_042F746D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04392073 mov eax, dword ptr fs:[00000030h] 19_2_04392073
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A1074 mov eax, dword ptr fs:[00000030h] 19_2_043A1074
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0436C450 mov eax, dword ptr fs:[00000030h] 19_2_0436C450
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0436C450 mov eax, dword ptr fs:[00000030h] 19_2_0436C450
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430A44B mov eax, dword ptr fs:[00000030h] 19_2_0430A44B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042F0050 mov eax, dword ptr fs:[00000030h] 19_2_042F0050
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042F0050 mov eax, dword ptr fs:[00000030h] 19_2_042F0050
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430F0BF mov ecx, dword ptr fs:[00000030h] 19_2_0430F0BF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430F0BF mov eax, dword ptr fs:[00000030h] 19_2_0430F0BF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430F0BF mov eax, dword ptr fs:[00000030h] 19_2_0430F0BF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043020A0 mov eax, dword ptr fs:[00000030h] 19_2_043020A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043020A0 mov eax, dword ptr fs:[00000030h] 19_2_043020A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043020A0 mov eax, dword ptr fs:[00000030h] 19_2_043020A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043020A0 mov eax, dword ptr fs:[00000030h] 19_2_043020A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043020A0 mov eax, dword ptr fs:[00000030h] 19_2_043020A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043020A0 mov eax, dword ptr fs:[00000030h] 19_2_043020A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043190AF mov eax, dword ptr fs:[00000030h] 19_2_043190AF
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D9080 mov eax, dword ptr fs:[00000030h] 19_2_042D9080
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04353884 mov eax, dword ptr fs:[00000030h] 19_2_04353884
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04353884 mov eax, dword ptr fs:[00000030h] 19_2_04353884
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E849B mov eax, dword ptr fs:[00000030h] 19_2_042E849B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D58EC mov eax, dword ptr fs:[00000030h] 19_2_042D58EC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043914FB mov eax, dword ptr fs:[00000030h] 19_2_043914FB
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04356CF0 mov eax, dword ptr fs:[00000030h] 19_2_04356CF0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04356CF0 mov eax, dword ptr fs:[00000030h] 19_2_04356CF0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04356CF0 mov eax, dword ptr fs:[00000030h] 19_2_04356CF0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0436B8D0 mov eax, dword ptr fs:[00000030h] 19_2_0436B8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0436B8D0 mov ecx, dword ptr fs:[00000030h] 19_2_0436B8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0436B8D0 mov eax, dword ptr fs:[00000030h] 19_2_0436B8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0436B8D0 mov eax, dword ptr fs:[00000030h] 19_2_0436B8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0436B8D0 mov eax, dword ptr fs:[00000030h] 19_2_0436B8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0436B8D0 mov eax, dword ptr fs:[00000030h] 19_2_0436B8D0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A8CD6 mov eax, dword ptr fs:[00000030h] 19_2_043A8CD6
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0435A537 mov eax, dword ptr fs:[00000030h] 19_2_0435A537
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430513A mov eax, dword ptr fs:[00000030h] 19_2_0430513A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430513A mov eax, dword ptr fs:[00000030h] 19_2_0430513A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04304D3B mov eax, dword ptr fs:[00000030h] 19_2_04304D3B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04304D3B mov eax, dword ptr fs:[00000030h] 19_2_04304D3B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04304D3B mov eax, dword ptr fs:[00000030h] 19_2_04304D3B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A8D34 mov eax, dword ptr fs:[00000030h] 19_2_043A8D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042F4120 mov eax, dword ptr fs:[00000030h] 19_2_042F4120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042F4120 mov eax, dword ptr fs:[00000030h] 19_2_042F4120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042F4120 mov eax, dword ptr fs:[00000030h] 19_2_042F4120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042F4120 mov eax, dword ptr fs:[00000030h] 19_2_042F4120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042F4120 mov ecx, dword ptr fs:[00000030h] 19_2_042F4120
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h] 19_2_042E3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h] 19_2_042E3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h] 19_2_042E3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h] 19_2_042E3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h] 19_2_042E3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h] 19_2_042E3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h] 19_2_042E3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h] 19_2_042E3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h] 19_2_042E3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h] 19_2_042E3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h] 19_2_042E3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h] 19_2_042E3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h] 19_2_042E3D34
