Windows Analysis Report
Copie a bonului de plata.exe

Overview

General Information

Sample Name: Copie a bonului de plata.exe
Analysis ID: 755986
MD5: eb8c68c29d6131d6b903dd268d6ff0ef
SHA1: 61dfb557d2e792229060bdeb21285f65daf48492
SHA256: d1798c288b296009d8049ca5364b29b079d59fadc870af65e92fe5fa23bdcec5
Tags: exeModiLoader
Infos:

Detection

FormBook, DBatLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected FormBook malware
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Sigma detected: Steal Google chrome login data
Antivirus / Scanner detection for submitted sample
Yara detected DBatLoader
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Tries to steal Mail credentials (via file / registry access)
Maps a DLL or memory area into another process
Writes to foreign memory regions
Machine Learning detection for sample
Allocates memory in foreign processes
Modifies the prolog of user mode functions (user mode inline hooks)
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Extensive use of GetProcAddress (often used to hide API calls)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Copie a bonului de plata.exe ReversingLabs: Detection: 19%
Source: Copie a bonului de plata.exe Virustotal: Detection: 25% Perma Link
Yara detected FormBook
Source: Yara match File source: 6.0.wscript.exe.10410000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.wscript.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.368934423.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.300982694.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.514213076.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.363700003.0000000004E70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.301779661.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.260531980.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.265578930.0000000004B07000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.511910785.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.367412831.0000000000AF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.362672301.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.259676945.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.514481833.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.301417348.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.300560859.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.333241932.00000000100D9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.349866867.00000000052F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.265182733.0000000004A77000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.363506192.0000000004E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.350083246.00000000060B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.259327533.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.260096262.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.305721420.00000000046D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Antivirus / Scanner detection for submitted sample
Source: Copie a bonului de plata.exe Avira: detected
Antivirus detection for URL or domain
Source: http://www.jam-nins.com/3nop/?lR-DA=FNGt6FUR7BoC+Wk2mT/OXzHG9rfZBcI/fjySAuf4KaFOaHLtldhTTP3Ojf6osS08NYIgkgrbcw==&5j=6leTg0VPe4i Avira URL Cloud: Label: malware
Source: http://www.stillwatersagawork.com/3nop/?lR-DA=uizPEf3ZCIKf+0vjz41ZIbJXQmeLMi3XcgBA4XxBdLh6ZlOYX2KmQQVjEXygOMnK9OyVSVhb/w==&5j=6leTg0VPe4i Avira URL Cloud: Label: malware
Source: http://www.stillwatersagawork.com/3nop/ Avira URL Cloud: Label: malware
Source: www.xctech.world/3nop/ Avira URL Cloud: Label: malware
Source: http://www.jam-nins.com/3nop/ Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Avira: detection malicious, Label: HEUR/AGEN.1214697
Multi AV Scanner detection for dropped file
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe ReversingLabs: Detection: 19%
Machine Learning detection for sample
Source: Copie a bonului de plata.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 6.0.wscript.exe.10410000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.0.wscript.exe.10410000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.0.colorcpl.exe.10410000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.0.wscript.exe.10410000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.0.colorcpl.exe.10410000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.0.colorcpl.exe.10410000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.Copie a bonului de plata.exe.22b0000.0.unpack Avira: Label: TR/Hijacker.Gen
Source: 6.2.wscript.exe.10410000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.colorcpl.exe.10410000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.Copie a bonului de plata.exe.2381218.1.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.0.colorcpl.exe.10410000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.0.wscript.exe.10410000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.Copie a bonului de plata.exe.2a4eed8.3.unpack Avira: Label: TR/Patched.Ren.Gen
Source: Copie a bonului de plata.exe Malware Configuration Extractor: DBatLoader {"Download Url": "https://onedrive.live.com/download?cid=E0CF7F9E6AAF27EF&resid=E0CF7F9E6AAF27EF%21845&authkey=AIl8u0Az19Gihis"}
Source: 00000006.00000000.301779661.0000000010410000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.xctech.world/3nop/"], "decoy": ["slot999.site", "hagsahoy.com", "howdyart.com", "orders-marketplace.com", "ranaa.email", "masterlink.guru", "archershut.com", "weikumcommunications.com", "dphardmoney.com", "shjyutie.com", "vivaberlin.net", "mycto.today", "curvygirlugc.com", "otnmp.cfd", "alwrists.com", "propercandlecompany.com", "allindustry-bg.com", "theyoungbizacademy.com", "expand658170.com", "leslainesdumouchon.com", "suptisa.com", "picnic-in-andong.com", "wanligui.com", "cesarjunaro.com", "kuxita.xyz", "simpkecpr.com", "microsoftsecuritys.com", "responsefactor.com", "polyggroup.com", "talonxmfg.biz", "jam-nins.com", "picuar.com", "familysafehidingplaces.com", "centericehockey.com", "appleidd.info", "igctsansculottism.sbs", "guiaestilosaude.online", "happysscribe.com", "tizzbizz.com", "qcorretor.com", "baremaster.online", "liputanlima.com", "ontherighttrack.systems", "zzza002.xyz", "k-aashirwaad.com", "stillwatersagawork.com", "skindoze.com", "asdjmhfg.xyz", "refaccionariafgnogales.com", "hunn.pro", "tlland.group", "homebizen.com", "newszi.xyz", "nicetimecafe.net", "qdbs.cloud", "ebtl.wtf", "dchasss.com", "kijangjantan.tech", "elegant-story.com", "glimtmedia.com", "1dot.online", "neatneighborncclean.com", "marionarzel.com", "app-arthrex.com"]}
Uses 32bit PE files
Source: Copie a bonului de plata.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: Binary string: wscript.pdbGCTL source: raserver.exe, 0000000C.00000002.512852357.000000000350C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msdt.pdbGCTL source: colorcpl.exe, 00000001.00000003.348121758.0000000006EED000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.368317281.0000000006EE0000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000001.00000003.350062669.0000000007060000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: colorcpl.exe, 00000001.00000002.366633984.0000000006BEF000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000003.260868670.0000000004D32000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.365212596.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000003.263091700.0000000004EC3000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.352157923.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.304946943.000000000615C000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.302242864.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.359504480.000000000640F000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000003.351499874.000000000502F000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000002.515150985.00000000051D0000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000003.348906326.0000000004E88000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000002.516595785.00000000052EF000.00000040.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000002.368989894.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000003.361406889.0000000004AD7000.00000004.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000003.364909249.0000000004C86000.00000004.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000002.370239187.0000000004F3F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: colorcpl.exe, colorcpl.exe, 00000001.00000002.366633984.0000000006BEF000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000003.260868670.0000000004D32000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.365212596.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000003.263091700.0000000004EC3000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.352157923.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.304946943.000000000615C000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.302242864.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.359504480.000000000640F000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000003.351499874.000000000502F000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000002.515150985.00000000051D0000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000003.348906326.0000000004E88000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000002.516595785.00000000052EF000.00000040.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000002.368989894.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000003.361406889.0000000004AD7000.00000004.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000003.364909249.0000000004C86000.00000004.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000002.370239187.0000000004F3F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: RAServer.pdb source: wscript.exe, 00000006.00000002.352000836.00000000062A0000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: wscript.pdb source: raserver.exe, 0000000C.00000002.512852357.000000000350C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RAServer.pdbGCTL source: wscript.exe, 00000006.00000002.352000836.00000000062A0000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: msdt.pdb source: colorcpl.exe, 00000001.00000003.348121758.0000000006EED000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.368317281.0000000006EE0000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000001.00000003.350062669.0000000007060000.00000004.00000800.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022B5B48 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 0_2_022B5B48

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.jam-nins.com
Source: C:\Windows\explorer.exe Network Connect: 212.32.237.90 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.stillwatersagawork.com
Source: C:\Windows\explorer.exe Network Connect: 5.183.8.25 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.xctech.world/3nop/
Source: Malware configuration extractor URLs: https://onedrive.live.com/download?cid=E0CF7F9E6AAF27EF&resid=E0CF7F9E6AAF27EF%21845&authkey=AIl8u0Az19Gihis
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: INTERXSCH INTERXSCH
Source: Joe Sandbox View ASN Name: LEASEWEB-NL-AMS-01NetherlandsNL LEASEWEB-NL-AMS-01NetherlandsNL
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /3nop/?lR-DA=FNGt6FUR7BoC+Wk2mT/OXzHG9rfZBcI/fjySAuf4KaFOaHLtldhTTP3Ojf6osS08NYIgkgrbcw==&5j=6leTg0VPe4i HTTP/1.1Host: www.jam-nins.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /3nop/?lR-DA=uizPEf3ZCIKf+0vjz41ZIbJXQmeLMi3XcgBA4XxBdLh6ZlOYX2KmQQVjEXygOMnK9OyVSVhb/w==&5j=6leTg0VPe4i HTTP/1.1Host: www.stillwatersagawork.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 212.32.237.90 212.32.237.90
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /3nop/ HTTP/1.1Host: www.jam-nins.comConnection: closeContent-Length: 164463Cache-Control: no-cacheOrigin: http://www.jam-nins.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.jam-nins.com/3nop/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 6c 52 2d 44 41 3d 4e 76 4b 58 6b 69 6b 63 36 43 6c 77 6f 55 74 64 6e 6b 6d 50 4c 58 58 47 39 4f 76 51 44 4f 52 34 4e 57 6a 58 63 4d 69 6a 44 66 4e 31 52 30 37 4a 76 73 6f 4b 58 6f 4b 4a 28 50 4f 76 35 78 4a 6c 56 34 34 35 6a 53 4c 77 66 77 73 6d 31 67 74 37 72 35 6b 71 35 58 66 74 72 53 61 4a 31 46 59 4e 55 50 77 61 43 57 5a 51 4b 47 51 52 79 64 7a 32 36 4f 71 43 74 44 38 68 6b 34 4a 63 42 66 71 4b 34 77 47 55 67 38 49 58 73 73 59 65 77 4b 79 50 6e 37 57 57 59 68 44 58 6b 4a 49 47 69 54 38 4d 50 68 6c 79 38 4d 43 35 44 48 33 52 7e 77 77 4a 76 38 44 5f 6a 44 39 76 6d 45 33 37 34 45 45 78 61 42 33 50 6c 48 30 6c 31 4d 71 55 46 70 32 46 76 4e 6a 43 30 4d 72 75 6a 58 67 48 49 35 51 79 79 4b 64 73 6c 67 78 73 4f 44 32 4c 48 4b 74 69 59 4d 79 42 30 75 7e 62 73 6c 70 4d 71 4e 4c 74 6c 5f 59 70 58 63 48 77 4b 4b 33 47 7e 31 48 55 41 4a 70 4b 36 4c 39 4e 78 52 4c 73 52 63 4c 6d 52 51 43 46 6b 73 7a 64 68 53 46 5f 49 6c 73 46 4d 37 34 4b 70 34 76 48 44 38 6b 41 76 64 71 7a 65 42 62 66 43 43 43 4b 58 74 6a 48 4f 55 38 7a 62 74 39 73 4b 39 66 31 76 52 6b 4a 34 39 56 69 34 58 76 47 75 5f 64 59 69 45 45 5a 4a 77 49 58 77 75 4a 6d 62 52 75 4c 68 43 78 5a 66 72 28 48 39 53 47 79 36 4b 7a 38 4b 30 46 58 6f 65 41 5f 42 66 42 48 58 4c 6f 42 7e 30 33 4f 68 2d 6c 50 51 64 34 43 43 2d 4a 79 33 6f 63 77 6c 59 62 5a 46 4e 7a 6a 74 42 71 52 72 72 44 69 79 69 6c 7a 38 66 78 57 59 61 42 66 36 4e 74 53 47 58 32 4c 4c 5a 55 6f 42 41 39 6d 6a 77 47 59 32 58 71 71 47 7a 6c 47 35 45 47 71 64 30 4d 78 32 71 51 62 77 41 38 6e 78 70 61 53 30 79 73 79 4c 65 66 49 70 77 50 57 4c 56 6c 57 6c 41 6d 6f 58 5f 70 55 4a 38 6f 73 6e 39 38 43 47 78 30 31 72 65 70 44 59 43 6d 61 66 33 35 2d 62 52 32 37 48 72 50 6b 47 79 57 46 6b 50 33 32 69 36 77 67 68 79 69 31 7a 77 58 39 6c 6d 46 5a 4e 73 33 74 36 69 4d 63 57 47 38 71 47 57 6d 50 61 6d 4e 44 4f 6a 36 66 73 4d 46 63 73 45 4f 7a 67 49 67 67 74 50 53 63 4d 5a 45 4d 50 62 4c 36 4b 32 30 6c 31 45 6c 38 6d 54 51 6a 57 6a 28 45 51 43 69 7a 28 4f 6b 62 51 4b 49 46 65 66 74 43 7a 52 50 48 75 7a 41 75 34 6e 53 5f 54 46 67 38 61 63 75 65 5a 6e 47 6a 31 6b 72 32 30 34 65 35 68 45 6b 33 32 4e 6d 79 77 64 39 45 6e 46 6f 35 36 43 63 72 39 52 49 74 4d 34 47 61 6e 32 4b 77 79 41 4f 7a 73 73 7e 66 35 66 35 6b 4d 79 53 31 49 4d 69 57 74 35 43 66 32 64 64 7a 63 32 66 76 42 5a 78 43 72 35 4c 46 50 6f 62 69 30 50 28 78 7e 30 45 45 77 71 45 70 6c 6f 7e 62 6f 6e 48 32 5a 6f 70 45 32 56 7a 35 33 50 61 4a 66 65 67 46 70 34 68 63 4e 4a 61 6c 78 52 62 4a 56 76 6c 44 71 76 36 30 5a 75 6d 72 51 62 4d 43 46 6f 47 51 69 72 69 77 39 6e 38 59 38 7a 39 70 33 50 57 35 4e 57 34 4c
Source: global traffic HTTP traffic detected: POST /3nop/ HTTP/1.1Host: www.stillwatersagawork.comConnection: closeContent-Length: 164463Cache-Control: no-cacheOrigin: http://www.stillwatersagawork.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.stillwatersagawork.com/3nop/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 6c 52 2d 44 41 3d 6d 41 28 31 61 37 4c 7a 4d 59 6d 65 28 6b 71 41 76 50 41 38 64 76 59 77 58 57 4f 56 62 54 76 53 5a 51 4d 58 67 48 59 66 54 36 31 4f 56 46 69 61 65 58 33 45 51 55 51 42 51 46 43 75 51 35 66 69 6c 62 7e 4c 61 32 4a 6c 70 32 56 37 69 44 66 73 43 73 45 66 31 47 6d 36 30 69 51 46 62 38 6f 37 4d 6f 36 6c 4b 6c 78 64 7e 4c 78 71 43 58 32 57 28 76 7e 65 42 64 48 50 5a 78 28 62 50 67 51 77 44 72 75 35 37 4d 62 2d 52 7a 74 78 4f 63 6f 47 6d 32 32 33 4c 45 62 62 72 74 67 44 31 4f 34 7a 55 41 71 32 74 5f 51 4d 48 4e 73 4c 39 4a 75 64 4d 4e 63 44 74 75 4d 67 50 31 63 44 4c 78 52 54 38 5a 6f 35 45 74 38 30 74 51 4a 52 4a 53 77 35 32 6b 66 58 61 30 64 38 71 6c 73 78 48 37 42 6b 34 32 67 44 56 45 41 77 38 6a 47 51 33 54 46 66 6c 41 73 32 49 71 65 68 31 74 4c 46 6f 49 28 62 28 75 61 61 71 65 76 78 31 43 45 79 54 44 50 32 76 72 46 70 68 66 76 35 28 44 62 44 76 42 78 52 78 78 46 70 6b 75 59 4b 72 32 73 39 70 53 41 2d 61 55 53 73 43 69 41 73 79 4f 4d 47 51 4c 50 56 52 6a 6f 51 62 54 7e 5f 72 4f 50 68 74 66 52 54 54 78 33 78 32 44 31 62 61 68 38 6a 44 70 48 54 61 56 73 71 49 64 53 35 42 31 63 6c 76 74 4b 2d 51 51 54 54 63 74 64 31 72 5f 76 6d 69 38 54 53 68 45 53 70 7e 31 61 75 45 69 74 39 50 45 78 7a 48 64 59 6a 42 42 76 77 58 5a 37 4e 47 56 69 61 54 72 74 53 71 35 6d 6b 66 45 79 49 70 58 6a 50 5a 6f 50 36 4e 44 42 5f 37 58 66 6c 4d 69 36 72 33 4a 36 30 53 30 75 41 6e 4e 67 63 74 72 36 5f 4a 6a 50 69 45 54 47 6a 44 51 28 78 44 30 53 57 4a 59 61 6e 74 52 69 46 79 56 47 43 42 4a 76 56 41 5a 63 30 46 77 6d 4a 58 6e 6c 4d 64 74 4f 49 61 31 7a 61 72 67 59 76 37 70 41 7a 70 49 56 75 76 42 4a 49 6c 43 64 76 47 44 63 34 77 61 4b 48 33 78 37 58 75 6b 61 6b 64 38 63 64 58 65 53 6b 35 71 57 58 70 65 67 53 6a 52 76 53 45 41 49 7a 6a 44 4a 66 4e 36 6a 4a 73 30 56 56 4c 72 70 35 6d 31 78 53 4e 76 37 73 70 67 55 70 6b 61 67 79 36 7a 71 5a 36 6d 39 49 37 69 7e 78 47 6a 48 78 6a 57 72 35 45 63 38 5f 30 42 66 51 66 33 37 4f 36 47 47 61 68 42 33 78 70 71 33 67 37 2d 5a 48 7a 4a 72 58 6d 48 4f 6f 67 54 49 55 33 52 62 6f 78 39 50 69 6a 41 78 5a 43 57 51 44 52 56 58 6a 37 44 49 58 56 2d 77 46 37 68 54 66 50 73 4c 58 59 35 73 38 4a 72 35 7a 72 6c 47 4d 4f 6e 36 48 79 4a 77 31 76 38 30 56 33 6e 51 55 32 4b 43 32 62 4f 44 6b 6a 33 37 54 53 61 54 55 34 50 61 46 49 58 46 58 67 76 6b 45 73 6a 42 34 4b 33 4e 74 49 78 4d 43 74 58 44 36 5a 77 4a 50 4a 34 46 54 46 30 71 30 71 6a 70 45 6d 5a 62 43 41 53 79 62 74 79 4d 77 37 6a 6d 42 58 76 6e 78 38 41 32 34 53 70 71 6e 64 2d 50 41 31 38 45 4b 38 75 55 36 61 36 7e 47 55 53 7a 68 7a 43 32 45 4c 56 4a 39 35 56
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Nov 2022 11:49:31 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 278Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6a 61 6d 2d 6e 69 6e 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.jam-nins.com Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Nov 2022 11:49:34 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 278Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6a 61 6d 2d 6e 69 6e 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.jam-nins.com Port 80</address></body></html>
Source: Copie a bonului de plata.exe, 00000000.00000003.253118024.0000000000888000.00000004.00000020.00020000.00000000.sdmp, Copie a bonului de plata.exe, 00000000.00000003.254339483.0000000000893000.00000004.00000020.00020000.00000000.sdmp, Copie a bonului de plata.exe, 00000000.00000002.261713677.0000000000894000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: raserver.exe, 0000000C.00000002.517969602.0000000005BEF000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://survey-smiles.com
Source: explorer.exe, 00000002.00000000.339391657.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.265456363.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.325519457.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.307576033.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.327025987.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.300998928.0000000008442000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: raserver.exe, 0000000C.00000002.517559998.0000000005879000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://www.stillwatersagawork.com
Source: raserver.exe, 0000000C.00000002.517559998.0000000005879000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://www.stillwatersagawork.com/3nop/
Source: Copie a bonului de plata.exe, 00000000.00000002.261332912.000000000082F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/
Source: Copie a bonului de plata.exe, 00000000.00000002.261332912.000000000082F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/download?cid=E0CF7F9E6AAF27EF&resid=E0CF7F9E6AAF27EF%21845&authkey=AIl8u0A
Source: Copie a bonului de plata.exe, 00000000.00000003.254351119.000000000089D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ppq0oq.ph.files.1drv.com/
Source: Copie a bonului de plata.exe, 00000000.00000003.254351119.000000000089D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ppq0oq.ph.files.1drv.com/t
Source: Copie a bonului de plata.exe, 00000000.00000003.253118024.0000000000888000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ppq0oq.ph.files.1drv.com/y
Source: Copie a bonului de plata.exe, 00000000.00000002.261332912.000000000082F000.00000004.00000020.00020000.00000000.sdmp, Copie a bonului de plata.exe, 00000000.00000002.261941242.00000000008CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ppq0oq.ph.files.1drv.com/y4mSOYNl8PReN028zDgtLGTbNYcgZC2HyHGQN3fPTRemBgwyzYyJn9Rzn0pByB78UZm
Source: Copie a bonului de plata.exe, 00000000.00000003.254351119.000000000089D000.00000004.00000020.00020000.00000000.sdmp, Copie a bonului de plata.exe, 00000000.00000002.261332912.000000000082F000.00000004.00000020.00020000.00000000.sdmp, Copie a bonului de plata.exe, 00000000.00000002.261941242.00000000008CC000.00000004.00000020.00020000.00000000.sdmp, Copie a bonului de plata.exe, 00000000.00000003.253162647.00000000008D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ppq0oq.ph.files.1drv.com/y4mTq5RZ8ohnMX6xf7NDPAPVNhWu7XDJIy7fIuYHyTqr4rWZJ8CBMittNjykZHXcnJ_
Source: unknown HTTP traffic detected: POST /3nop/ HTTP/1.1Host: www.jam-nins.comConnection: closeContent-Length: 164463Cache-Control: no-cacheOrigin: http://www.jam-nins.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.jam-nins.com/3nop/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 6c 52 2d 44 41 3d 4e 76 4b 58 6b 69 6b 63 36 43 6c 77 6f 55 74 64 6e 6b 6d 50 4c 58 58 47 39 4f 76 51 44 4f 52 34 4e 57 6a 58 63 4d 69 6a 44 66 4e 31 52 30 37 4a 76 73 6f 4b 58 6f 4b 4a 28 50 4f 76 35 78 4a 6c 56 34 34 35 6a 53 4c 77 66 77 73 6d 31 67 74 37 72 35 6b 71 35 58 66 74 72 53 61 4a 31 46 59 4e 55 50 77 61 43 57 5a 51 4b 47 51 52 79 64 7a 32 36 4f 71 43 74 44 38 68 6b 34 4a 63 42 66 71 4b 34 77 47 55 67 38 49 58 73 73 59 65 77 4b 79 50 6e 37 57 57 59 68 44 58 6b 4a 49 47 69 54 38 4d 50 68 6c 79 38 4d 43 35 44 48 33 52 7e 77 77 4a 76 38 44 5f 6a 44 39 76 6d 45 33 37 34 45 45 78 61 42 33 50 6c 48 30 6c 31 4d 71 55 46 70 32 46 76 4e 6a 43 30 4d 72 75 6a 58 67 48 49 35 51 79 79 4b 64 73 6c 67 78 73 4f 44 32 4c 48 4b 74 69 59 4d 79 42 30 75 7e 62 73 6c 70 4d 71 4e 4c 74 6c 5f 59 70 58 63 48 77 4b 4b 33 47 7e 31 48 55 41 4a 70 4b 36 4c 39 4e 78 52 4c 73 52 63 4c 6d 52 51 43 46 6b 73 7a 64 68 53 46 5f 49 6c 73 46 4d 37 34 4b 70 34 76 48 44 38 6b 41 76 64 71 7a 65 42 62 66 43 43 43 4b 58 74 6a 48 4f 55 38 7a 62 74 39 73 4b 39 66 31 76 52 6b 4a 34 39 56 69 34 58 76 47 75 5f 64 59 69 45 45 5a 4a 77 49 58 77 75 4a 6d 62 52 75 4c 68 43 78 5a 66 72 28 48 39 53 47 79 36 4b 7a 38 4b 30 46 58 6f 65 41 5f 42 66 42 48 58 4c 6f 42 7e 30 33 4f 68 2d 6c 50 51 64 34 43 43 2d 4a 79 33 6f 63 77 6c 59 62 5a 46 4e 7a 6a 74 42 71 52 72 72 44 69 79 69 6c 7a 38 66 78 57 59 61 42 66 36 4e 74 53 47 58 32 4c 4c 5a 55 6f 42 41 39 6d 6a 77 47 59 32 58 71 71 47 7a 6c 47 35 45 47 71 64 30 4d 78 32 71 51 62 77 41 38 6e 78 70 61 53 30 79 73 79 4c 65 66 49 70 77 50 57 4c 56 6c 57 6c 41 6d 6f 58 5f 70 55 4a 38 6f 73 6e 39 38 43 47 78 30 31 72 65 70 44 59 43 6d 61 66 33 35 2d 62 52 32 37 48 72 50 6b 47 79 57 46 6b 50 33 32 69 36 77 67 68 79 69 31 7a 77 58 39 6c 6d 46 5a 4e 73 33 74 36 69 4d 63 57 47 38 71 47 57 6d 50 61 6d 4e 44 4f 6a 36 66 73 4d 46 63 73 45 4f 7a 67 49 67 67 74 50 53 63 4d 5a 45 4d 50 62 4c 36 4b 32 30 6c 31 45 6c 38 6d 54 51 6a 57 6a 28 45 51 43 69 7a 28 4f 6b 62 51 4b 49 46 65 66 74 43 7a 52 50 48 75 7a 41 75 34 6e 53 5f 54 46 67 38 61 63 75 65 5a 6e 47 6a 31 6b 72 32 30 34 65 35 68 45 6b 33 32 4e 6d 79 77 64 39 45 6e 46 6f 35 36 43 63 72 39 52 49 74 4d 34 47 61 6e 32 4b 77 79 41 4f 7a 73 73 7e 66 35 66 35 6b 4d 79 53 31 49 4d 69 57 74 35 43 66 32 64 64 7a 63 32 66 76 42 5a 78 43 72 35 4c 46 50 6f 62 69 30 50 28 78 7e 30 45 45 77 71 45 70 6c 6f 7e 62 6f 6e 48 32 5a 6f 70 45 32 56 7a 35 33 50 61 4a 66 65 67 46 70 34 68 63 4e 4a 61 6c 78 52 62 4a 56 76 6c 44 71 76 36 30 5a 75 6d 72 51 62 4d 43 46 6f 47 51 69 72 69 77 39 6e 38 59 38 7a 39 70 33 50 57 35 4e 57 34 4c
Source: unknown DNS traffic detected: queries for: onedrive.live.com
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C8CBC InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle, 0_2_022C8CBC
Source: global traffic HTTP traffic detected: GET /3nop/?lR-DA=FNGt6FUR7BoC+Wk2mT/OXzHG9rfZBcI/fjySAuf4KaFOaHLtldhTTP3Ojf6osS08NYIgkgrbcw==&5j=6leTg0VPe4i HTTP/1.1Host: www.jam-nins.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /3nop/?lR-DA=uizPEf3ZCIKf+0vjz41ZIbJXQmeLMi3XcgBA4XxBdLh6ZlOYX2KmQQVjEXygOMnK9OyVSVhb/w==&5j=6leTg0VPe4i HTTP/1.1Host: www.stillwatersagawork.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Creates a DirectInput object (often for capturing keystrokes)