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DAD30 mov eax, dword ptr fs:[00000030h] 19_2_042DAD30
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D9100 mov eax, dword ptr fs:[00000030h] 19_2_042D9100
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D9100 mov eax, dword ptr fs:[00000030h] 19_2_042D9100
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D9100 mov eax, dword ptr fs:[00000030h] 19_2_042D9100
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DC962 mov eax, dword ptr fs:[00000030h] 19_2_042DC962
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042FC577 mov eax, dword ptr fs:[00000030h] 19_2_042FC577
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042FC577 mov eax, dword ptr fs:[00000030h] 19_2_042FC577
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DB171 mov eax, dword ptr fs:[00000030h] 19_2_042DB171
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DB171 mov eax, dword ptr fs:[00000030h] 19_2_042DB171
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042FB944 mov eax, dword ptr fs:[00000030h] 19_2_042FB944
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042FB944 mov eax, dword ptr fs:[00000030h] 19_2_042FB944
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04313D43 mov eax, dword ptr fs:[00000030h] 19_2_04313D43
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04353540 mov eax, dword ptr fs:[00000030h] 19_2_04353540
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042F7D50 mov eax, dword ptr fs:[00000030h] 19_2_042F7D50
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04301DB5 mov eax, dword ptr fs:[00000030h] 19_2_04301DB5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04301DB5 mov eax, dword ptr fs:[00000030h] 19_2_04301DB5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04301DB5 mov eax, dword ptr fs:[00000030h] 19_2_04301DB5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043551BE mov eax, dword ptr fs:[00000030h] 19_2_043551BE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043551BE mov eax, dword ptr fs:[00000030h] 19_2_043551BE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043551BE mov eax, dword ptr fs:[00000030h] 19_2_043551BE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043551BE mov eax, dword ptr fs:[00000030h] 19_2_043551BE
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043061A0 mov eax, dword ptr fs:[00000030h] 19_2_043061A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043061A0 mov eax, dword ptr fs:[00000030h] 19_2_043061A0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043035A1 mov eax, dword ptr fs:[00000030h] 19_2_043035A1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043569A6 mov eax, dword ptr fs:[00000030h] 19_2_043569A6
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A05AC mov eax, dword ptr fs:[00000030h] 19_2_043A05AC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A05AC mov eax, dword ptr fs:[00000030h] 19_2_043A05AC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04302990 mov eax, dword ptr fs:[00000030h] 19_2_04302990
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D2D8A mov eax, dword ptr fs:[00000030h] 19_2_042D2D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D2D8A mov eax, dword ptr fs:[00000030h] 19_2_042D2D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D2D8A mov eax, dword ptr fs:[00000030h] 19_2_042D2D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D2D8A mov eax, dword ptr fs:[00000030h] 19_2_042D2D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D2D8A mov eax, dword ptr fs:[00000030h] 19_2_042D2D8A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430FD9B mov eax, dword ptr fs:[00000030h] 19_2_0430FD9B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430FD9B mov eax, dword ptr fs:[00000030h] 19_2_0430FD9B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042FC182 mov eax, dword ptr fs:[00000030h] 19_2_042FC182
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04302581 mov eax, dword ptr fs:[00000030h] 19_2_04302581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04302581 mov eax, dword ptr fs:[00000030h] 19_2_04302581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04302581 mov eax, dword ptr fs:[00000030h] 19_2_04302581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04302581 mov eax, dword ptr fs:[00000030h] 19_2_04302581
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430A185 mov eax, dword ptr fs:[00000030h] 19_2_0430A185
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04388DF1 mov eax, dword ptr fs:[00000030h] 19_2_04388DF1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DB1E1 mov eax, dword ptr fs:[00000030h] 19_2_042DB1E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DB1E1 mov eax, dword ptr fs:[00000030h] 19_2_042DB1E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DB1E1 mov eax, dword ptr fs:[00000030h] 19_2_042DB1E1
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042ED5E0 mov eax, dword ptr fs:[00000030h] 19_2_042ED5E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042ED5E0 mov eax, dword ptr fs:[00000030h] 19_2_042ED5E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043641E8 mov eax, dword ptr fs:[00000030h] 19_2_043641E8