Source: Copie a bonului de plata.exe, 00000000.00000002.261271143.00000000007FA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 6.0.wscript.exe.10410000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.wscript.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.368934423.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.300982694.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.514213076.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.363700003.0000000004E70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.301779661.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.260531980.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.265578930.0000000004B07000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.511910785.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.367412831.0000000000AF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.362672301.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.259676945.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.514481833.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.301417348.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.300560859.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.333241932.00000000100D9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.349866867.00000000052F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.265182733.0000000004A77000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.363506192.0000000004E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.350083246.00000000060B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.259327533.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.260096262.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.305721420.00000000046D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Detected FormBook malware
Source: C:\Windows\SysWOW64\raserver.exe Dropped file: C:\Users\user\AppData\Roaming\9N30RODQ\9N3logri.ini Jump to dropped file
Source: C:\Windows\SysWOW64\raserver.exe Dropped file: C:\Users\user\AppData\Roaming\9N30RODQ\9N3logrv.ini Jump to dropped file
Malicious sample detected (through community Yara rule)
Source: 6.0.wscript.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.0.wscript.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.wscript.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.2.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.wscript.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.0.wscript.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.wscript.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.wscript.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.0.wscript.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.wscript.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.wscript.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.0.wscript.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.wscript.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.wscript.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.0.wscript.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.wscript.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.wscript.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.2.wscript.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.wscript.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.wscript.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.0.wscript.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.wscript.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.wscript.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.0.wscript.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.wscript.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.0.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.368934423.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.368934423.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.368934423.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.300982694.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000000.300982694.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.300982694.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.514213076.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.514213076.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.514213076.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.363700003.0000000004E70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.363700003.0000000004E70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.363700003.0000000004E70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.301779661.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000000.301779661.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.301779661.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.260531980.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000000.260531980.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.260531980.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.265578930.0000000004B07000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.265578930.0000000004B07000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.265578930.0000000004B07000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.511910785.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.511910785.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.511910785.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.367412831.0000000000AF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.367412831.0000000000AF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.367412831.0000000000AF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.362672301.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.362672301.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.362672301.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.259676945.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000000.259676945.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.259676945.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.514481833.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.514481833.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.514481833.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.301417348.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000000.301417348.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.301417348.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.300560859.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000000.300560859.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.300560859.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000000.333241932.00000000100D9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000000.333241932.00000000100D9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000000.333241932.00000000100D9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.349866867.00000000052F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.349866867.00000000052F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.349866867.00000000052F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.265182733.0000000004A77000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.265182733.0000000004A77000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.265182733.0000000004A77000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.363506192.0000000004E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.363506192.0000000004E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.363506192.0000000004E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.350083246.00000000060B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.350083246.00000000060B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.350083246.00000000060B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.259327533.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000000.259327533.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.259327533.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.260096262.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000000.260096262.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.260096262.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.305721420.00000000046D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.305721420.00000000046D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.305721420.00000000046D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: Copie a bonului de plata.exe PID: 5152, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: colorcpl.exe PID: 3556, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: Ndvmyrkf.exe PID: 5252, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: wscript.exe PID: 4648, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: raserver.exe PID: 3868, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: msdt.exe PID: 632, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Uses 32bit PE files
Source: Copie a bonului de plata.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Yara signature match
Source: 6.0.wscript.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.0.wscript.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.wscript.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.2.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.wscript.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.0.wscript.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.wscript.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.wscript.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.0.wscript.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.wscript.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.wscript.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.0.wscript.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.wscript.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.wscript.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.0.wscript.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.wscript.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.wscript.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.2.wscript.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.wscript.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.wscript.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.0.wscript.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.wscript.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.wscript.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.0.wscript.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.wscript.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.0.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.368934423.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.368934423.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.368934423.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.300982694.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000000.300982694.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.300982694.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.514213076.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.514213076.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.514213076.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.363700003.0000000004E70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.363700003.0000000004E70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.363700003.0000000004E70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.301779661.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000000.301779661.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.301779661.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.260531980.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000000.260531980.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.260531980.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.265578930.0000000004B07000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.265578930.0000000004B07000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.265578930.0000000004B07000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.511910785.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.511910785.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.511910785.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.367412831.0000000000AF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.367412831.0000000000AF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.367412831.0000000000AF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.362672301.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.362672301.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.362672301.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.259676945.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000000.259676945.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.259676945.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.514481833.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.514481833.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.514481833.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.301417348.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000000.301417348.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.301417348.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.300560859.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000000.300560859.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.300560859.