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04356DC9 mov eax, dword ptr fs:[00000030h] 19_2_04356DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04356DC9 mov eax, dword ptr fs:[00000030h] 19_2_04356DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04356DC9 mov eax, dword ptr fs:[00000030h] 19_2_04356DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04356DC9 mov ecx, dword ptr fs:[00000030h] 19_2_04356DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04356DC9 mov eax, dword ptr fs:[00000030h] 19_2_04356DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04356DC9 mov eax, dword ptr fs:[00000030h] 19_2_04356DC9
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0438FE3F mov eax, dword ptr fs:[00000030h] 19_2_0438FE3F
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DE620 mov eax, dword ptr fs:[00000030h] 19_2_042DE620
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04314A2C mov eax, dword ptr fs:[00000030h] 19_2_04314A2C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04314A2C mov eax, dword ptr fs:[00000030h] 19_2_04314A2C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E8A0A mov eax, dword ptr fs:[00000030h] 19_2_042E8A0A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430A61C mov eax, dword ptr fs:[00000030h] 19_2_0430A61C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430A61C mov eax, dword ptr fs:[00000030h] 19_2_0430A61C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DC600 mov eax, dword ptr fs:[00000030h] 19_2_042DC600
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DC600 mov eax, dword ptr fs:[00000030h] 19_2_042DC600
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DC600 mov eax, dword ptr fs:[00000030h] 19_2_042DC600
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04308E00 mov eax, dword ptr fs:[00000030h] 19_2_04308E00
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04391608 mov eax, dword ptr fs:[00000030h] 19_2_04391608
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042F3A1C mov eax, dword ptr fs:[00000030h] 19_2_042F3A1C
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DAA16 mov eax, dword ptr fs:[00000030h] 19_2_042DAA16
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DAA16 mov eax, dword ptr fs:[00000030h] 19_2_042DAA16
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D5210 mov eax, dword ptr fs:[00000030h] 19_2_042D5210
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D5210 mov ecx, dword ptr fs:[00000030h] 19_2_042D5210
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D5210 mov eax, dword ptr fs:[00000030h] 19_2_042D5210
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D5210 mov eax, dword ptr fs:[00000030h] 19_2_042D5210
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E766D mov eax, dword ptr fs:[00000030h] 19_2_042E766D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0431927A mov eax, dword ptr fs:[00000030h] 19_2_0431927A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0438B260 mov eax, dword ptr fs:[00000030h] 19_2_0438B260
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0438B260 mov eax, dword ptr fs:[00000030h] 19_2_0438B260
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A8A62 mov eax, dword ptr fs:[00000030h] 19_2_043A8A62
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042FAE73 mov eax, dword ptr fs:[00000030h] 19_2_042FAE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042FAE73 mov eax, dword ptr fs:[00000030h] 19_2_042FAE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042FAE73 mov eax, dword ptr fs:[00000030h] 19_2_042FAE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042FAE73 mov eax, dword ptr fs:[00000030h] 19_2_042FAE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042FAE73 mov eax, dword ptr fs:[00000030h] 19_2_042FAE73
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04364257 mov eax, dword ptr fs:[00000030h] 19_2_04364257
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D9240 mov eax, dword ptr fs:[00000030h] 19_2_042D9240
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D9240 mov eax, dword ptr fs:[00000030h] 19_2_042D9240
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D9240 mov eax, dword ptr fs:[00000030h] 19_2_042D9240
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D9240 mov eax, dword ptr fs:[00000030h] 19_2_042D9240
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E7E41 mov eax, dword ptr fs:[00000030h] 19_2_042E7E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E7E41 mov eax, dword ptr fs:[00000030h] 19_2_042E7E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E7E41 mov eax, dword ptr fs:[00000030h] 19_2_042E7E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E7E41 mov eax, dword ptr fs:[00000030h] 19_2_042E7E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E7E41 mov eax, dword ptr fs:[00000030h] 19_2_042E7E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E7E41 mov eax, dword ptr fs:[00000030h] 19_2_042E7E41
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430FAB0 mov eax, dword ptr fs:[00000030h] 19_2_0430FAB0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D52A5 mov eax, dword ptr fs:[00000030h] 19_2_042D52A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D52A5 mov eax, dword ptr fs:[00000030h] 19_2_042D52A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D52A5 mov eax, dword ptr fs:[00000030h] 19_2_042D52A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D52A5 mov eax, dword ptr fs:[00000030h] 19_2_042D52A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D52A5 mov eax, dword ptr fs:[00000030h] 19_2_042D52A5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043546A7 mov eax, dword ptr fs:[00000030h] 19_2_043546A7