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000000.333241932.00000000100D9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000000.333241932.00000000100D9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000000.333241932.00000000100D9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.349866867.00000000052F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.349866867.00000000052F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.349866867.00000000052F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.265182733.0000000004A77000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.265182733.0000000004A77000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.265182733.0000000004A77000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.363506192.0000000004E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.363506192.0000000004E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.363506192.0000000004E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.350083246.00000000060B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.350083246.00000000060B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.350083246.00000000060B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.259327533.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000000.259327533.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.259327533.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.260096262.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000000.260096262.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.260096262.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.305721420.00000000046D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.305721420.00000000046D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.305721420.00000000046D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: Copie a bonului de plata.exe PID: 5152, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: colorcpl.exe PID: 3556, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: Ndvmyrkf.exe PID: 5252, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: wscript.exe PID: 4648, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: raserver.exe PID: 3868, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: msdt.exe PID: 632, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: C:\Users\Public\Libraries\fkrymvdN.url, type: DROPPED Matched rule: Methodology_Shortcut_HotKey author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, score = 27.09.2019, reference = https://twitter.com/cglyer/status/1176184798248919044
Source: C:\Users\Public\Libraries\fkrymvdN.url, type: DROPPED Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, score = 27.09.2019, reference = https://twitter.com/cglyer/status/1176184798248919044
Detected potential crypto function
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022B20F4 0_2_022B20F4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC2EF7 1_2_06BC2EF7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B16E30 1_2_06B16E30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BBD616 1_2_06BBD616
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC1FF1 1_2_06BC1FF1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BCDFCE 1_2_06BCDFCE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4496 1_2_06BB4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0841F 1_2_06B0841F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BBD466 1_2_06BBD466
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B22581 1_2_06B22581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB2D82 1_2_06BB2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0D5E0 1_2_06B0D5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC25DD 1_2_06BC25DD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF0D20 1_2_06AF0D20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC2D07 1_2_06BC2D07
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC1D55 1_2_06BC1D55
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC22AE 1_2_06BC22AE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BAFA2B 1_2_06BAFA2B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2EBB0 1_2_06B2EBB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BA23E3 1_2_06BA23E3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB03DA 1_2_06BB03DA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BBDBD2 1_2_06BBDBD2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2ABD8 1_2_06B2ABD8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC2B28 1_2_06BC2B28
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1AB40 1_2_06B1AB40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B220A0 1_2_06B220A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC20A8 1_2_06BC20A8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0B090 1_2_06B0B090
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC28EC 1_2_06BC28EC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A830 1_2_06B1A830
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BCE824 1_2_06BCE824
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1002 1_2_06BB1002
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B199BF 1_2_06B199BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B14120 1_2_06B14120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFF900 1_2_06AFF900
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: String function: 022B4A98 appears 136 times
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: String function: 022B48A0 appears 60 times
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: String function: 022B4C24 appears 471 times
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: String function: 022B6908 appears 32 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 06AFB150 appears 133 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C9128 InetIsOffline,InetIsOffline,CopyFileA,WinExec,Sleep,OpenProcess,NtSuspendThread,InetIsOffline,ZwClose,InetIsOffline,InetIsOffline,ExitProcess, 0_2_022C9128
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C3690 LoadLibraryA,GetModuleHandleA,GetProcAddress,RtlMoveMemory,GetCurrentProcess,NtFlushVirtualMemory,FreeLibrary, 0_2_022C3690
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C779C InetIsOffline,VirtualAlloc,GetProcAddress,FreeLibrary,VirtualFree,VirtualAllocEx,GetProcAddress,FreeLibrary,WriteProcessMemory,NtProtectVirtualMemory, 0_2_022C779C
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022CC0D9 Sleep,DeleteFileA,DeleteFileA,DeleteFileA,DeleteFileA,DeleteFileA,DeleteFileA,WinExec,Sleep,OpenProcess,NtSuspendThread,InetIsOffline,ZwClose,InetIsOffline,InetIsOffline,ExitProcess, 0_2_022CC0D9
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C9128 InetIsOffline,InetIsOffline,CopyFileA,WinExec,Sleep,OpenProcess,NtSuspendThread,InetIsOffline,ZwClose,InetIsOffline,InetIsOffline,ExitProcess, 0_2_022C9128
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C368E LoadLibraryA,GetModuleHandleA,GetProcAddress,RtlMoveMemory,GetCurrentProcess,NtFlushVirtualMemory,FreeLibrary, 0_2_022C368E
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C773C InetIsOffline,VirtualAlloc,GetProcAddress,FreeLibrary,VirtualFree,VirtualAllocEx,GetProcAddress,FreeLibrary,WriteProcessMemory,NtProtectVirtualMemory, 0_2_022C773C
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C398E InetIsOffline,CreateProcessA,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,GetProcAddress,FreeLibrary,NtProtectVirtualMemory,SetThreadContext,NtResumeThread, 0_2_022C398E
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C3990 InetIsOffline,CreateProcessA,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,VirtualAllocEx,VirtualAllocEx,GetProcAddress,FreeLibrary,NtProtectVirtualMemory,SetThreadContext,NtResumeThread, 0_2_022C3990
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B396E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_06B396E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39660 NtAllocateVirtualMemory,LdrInitializeThunk, 1_2_06B39660
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B397A0 NtUnmapViewOfSection,LdrInitializeThunk, 1_2_06B397A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39780 NtMapViewOfSection,LdrInitializeThunk, 1_2_06B39780
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39710 NtQueryInformationToken,LdrInitializeThunk, 1_2_06B39710
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B395D0 NtClose,LdrInitializeThunk, 1_2_06B395D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39540 NtReadFile,LdrInitializeThunk, 1_2_06B39540
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39A20 NtResumeThread,LdrInitializeThunk, 1_2_06B39A20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39A00 NtProtectVirtualMemory,LdrInitializeThunk, 1_2_06B39A00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39A50 NtCreateFile,LdrInitializeThunk, 1_2_06B39A50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B398F0 NtReadVirtualMemory,LdrInitializeThunk, 1_2_06B398F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39860 NtQuerySystemInformation,LdrInitializeThunk, 1_2_06B39860
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39840 NtDelayExecution,LdrInitializeThunk, 1_2_06B39840
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B399A0 NtCreateSection,LdrInitializeThunk, 1_2_06B399A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39910 NtAdjustPrivilegesToken,LdrInitializeThunk, 1_2_06B39910
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B396D0 NtCreateKey, 1_2_06B396D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39610 NtEnumerateValueKey, 1_2_06B39610
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39670 NtQueryInformationProcess, 1_2_06B39670
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39650 NtQueryValueKey, 1_2_06B39650
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39FE0 NtCreateMutant, 1_2_06B39FE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39730 NtQueryVirtualMemory, 1_2_06B39730
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B3A710 NtOpenProcessToken, 1_2_06B3A710
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B3A770 NtOpenThread, 1_2_06B3A770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39770 NtSetInformationFile, 1_2_06B39770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39760 NtOpenProcess, 1_2_06B39760
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B395F0 NtQueryInformationFile, 1_2_06B395F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B3AD30 NtSetContextThread, 1_2_06B3AD30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39520 NtWaitForSingleObject, 1_2_06B39520
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39560 NtWriteFile, 1_2_06B39560
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39A80 NtOpenDirectoryObject, 1_2_06B39A80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39A10 NtQuerySection, 1_2_06B39A10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B3A3B0 NtGetContextThread, 1_2_06B3A3B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39B00 NtSetValueKey, 1_2_06B39B00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B398A0 NtWriteVirtualMemory, 1_2_06B398A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39820 NtEnumerateKey, 1_2_06B39820
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B3B040 NtSuspendThread, 1_2_06B3B040
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B399D0 NtCreateProcessEx, 1_2_06B399D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B39950 NtQueueApcThread, 1_2_06B39950
Tries to load missing DLLs
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Section loaded: amtahoo.dll Jump to behavior
Source: Copie a bonului de plata.exe ReversingLabs: Detection: 19%
Source: Copie a bonului de plata.exe Virustotal: Detection: 25%
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe File read: C:\Users\user\Desktop\Copie a bonului de plata.exe Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Copie a bonului de plata.exe C:\Users\user\Desktop\Copie a bonului de plata.exe
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\Public\Libraries\Ndvmyrkf.exe "C:\Users\Public\Libraries\Ndvmyrkf.exe"
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\System32\wscript.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\raserver.exe C:\Windows\SysWOW64\raserver.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\System32\wscript.exe Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\DB1
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@11/10@4/2
Source: C:\Windows\explorer.exe File read: C:\Users\user\AppData\Roaming\9N30RODQ\9N3logri.ini Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022B823A GetDiskFreeSpaceA, 0_2_022B823A
Source: cmd.exe, 0000000E.00000002.369426848.00000000025E7000.00000004.00001000.00020000.00000000.sdmp, DB1.14.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C5770 CreateToolhelp32Snapshot, 0_2_022C5770
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1808:120:WilError_01
Source: C:\Windows\SysWOW64\raserver.exe File written: C:\Users\user\AppData\Roaming\9N30RODQ\9N3logri.ini Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Window found: window name: SysTabControl32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\colorcpl.exe Window detected: Number of UI elements: 12
Source: C:\Windows\SysWOW64\raserver.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: Binary string: wscript.pdbGCTL source: raserver.exe, 0000000C.00000002.512852357.000000000350C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msdt.pdbGCTL source: colorcpl.exe, 00000001.00000003.348121758.0000000006EED000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.368317281.0000000006EE0000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000001.00000003.350062669.0000000007060000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: colorcpl.exe, 00000001.00000002.366633984.0000000006BEF000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000003.260868670.0000000004D32000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.365212596.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000003.263091700.0000000004EC3000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.352157923.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.304946943.000000000615C000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.302242864.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.359504480.000000000640F000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000003.351499874.000000000502F000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000002.515150985.00000000051D0000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000003.348906326.0000000004E88000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000002.516595785.00000000052EF000.00000040.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000002.368989894.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000003.361406889.0000000004AD7000.00000004.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000003.364909249.0000000004C86000.00000004.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000002.370239187.0000000004F3F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: colorcpl.exe, colorcpl.exe, 00000001.00000002.366633984.0000000006BEF000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000003.260868670.0000000004D32000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.365212596.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000003.263091700.0000000004EC3000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.352157923.00000000062F0000.00000040.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.304946943.000000000615C000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.302242864.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.359504480.000000000640F000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000003.351499874.000000000502F000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000002.515150985.00000000051D0000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000003.348906326.0000000004E88000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 0000000C.00000002.516595785.00000000052EF000.00000040.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000002.368989894.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000003.361406889.0000000004AD7000.00000004.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000003.364909249.0000000004C86000.00000004.00000800.00020000.00000000.sdmp, msdt.exe, 0000000D.00000002.370239187.0000000004F3F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: RAServer.pdb source: wscript.exe, 00000006.00000002.352000836.00000000062A0000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: wscript.pdb source: raserver.exe, 0000000C.00000002.512852357.000000000350C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RAServer.pdbGCTL source: wscript.exe, 00000006.00000002.352000836.00000000062A0000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: msdt.pdb source: colorcpl.exe, 00000001.00000003.348121758.0000000006EED000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.368317281.0000000006EE0000.00000040.10000000.00040000.00000000.sdmp, colorcpl.exe, 00000001.00000003.350062669.0000000007060000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
Yara detected DBatLoader
Source: Yara match File source: 0.2.Copie a bonului de plata.exe.22b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Copie a bonului de plata.exe.2a4eed8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Copie a bonului de plata.exe.2a4eed8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.262570610.0000000002320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.263522793.0000000002A4E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022CF2A4 push 022CF310h; ret 0_2_022CF308
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022CF0AC push 022CF125h; ret 0_2_022CF11D
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022CF144 push 022CF1ECh; ret 0_2_022CF1E4
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022CF1F8 push 022CF288h; ret 0_2_022CF280
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022BC718 push ecx; mov dword ptr [esp], edx 0_2_022BC71D
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022BD78C push 022BD7B8h; ret 0_2_022BD7B0
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C44AC push 022C44EEh; ret 0_2_022C44E6
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C5488 push 022C54F2h; ret 0_2_022C54EA
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C84FC push 022C8554h; ret 0_2_022C854C
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C84FB push 022C8554h; ret 0_2_022C854C
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C35A8 push 022C3653h; ret 0_2_022C364B
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C35A6 push 022C3653h; ret 0_2_022C364B
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022B65FA push 022B6657h; ret 0_2_022B664F
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022B65FC push 022B6657h; ret 0_2_022B664F
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022B6A48 push 022B6A8Ah; ret 0_2_022B6A82
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022BCB4C push 022BCFA2h; ret 0_2_022BCF9A
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022B3894 push eax; ret 0_2_022B38D0
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022BCE1C push 022BCFA2h; ret 0_2_022BCF9A
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022BFEA0 push 022BFF16h; ret 0_2_022BFF0E
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022BFFA3 push 022BFFF1h; ret 0_2_022BFFE9
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022BFFA4 push 022BFFF1h; ret 0_2_022BFFE9
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022CEC64 push 022CEE54h; ret 0_2_022CEE4C
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C8C58 push ecx; mov dword ptr [esp], edx 0_2_022C8C5D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B4D0D1 push ecx; ret 1_2_06B4D0E4
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C6388 InetIsOffline,VirtualAlloc,GetProcAddress,FreeLibrary,VirtualAlloc,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualAlloc,VirtualProtect,FreeLibrary, 0_2_022C6388
Drops PE files
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe File created: C:\Users\Public\Libraries\Ndvmyrkf.exe Jump to dropped file
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Ndvmyrkf Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Ndvmyrkf Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x82 0x2E 0xEF
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C54F4 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_022C54F4
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\SysWOW64\colorcpl.exe RDTSC instruction interceptor: First address: 0000000010419904 second address: 000000001041990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe RDTSC instruction interceptor: First address: 0000000010419B6E second address: 0000000010419B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wscript.exe RDTSC instruction interceptor: First address: 0000000010419904 second address: 000000001041990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wscript.exe RDTSC instruction interceptor: First address: 0000000010419B6E second address: 0000000010419B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe RDTSC instruction interceptor: First address: 0000000003209904 second address: 000000000320990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe RDTSC instruction interceptor: First address: 0000000003209B6E second address: 0000000003209B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe RDTSC instruction interceptor: First address: 0000000000AF9904 second address: 0000000000AF990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe RDTSC instruction interceptor: First address: 0000000000AF9B6E second address: 0000000000AF9B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 4524 Thread sleep time: -32000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\raserver.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B36DE6 rdtsc 1_2_06B36DE6
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\colorcpl.exe API coverage: 4.1 %
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022B5B48 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 0_2_022B5B48
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe API call chain: ExitProcess graph end node
Source: explorer.exe, 00000002.00000000.301771768.00000000084D8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.327394802.00000000045C6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.336060582.00000000081DD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000^
Source: explorer.exe, 00000002.00000000.275184696.0000000006710000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: explorer.exe, 00000002.00000000.309247395.000000000F3AB000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}.Mic
Source: Copie a bonului de plata.exe, 00000000.00000002.261388938.000000000086B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Copie a bonului de plata.exe, 00000000.00000002.261332912.000000000082F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0a
Source: explorer.exe, 00000002.00000000.298195474.0000000008304000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: Copie a bonului de plata.exe, 00000000.00000002.261388938.000000000086B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWe.com
Source: explorer.exe, 00000002.00000000.326378243.00000000082B2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000002.00000000.297738504.0000000008269000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>&
Source: Ndvmyrkf.exe, 00000003.00000002.302649199.0000000000771000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022C6388 InetIsOffline,VirtualAlloc,GetProcAddress,FreeLibrary,VirtualAlloc,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualAlloc,VirtualProtect,FreeLibrary, 0_2_022C6388
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B36DE6 rdtsc 1_2_06B36DE6
Enables debug privileges
Source: C:\Windows\SysWOW64\colorcpl.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B746A7 mov eax, dword ptr fs:[00000030h] 1_2_06B746A7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC0EA5 mov eax, dword ptr fs:[00000030h] 1_2_06BC0EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC0EA5 mov eax, dword ptr fs:[00000030h] 1_2_06BC0EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC0EA5 mov eax, dword ptr fs:[00000030h] 1_2_06BC0EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B8FE87 mov eax, dword ptr fs:[00000030h] 1_2_06B8FE87
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B216E0 mov ecx, dword ptr fs:[00000030h] 1_2_06B216E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B076E2 mov eax, dword ptr fs:[00000030h] 1_2_06B076E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC8ED6 mov eax, dword ptr fs:[00000030h] 1_2_06BC8ED6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B38EC7 mov eax, dword ptr fs:[00000030h] 1_2_06B38EC7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BAFEC0 mov eax, dword ptr fs:[00000030h] 1_2_06BAFEC0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B236CC mov eax, dword ptr fs:[00000030h] 1_2_06B236CC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BAFE3F mov eax, dword ptr fs:[00000030h] 1_2_06BAFE3F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFE620 mov eax, dword ptr fs:[00000030h] 1_2_06AFE620