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042EAAB0 mov eax, dword ptr fs:[00000030h] 19_2_042EAAB0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042EAAB0 mov eax, dword ptr fs:[00000030h] 19_2_042EAAB0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A0EA5 mov eax, dword ptr fs:[00000030h] 19_2_043A0EA5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A0EA5 mov eax, dword ptr fs:[00000030h] 19_2_043A0EA5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A0EA5 mov eax, dword ptr fs:[00000030h] 19_2_043A0EA5
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430D294 mov eax, dword ptr fs:[00000030h] 19_2_0430D294
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430D294 mov eax, dword ptr fs:[00000030h] 19_2_0430D294
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0436FE87 mov eax, dword ptr fs:[00000030h] 19_2_0436FE87
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042E76E2 mov eax, dword ptr fs:[00000030h] 19_2_042E76E2
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043016E0 mov ecx, dword ptr fs:[00000030h] 19_2_043016E0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04302AE4 mov eax, dword ptr fs:[00000030h] 19_2_04302AE4
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A8ED6 mov eax, dword ptr fs:[00000030h] 19_2_043A8ED6
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04318EC7 mov eax, dword ptr fs:[00000030h] 19_2_04318EC7
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0438FEC0 mov eax, dword ptr fs:[00000030h] 19_2_0438FEC0
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04302ACB mov eax, dword ptr fs:[00000030h] 19_2_04302ACB
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043036CC mov eax, dword ptr fs:[00000030h] 19_2_043036CC
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430E730 mov eax, dword ptr fs:[00000030h] 19_2_0430E730
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D4F2E mov eax, dword ptr fs:[00000030h] 19_2_042D4F2E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042D4F2E mov eax, dword ptr fs:[00000030h] 19_2_042D4F2E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0439131B mov eax, dword ptr fs:[00000030h] 19_2_0439131B
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0436FF10 mov eax, dword ptr fs:[00000030h] 19_2_0436FF10
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0436FF10 mov eax, dword ptr fs:[00000030h] 19_2_0436FF10
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A070D mov eax, dword ptr fs:[00000030h] 19_2_043A070D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_043A070D mov eax, dword ptr fs:[00000030h] 19_2_043A070D
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042FF716 mov eax, dword ptr fs:[00000030h] 19_2_042FF716
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430A70E mov eax, dword ptr fs:[00000030h] 19_2_0430A70E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_0430A70E mov eax, dword ptr fs:[00000030h] 19_2_0430A70E
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04303B7A mov eax, dword ptr fs:[00000030h] 19_2_04303B7A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_04303B7A mov eax, dword ptr fs:[00000030h] 19_2_04303B7A
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 19_2_042DDB60 mov ecx, dword ptr fs:[00000030h] 19_2_042DDB60
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\DpiScaling.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\logagent.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\DpiScaling.exe Code function: 7_2_04759540 NtReadFile,LdrInitializeThunk, 7_2_04759540

HIPS / PFW / Operating System Protection Evasion
barindex
Sample uses process hollowing technique
Source: C:\Windows\SysWOW64\DpiScaling.exe Section unmapped: C:\Windows\SysWOW64\cscript.exe base address: 9F0000 Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section unmapped: C:\Windows\SysWOW64\msiexec.exe base address: DF0000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Section loaded: unknown target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\logagent.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\logagent.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 690000 Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 6A0000 Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 140000 Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 150000 Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory written: C:\Windows\SysWOW64\logagent.exe base: 72480000 Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory written: C:\Windows\SysWOW64\logagent.exe base: D80000 Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory written: C:\Windows\SysWOW64\logagent.exe base: D90000 Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 690000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 6A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 140000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 150000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 72480000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: C:\Windows\SysWOW64\logagent.exe base: D80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory allocated: C:\Windows\SysWOW64\logagent.exe base: D90000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Memory written: C:\Windows\SysWOW64\logagent.exe base: 72480000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\DpiScaling.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\DpiScaling.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Windows\SysWOW64\DpiScaling.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Windows\SysWOW64\logagent.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Windows\SysWOW64\logagent.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Thread register set: target process: 3352 Jump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Thread created: C:\Windows\SysWOW64\DpiScaling.exe EIP: 6A0000 Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Thread created: C:\Windows\SysWOW64\DpiScaling.exe EIP: 150000 Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Thread created: C:\Windows\SysWOW64\logagent.exe EIP: D90000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\7AYsP32Q7Y.exe Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe Jump to behavior