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2A61C mov eax, dword ptr fs:[00000030h] 1_2_06B2A61C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2A61C mov eax, dword ptr fs:[00000030h] 1_2_06B2A61C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFC600 mov eax, dword ptr fs:[00000030h] 1_2_06AFC600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFC600 mov eax, dword ptr fs:[00000030h] 1_2_06AFC600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFC600 mov eax, dword ptr fs:[00000030h] 1_2_06AFC600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B28E00 mov eax, dword ptr fs:[00000030h] 1_2_06B28E00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1608 mov eax, dword ptr fs:[00000030h] 1_2_06BB1608
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1AE73 mov eax, dword ptr fs:[00000030h] 1_2_06B1AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1AE73 mov eax, dword ptr fs:[00000030h] 1_2_06B1AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1AE73 mov eax, dword ptr fs:[00000030h] 1_2_06B1AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1AE73 mov eax, dword ptr fs:[00000030h] 1_2_06B1AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1AE73 mov eax, dword ptr fs:[00000030h] 1_2_06B1AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0766D mov eax, dword ptr fs:[00000030h] 1_2_06B0766D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B07E41 mov eax, dword ptr fs:[00000030h] 1_2_06B07E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B07E41 mov eax, dword ptr fs:[00000030h] 1_2_06B07E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B07E41 mov eax, dword ptr fs:[00000030h] 1_2_06B07E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B07E41 mov eax, dword ptr fs:[00000030h] 1_2_06B07E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B07E41 mov eax, dword ptr fs:[00000030h] 1_2_06B07E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B07E41 mov eax, dword ptr fs:[00000030h] 1_2_06B07E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BBAE44 mov eax, dword ptr fs:[00000030h] 1_2_06BBAE44
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BBAE44 mov eax, dword ptr fs:[00000030h] 1_2_06BBAE44
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B77794 mov eax, dword ptr fs:[00000030h] 1_2_06B77794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B77794 mov eax, dword ptr fs:[00000030h] 1_2_06B77794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B77794 mov eax, dword ptr fs:[00000030h] 1_2_06B77794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B08794 mov eax, dword ptr fs:[00000030h] 1_2_06B08794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B337F5 mov eax, dword ptr fs:[00000030h] 1_2_06B337F5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF4F2E mov eax, dword ptr fs:[00000030h] 1_2_06AF4F2E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF4F2E mov eax, dword ptr fs:[00000030h] 1_2_06AF4F2E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2E730 mov eax, dword ptr fs:[00000030h] 1_2_06B2E730
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1B73D mov eax, dword ptr fs:[00000030h] 1_2_06B1B73D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1B73D mov eax, dword ptr fs:[00000030h] 1_2_06B1B73D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1F716 mov eax, dword ptr fs:[00000030h] 1_2_06B1F716
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B8FF10 mov eax, dword ptr fs:[00000030h] 1_2_06B8FF10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B8FF10 mov eax, dword ptr fs:[00000030h] 1_2_06B8FF10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC070D mov eax, dword ptr fs:[00000030h] 1_2_06BC070D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC070D mov eax, dword ptr fs:[00000030h] 1_2_06BC070D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2A70E mov eax, dword ptr fs:[00000030h] 1_2_06B2A70E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2A70E mov eax, dword ptr fs:[00000030h] 1_2_06B2A70E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0FF60 mov eax, dword ptr fs:[00000030h] 1_2_06B0FF60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC8F6A mov eax, dword ptr fs:[00000030h] 1_2_06BC8F6A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0EF40 mov eax, dword ptr fs:[00000030h] 1_2_06B0EF40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0849B mov eax, dword ptr fs:[00000030h] 1_2_06B0849B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4496 mov eax, dword ptr fs:[00000030h] 1_2_06BB4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4496 mov eax, dword ptr fs:[00000030h] 1_2_06BB4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4496 mov eax, dword ptr fs:[00000030h] 1_2_06BB4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4496 mov eax, dword ptr fs:[00000030h] 1_2_06BB4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4496 mov eax, dword ptr fs:[00000030h] 1_2_06BB4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4496 mov eax, dword ptr fs:[00000030h] 1_2_06BB4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4496 mov eax, dword ptr fs:[00000030h] 1_2_06BB4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4496 mov eax, dword ptr fs:[00000030h] 1_2_06BB4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4496 mov eax, dword ptr fs:[00000030h] 1_2_06BB4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4496 mov eax, dword ptr fs:[00000030h] 1_2_06BB4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4496 mov eax, dword ptr fs:[00000030h] 1_2_06BB4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4496 mov eax, dword ptr fs:[00000030h] 1_2_06BB4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4496 mov eax, dword ptr fs:[00000030h] 1_2_06BB4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB14FB mov eax, dword ptr fs:[00000030h] 1_2_06BB14FB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B76CF0 mov eax, dword ptr fs:[00000030h] 1_2_06B76CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B76CF0 mov eax, dword ptr fs:[00000030h] 1_2_06B76CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B76CF0 mov eax, dword ptr fs:[00000030h] 1_2_06B76CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC8CD6 mov eax, dword ptr fs:[00000030h] 1_2_06BC8CD6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2BC2C mov eax, dword ptr fs:[00000030h] 1_2_06B2BC2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC740D mov eax, dword ptr fs:[00000030h] 1_2_06BC740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC740D mov eax, dword ptr fs:[00000030h] 1_2_06BC740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC740D mov eax, dword ptr fs:[00000030h] 1_2_06BC740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1C06 mov eax, dword ptr fs:[00000030h] 1_2_06BB1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1C06 mov eax, dword ptr fs:[00000030h] 1_2_06BB1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1C06 mov eax, dword ptr fs:[00000030h] 1_2_06BB1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1C06 mov eax, dword ptr fs:[00000030h] 1_2_06BB1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1C06 mov eax, dword ptr fs:[00000030h] 1_2_06BB1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1C06 mov eax, dword ptr fs:[00000030h] 1_2_06BB1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1C06 mov eax, dword ptr fs:[00000030h] 1_2_06BB1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1C06 mov eax, dword ptr fs:[00000030h] 1_2_06BB1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1C06 mov eax, dword ptr fs:[00000030h] 1_2_06BB1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1C06 mov eax, dword ptr fs:[00000030h] 1_2_06BB1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1C06 mov eax, dword ptr fs:[00000030h] 1_2_06BB1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1C06 mov eax, dword ptr fs:[00000030h] 1_2_06BB1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1C06 mov eax, dword ptr fs:[00000030h] 1_2_06BB1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB1C06 mov eax, dword ptr fs:[00000030h] 1_2_06BB1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B76C0A mov eax, dword ptr fs:[00000030h] 1_2_06B76C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B76C0A mov eax, dword ptr fs:[00000030h] 1_2_06B76C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B76C0A mov eax, dword ptr fs:[00000030h] 1_2_06B76C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B76C0A mov eax, dword ptr fs:[00000030h] 1_2_06B76C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2AC7B mov eax, dword ptr fs:[00000030h] 1_2_06B2AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2AC7B mov eax, dword ptr fs:[00000030h] 1_2_06B2AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2AC7B mov eax, dword ptr fs:[00000030h] 1_2_06B2AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2AC7B mov eax, dword ptr fs:[00000030h] 1_2_06B2AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2AC7B mov eax, dword ptr fs:[00000030h] 1_2_06B2AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2AC7B mov eax, dword ptr fs:[00000030h] 1_2_06B2AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2AC7B mov eax, dword ptr fs:[00000030h] 1_2_06B2AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2AC7B mov eax, dword ptr fs:[00000030h] 1_2_06B2AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2AC7B mov eax, dword ptr fs:[00000030h] 1_2_06B2AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2AC7B mov eax, dword ptr fs:[00000030h] 1_2_06B2AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2AC7B mov eax, dword ptr fs:[00000030h] 1_2_06B2AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1746D mov eax, dword ptr fs:[00000030h] 1_2_06B1746D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B8C450 mov eax, dword ptr fs:[00000030h] 1_2_06B8C450
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B8C450 mov eax, dword ptr fs:[00000030h] 1_2_06B8C450
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2A44B mov eax, dword ptr fs:[00000030h] 1_2_06B2A44B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B21DB5 mov eax, dword ptr fs:[00000030h] 1_2_06B21DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B21DB5 mov eax, dword ptr fs:[00000030h] 1_2_06B21DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B21DB5 mov eax, dword ptr fs:[00000030h] 1_2_06B21DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC05AC mov eax, dword ptr fs:[00000030h] 1_2_06BC05AC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC05AC mov eax, dword ptr fs:[00000030h] 1_2_06BC05AC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B235A1 mov eax, dword ptr fs:[00000030h] 1_2_06B235A1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF2D8A mov eax, dword ptr fs:[00000030h] 1_2_06AF2D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF2D8A mov eax, dword ptr fs:[00000030h] 1_2_06AF2D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF2D8A mov eax, dword ptr fs:[00000030h] 1_2_06AF2D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF2D8A mov eax, dword ptr fs:[00000030h] 1_2_06AF2D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF2D8A mov eax, dword ptr fs:[00000030h] 1_2_06AF2D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2FD9B mov eax, dword ptr fs:[00000030h] 1_2_06B2FD9B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2FD9B mov eax, dword ptr fs:[00000030h] 1_2_06B2FD9B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B22581 mov eax, dword ptr fs:[00000030h] 1_2_06B22581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B22581 mov eax, dword ptr fs:[00000030h] 1_2_06B22581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B22581 mov eax, dword ptr fs:[00000030h] 1_2_06B22581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B22581 mov eax, dword ptr fs:[00000030h] 1_2_06B22581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB2D82 mov eax, dword ptr fs:[00000030h] 1_2_06BB2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB2D82 mov eax, dword ptr fs:[00000030h] 1_2_06BB2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB2D82 mov eax, dword ptr fs:[00000030h] 1_2_06BB2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB2D82 mov eax, dword ptr fs:[00000030h] 1_2_06BB2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB2D82 mov eax, dword ptr fs:[00000030h] 1_2_06BB2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB2D82 mov eax, dword ptr fs:[00000030h] 1_2_06BB2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB2D82 mov eax, dword ptr fs:[00000030h] 1_2_06BB2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BA8DF1 mov eax, dword ptr fs:[00000030h] 1_2_06BA8DF1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0D5E0 mov eax, dword ptr fs:[00000030h] 1_2_06B0D5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0D5E0 mov eax, dword ptr fs:[00000030h] 1_2_06B0D5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BBFDE2 mov eax, dword ptr fs:[00000030h] 1_2_06BBFDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BBFDE2 mov eax, dword ptr fs:[00000030h] 1_2_06BBFDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BBFDE2 mov eax, dword ptr fs:[00000030h] 1_2_06BBFDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BBFDE2 mov eax, dword ptr fs:[00000030h] 1_2_06BBFDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B76DC9 mov eax, dword ptr fs:[00000030h] 1_2_06B76DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B76DC9 mov eax, dword ptr fs:[00000030h] 1_2_06B76DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B76DC9 mov eax, dword ptr fs:[00000030h] 1_2_06B76DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B76DC9 mov ecx, dword ptr fs:[00000030h] 1_2_06B76DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B76DC9 mov eax, dword ptr fs:[00000030h] 1_2_06B76DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B76DC9 mov eax, dword ptr fs:[00000030h] 1_2_06B76DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B7A537 mov eax, dword ptr fs:[00000030h] 1_2_06B7A537