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe Jump to behavior
Source: explorer.exe, 00000008.00000000.388552936.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.407078346.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.436325364.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.510076819.0000000000B68000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progman\Pr
Source: explorer.exe, 00000008.00000000.388839849.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.437001992.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.407437943.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.511597253.00000000011E0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000008.00000000.409960799.0000000005E10000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.388839849.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.444658827.0000000005E10000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.437001992.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.407437943.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.511597253.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.392134127.0000000005E10000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000000.388839849.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.437001992.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.407437943.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.511597253.00000000011E0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000008.00000000.388839849.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.437001992.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.407437943.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.511597253.00000000011E0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000008.00000000.462908991.000000000875B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.396887667.0000000008778000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.421067968.000000000875B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWndh
Source: C:\Users\user\Contacts\Iodqgrdelf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 562059 Sample: 7AYsP32Q7Y Startdate: 28/01/2022 Architecture: WINDOWS Score: 100 39 www.graffity-aws.com 2->39 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 Multi AV Scanner detection for submitted file 2->63 65 2 other signatures 2->65 10 7AYsP32Q7Y.exe 1 17 2->10         started        signatures3 process4 dnsIp5 53 vru2ia.am.files.1drv.com 10->53 55 onedrive.live.com 10->55 57 am-files.fe.1drv.com 10->57 35 C:\Users\user\Contacts\Iodqgrdelf.exe, PE32 10->35 dropped 37 C:\Users\...\Iodqgrdelf.exe:Zone.Identifier, ASCII 10->37 dropped 83 Writes to foreign memory regions 10->83 85 Allocates memory in foreign processes 10->85 87 Creates a thread in another existing process (thread injection) 10->87 89 Injects a PE file into a foreign processes 10->89 15 DpiScaling.exe 10->15         started        file6 signatures7 process8 signatures9 99 Modifies the context of a thread in another process (thread injection) 15->99 101 Maps a DLL or memory area into another process 15->101 103 Sample uses process hollowing technique 15->103 105 2 other signatures 15->105 18 explorer.exe 2 15->18 injected process10 process11 20 Iodqgrdelf.exe 15 18->20         started        24 Iodqgrdelf.exe 15 18->24         started        26 msiexec.exe 18->26         started        28 2 other processes 18->28 dnsIp12 41 vru2ia.am.files.1drv.com 20->41 43 onedrive.live.com 20->43 45 am-files.fe.1drv.com 20->45 67 Multi AV Scanner detection for dropped file 20->67 69 Writes to foreign memory regions 20->69 71 Allocates memory in foreign processes 20->71 30 DpiScaling.exe 20->30         started        47 vru2ia.am.files.1drv.com 24->47 49 onedrive.live.com 24->49 51 am-files.fe.1drv.com 24->51 73 Creates a thread in another existing process (thread injection) 24->73 75 Injects a PE file into a foreign processes 24->75 33 logagent.exe 24->33         started        77 Modifies the context of a thread in another process (thread injection) 26->77 79 Maps a DLL or memory area into another process 26->79 81 Tries to detect virtualization through RDTSC time measurements 28->81 signatures13 process14 signatures15 91 Modifies the context of a thread in another process (thread injection) 30->91 93 Maps a DLL or memory area into another process 30->93 95 Sample uses process hollowing technique 30->95 97 Tries to detect virtualization through RDTSC time measurements 33->97
⊘No contacted IP infos

Contacted Domains

Name IP Active
onedrive.live.com unknown unknown
vru2ia.am.files.1drv.com unknown unknown
www.graffity-aws.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.fyonkaly.com/ahc8/ true
  • Avira URL Cloud: safe
 low