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BBE539 mov eax, dword ptr fs:[00000030h] 1_2_06BBE539
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B03D34 mov eax, dword ptr fs:[00000030h] 1_2_06B03D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B03D34 mov eax, dword ptr fs:[00000030h] 1_2_06B03D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B03D34 mov eax, dword ptr fs:[00000030h] 1_2_06B03D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B03D34 mov eax, dword ptr fs:[00000030h] 1_2_06B03D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B03D34 mov eax, dword ptr fs:[00000030h] 1_2_06B03D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B03D34 mov eax, dword ptr fs:[00000030h] 1_2_06B03D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B03D34 mov eax, dword ptr fs:[00000030h] 1_2_06B03D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B03D34 mov eax, dword ptr fs:[00000030h] 1_2_06B03D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B03D34 mov eax, dword ptr fs:[00000030h] 1_2_06B03D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B03D34 mov eax, dword ptr fs:[00000030h] 1_2_06B03D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B03D34 mov eax, dword ptr fs:[00000030h] 1_2_06B03D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B03D34 mov eax, dword ptr fs:[00000030h] 1_2_06B03D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B03D34 mov eax, dword ptr fs:[00000030h] 1_2_06B03D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC8D34 mov eax, dword ptr fs:[00000030h] 1_2_06BC8D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B24D3B mov eax, dword ptr fs:[00000030h] 1_2_06B24D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B24D3B mov eax, dword ptr fs:[00000030h] 1_2_06B24D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B24D3B mov eax, dword ptr fs:[00000030h] 1_2_06B24D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFAD30 mov eax, dword ptr fs:[00000030h] 1_2_06AFAD30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1C577 mov eax, dword ptr fs:[00000030h] 1_2_06B1C577
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1C577 mov eax, dword ptr fs:[00000030h] 1_2_06B1C577
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B17D50 mov eax, dword ptr fs:[00000030h] 1_2_06B17D50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B33D43 mov eax, dword ptr fs:[00000030h] 1_2_06B33D43
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B73540 mov eax, dword ptr fs:[00000030h] 1_2_06B73540
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BA3D40 mov eax, dword ptr fs:[00000030h] 1_2_06BA3D40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0AAB0 mov eax, dword ptr fs:[00000030h] 1_2_06B0AAB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0AAB0 mov eax, dword ptr fs:[00000030h] 1_2_06B0AAB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2FAB0 mov eax, dword ptr fs:[00000030h] 1_2_06B2FAB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF52A5 mov eax, dword ptr fs:[00000030h] 1_2_06AF52A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF52A5 mov eax, dword ptr fs:[00000030h] 1_2_06AF52A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF52A5 mov eax, dword ptr fs:[00000030h] 1_2_06AF52A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF52A5 mov eax, dword ptr fs:[00000030h] 1_2_06AF52A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF52A5 mov eax, dword ptr fs:[00000030h] 1_2_06AF52A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2D294 mov eax, dword ptr fs:[00000030h] 1_2_06B2D294
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2D294 mov eax, dword ptr fs:[00000030h] 1_2_06B2D294
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF mov eax, dword ptr fs:[00000030h] 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF mov eax, dword ptr fs:[00000030h] 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF mov eax, dword ptr fs:[00000030h] 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF mov eax, dword ptr fs:[00000030h] 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF mov eax, dword ptr fs:[00000030h] 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF mov eax, dword ptr fs:[00000030h] 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF mov eax, dword ptr fs:[00000030h] 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF mov eax, dword ptr fs:[00000030h] 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF mov eax, dword ptr fs:[00000030h] 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF mov eax, dword ptr fs:[00000030h] 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF mov eax, dword ptr fs:[00000030h] 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF mov eax, dword ptr fs:[00000030h] 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF mov eax, dword ptr fs:[00000030h] 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB4AEF mov eax, dword ptr fs:[00000030h] 1_2_06BB4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B22AE4 mov eax, dword ptr fs:[00000030h] 1_2_06B22AE4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B22ACB mov eax, dword ptr fs:[00000030h] 1_2_06B22ACB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A229 mov eax, dword ptr fs:[00000030h] 1_2_06B1A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A229 mov eax, dword ptr fs:[00000030h] 1_2_06B1A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A229 mov eax, dword ptr fs:[00000030h] 1_2_06B1A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A229 mov eax, dword ptr fs:[00000030h] 1_2_06B1A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A229 mov eax, dword ptr fs:[00000030h] 1_2_06B1A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A229 mov eax, dword ptr fs:[00000030h] 1_2_06B1A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A229 mov eax, dword ptr fs:[00000030h] 1_2_06B1A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A229 mov eax, dword ptr fs:[00000030h] 1_2_06B1A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A229 mov eax, dword ptr fs:[00000030h] 1_2_06B1A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B34A2C mov eax, dword ptr fs:[00000030h] 1_2_06B34A2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B34A2C mov eax, dword ptr fs:[00000030h] 1_2_06B34A2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B13A1C mov eax, dword ptr fs:[00000030h] 1_2_06B13A1C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BBAA16 mov eax, dword ptr fs:[00000030h] 1_2_06BBAA16
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BBAA16 mov eax, dword ptr fs:[00000030h] 1_2_06BBAA16
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFAA16 mov eax, dword ptr fs:[00000030h] 1_2_06AFAA16
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFAA16 mov eax, dword ptr fs:[00000030h] 1_2_06AFAA16
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B08A0A mov eax, dword ptr fs:[00000030h] 1_2_06B08A0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF5210 mov eax, dword ptr fs:[00000030h] 1_2_06AF5210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF5210 mov ecx, dword ptr fs:[00000030h] 1_2_06AF5210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF5210 mov eax, dword ptr fs:[00000030h] 1_2_06AF5210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF5210 mov eax, dword ptr fs:[00000030h] 1_2_06AF5210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B3927A mov eax, dword ptr fs:[00000030h] 1_2_06B3927A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BAB260 mov eax, dword ptr fs:[00000030h] 1_2_06BAB260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BAB260 mov eax, dword ptr fs:[00000030h] 1_2_06BAB260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC8A62 mov eax, dword ptr fs:[00000030h] 1_2_06BC8A62
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BBEA55 mov eax, dword ptr fs:[00000030h] 1_2_06BBEA55
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF9240 mov eax, dword ptr fs:[00000030h] 1_2_06AF9240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF9240 mov eax, dword ptr fs:[00000030h] 1_2_06AF9240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF9240 mov eax, dword ptr fs:[00000030h] 1_2_06AF9240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF9240 mov eax, dword ptr fs:[00000030h] 1_2_06AF9240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B84257 mov eax, dword ptr fs:[00000030h] 1_2_06B84257
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC5BA5 mov eax, dword ptr fs:[00000030h] 1_2_06BC5BA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B24BAD mov eax, dword ptr fs:[00000030h] 1_2_06B24BAD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B24BAD mov eax, dword ptr fs:[00000030h] 1_2_06B24BAD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B24BAD mov eax, dword ptr fs:[00000030h] 1_2_06B24BAD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2B390 mov eax, dword ptr fs:[00000030h] 1_2_06B2B390
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B22397 mov eax, dword ptr fs:[00000030h] 1_2_06B22397
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB138A mov eax, dword ptr fs:[00000030h] 1_2_06BB138A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BAD380 mov ecx, dword ptr fs:[00000030h] 1_2_06BAD380
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B01B8F mov eax, dword ptr fs:[00000030h] 1_2_06B01B8F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B01B8F mov eax, dword ptr fs:[00000030h] 1_2_06B01B8F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B203E2 mov eax, dword ptr fs:[00000030h] 1_2_06B203E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B203E2 mov eax, dword ptr fs:[00000030h] 1_2_06B203E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B203E2 mov eax, dword ptr fs:[00000030h] 1_2_06B203E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B203E2 mov eax, dword ptr fs:[00000030h] 1_2_06B203E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B203E2 mov eax, dword ptr fs:[00000030h] 1_2_06B203E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B203E2 mov eax, dword ptr fs:[00000030h] 1_2_06B203E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1DBE9 mov eax, dword ptr fs:[00000030h] 1_2_06B1DBE9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BA23E3 mov ecx, dword ptr fs:[00000030h] 1_2_06BA23E3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BA23E3 mov ecx, dword ptr fs:[00000030h] 1_2_06BA23E3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BA23E3 mov eax, dword ptr fs:[00000030h] 1_2_06BA23E3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B753CA mov eax, dword ptr fs:[00000030h] 1_2_06B753CA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B753CA mov eax, dword ptr fs:[00000030h] 1_2_06B753CA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB131B mov eax, dword ptr fs:[00000030h] 1_2_06BB131B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A309 mov eax, dword ptr fs:[00000030h] 1_2_06B1A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B23B7A mov eax, dword ptr fs:[00000030h] 1_2_06B23B7A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B23B7A mov eax, dword ptr fs:[00000030h] 1_2_06B23B7A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFDB60 mov ecx, dword ptr fs:[00000030h] 1_2_06AFDB60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC8B58 mov eax, dword ptr fs:[00000030h] 1_2_06BC8B58
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFDB40 mov eax, dword ptr fs:[00000030h] 1_2_06AFDB40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFF358 mov eax, dword ptr fs:[00000030h] 1_2_06AFF358
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2F0BF mov ecx, dword ptr fs:[00000030h] 1_2_06B2F0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2F0BF mov eax, dword ptr fs:[00000030h] 1_2_06B2F0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2F0BF mov eax, dword ptr fs:[00000030h] 1_2_06B2F0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B220A0 mov eax, dword ptr fs:[00000030h] 1_2_06B220A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B220A0 mov eax, dword ptr fs:[00000030h] 1_2_06B220A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B220A0 mov eax, dword ptr fs:[00000030h] 1_2_06B220A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B220A0 mov eax, dword ptr fs:[00000030h] 1_2_06B220A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B220A0 mov eax, dword ptr fs:[00000030h] 1_2_06B220A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B220A0 mov eax, dword ptr fs:[00000030h] 1_2_06B220A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B390AF mov eax, dword ptr fs:[00000030h] 1_2_06B390AF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF9080 mov eax, dword ptr fs:[00000030h] 1_2_06AF9080
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B73884 mov eax, dword ptr fs:[00000030h] 1_2_06B73884
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B73884 mov eax, dword ptr fs:[00000030h] 1_2_06B73884
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF58EC mov eax, dword ptr fs:[00000030h] 1_2_06AF58EC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF40E1 mov eax, dword ptr fs:[00000030h] 1_2_06AF40E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF40E1 mov eax, dword ptr fs:[00000030h] 1_2_06AF40E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF40E1 mov eax, dword ptr fs:[00000030h] 1_2_06AF40E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1B8E4 mov eax, dword ptr fs:[00000030h] 1_2_06B1B8E4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1B8E4 mov eax, dword ptr fs:[00000030h] 1_2_06B1B8E4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B8B8D0 mov eax, dword ptr fs:[00000030h] 1_2_06B8B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B8B8D0 mov ecx, dword ptr fs:[00000030h] 1_2_06B8B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B8B8D0 mov eax, dword ptr fs:[00000030h] 1_2_06B8B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B8B8D0 mov eax, dword ptr fs:[00000030h] 1_2_06B8B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B8B8D0 mov eax, dword ptr fs:[00000030h] 1_2_06B8B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B8B8D0 mov eax, dword ptr fs:[00000030h] 1_2_06B8B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A830 mov eax, dword ptr fs:[00000030h] 1_2_06B1A830
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A830 mov eax, dword ptr fs:[00000030h] 1_2_06B1A830
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A830 mov eax, dword ptr fs:[00000030h] 1_2_06B1A830
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1A830 mov eax, dword ptr fs:[00000030h] 1_2_06B1A830
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0B02A mov eax, dword ptr fs:[00000030h] 1_2_06B0B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0B02A mov eax, dword ptr fs:[00000030h] 1_2_06B0B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0B02A mov eax, dword ptr fs:[00000030h] 1_2_06B0B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B0B02A mov eax, dword ptr fs:[00000030h] 1_2_06B0B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2002D mov eax, dword ptr fs:[00000030h] 1_2_06B2002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2002D mov eax, dword ptr fs:[00000030h] 1_2_06B2002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2002D mov eax, dword ptr fs:[00000030h] 1_2_06B2002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2002D mov eax, dword ptr fs:[00000030h] 1_2_06B2002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2002D mov eax, dword ptr fs:[00000030h] 1_2_06B2002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B77016 mov eax, dword ptr fs:[00000030h] 1_2_06B77016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B77016 mov eax, dword ptr fs:[00000030h] 1_2_06B77016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B77016 mov eax, dword ptr fs:[00000030h] 1_2_06B77016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC4015 mov eax, dword ptr fs:[00000030h] 1_2_06BC4015
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC4015 mov eax, dword ptr fs:[00000030h] 1_2_06BC4015
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB2073 mov eax, dword ptr fs:[00000030h] 1_2_06BB2073
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BC1074 mov eax, dword ptr fs:[00000030h] 1_2_06BC1074
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B10050 mov eax, dword ptr fs:[00000030h] 1_2_06B10050
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B10050 mov eax, dword ptr fs:[00000030h] 1_2_06B10050
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B751BE mov eax, dword ptr fs:[00000030h] 1_2_06B751BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B751BE mov eax, dword ptr fs:[00000030h] 1_2_06B751BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B751BE mov eax, dword ptr fs:[00000030h] 1_2_06B751BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B751BE mov eax, dword ptr fs:[00000030h] 1_2_06B751BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B199BF mov ecx, dword ptr fs:[00000030h] 1_2_06B199BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B199BF mov ecx, dword ptr fs:[00000030h] 1_2_06B199BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B199BF mov eax, dword ptr fs:[00000030h] 1_2_06B199BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B199BF mov ecx, dword ptr fs:[00000030h] 1_2_06B199BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B199BF mov ecx, dword ptr fs:[00000030h] 1_2_06B199BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B199BF mov eax, dword ptr fs:[00000030h] 1_2_06B199BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B199BF mov ecx, dword ptr fs:[00000030h] 1_2_06B199BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B199BF mov ecx, dword ptr fs:[00000030h] 1_2_06B199BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B199BF mov eax, dword ptr fs:[00000030h] 1_2_06B199BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B199BF mov ecx, dword ptr fs:[00000030h] 1_2_06B199BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B199BF mov ecx, dword ptr fs:[00000030h] 1_2_06B199BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B199BF mov eax, dword ptr fs:[00000030h] 1_2_06B199BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B769A6 mov eax, dword ptr fs:[00000030h] 1_2_06B769A6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B261A0 mov eax, dword ptr fs:[00000030h] 1_2_06B261A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B261A0 mov eax, dword ptr fs:[00000030h] 1_2_06B261A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB49A4 mov eax, dword ptr fs:[00000030h] 1_2_06BB49A4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB49A4 mov eax, dword ptr fs:[00000030h] 1_2_06BB49A4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB49A4 mov eax, dword ptr fs:[00000030h] 1_2_06BB49A4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06BB49A4 mov eax, dword ptr fs:[00000030h] 1_2_06BB49A4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B22990 mov eax, dword ptr fs:[00000030h] 1_2_06B22990
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1C182 mov eax, dword ptr fs:[00000030h] 1_2_06B1C182
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2A185 mov eax, dword ptr fs:[00000030h] 1_2_06B2A185
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFB1E1 mov eax, dword ptr fs:[00000030h] 1_2_06AFB1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFB1E1 mov eax, dword ptr fs:[00000030h] 1_2_06AFB1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFB1E1 mov eax, dword ptr fs:[00000030h] 1_2_06AFB1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B841E8 mov eax, dword ptr fs:[00000030h] 1_2_06B841E8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2513A mov eax, dword ptr fs:[00000030h] 1_2_06B2513A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B2513A mov eax, dword ptr fs:[00000030h] 1_2_06B2513A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B14120 mov eax, dword ptr fs:[00000030h] 1_2_06B14120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B14120 mov eax, dword ptr fs:[00000030h] 1_2_06B14120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B14120 mov eax, dword ptr fs:[00000030h] 1_2_06B14120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B14120 mov eax, dword ptr fs:[00000030h] 1_2_06B14120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B14120 mov ecx, dword ptr fs:[00000030h] 1_2_06B14120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF9100 mov eax, dword ptr fs:[00000030h] 1_2_06AF9100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF9100 mov eax, dword ptr fs:[00000030h] 1_2_06AF9100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AF9100 mov eax, dword ptr fs:[00000030h] 1_2_06AF9100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFC962 mov eax, dword ptr fs:[00000030h] 1_2_06AFC962
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFB171 mov eax, dword ptr fs:[00000030h] 1_2_06AFB171
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06AFB171 mov eax, dword ptr fs:[00000030h] 1_2_06AFB171
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1B944 mov eax, dword ptr fs:[00000030h] 1_2_06B1B944
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B1B944 mov eax, dword ptr fs:[00000030h] 1_2_06B1B944
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\colorcpl.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06B396E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_06B396E0

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.jam-nins.com
Source: C:\Windows\explorer.exe Network Connect: 212.32.237.90 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.stillwatersagawork.com
Source: C:\Windows\explorer.exe Network Connect: 5.183.8.25 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Windows\SysWOW64\colorcpl.exe Section unmapped: C:\Windows\SysWOW64\msdt.exe base address: 1030000 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section unmapped: C:\Windows\SysWOW64\raserver.exe base address: FC0000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 10410000 Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 4C90000 Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 4CA0000 Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Memory written: C:\Windows\SysWOW64\wscript.exe base: 10410000 Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Memory written: C:\Windows\SysWOW64\wscript.exe base: 38D0000 Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Memory written: C:\Windows\SysWOW64\wscript.exe base: 52E0000 Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 10410000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 4C90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 4CA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Memory allocated: C:\Windows\SysWOW64\wscript.exe base: 10410000 protect: page execute and read and write Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Memory allocated: C:\Windows\SysWOW64\wscript.exe base: 38D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Memory allocated: C:\Windows\SysWOW64\wscript.exe base: 52E0000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 10410000 value starts with: 4D5A Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Memory written: C:\Windows\SysWOW64\wscript.exe base: 10410000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\colorcpl.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\colorcpl.exe Thread register set: target process: 3452 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Thread register set: target process: 3452 Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Thread register set: target process: 3452 Jump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Thread created: C:\Windows\SysWOW64\colorcpl.exe EIP: 4CA0000 Jump to behavior
Source: C:\Users\Public\Libraries\Ndvmyrkf.exe Thread created: C:\Windows\SysWOW64\wscript.exe EIP: 52E0000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V Jump to behavior
Source: explorer.exe, 00000002.00000000.340047701.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.266283121.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.308642994.0000000001080000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: XProgram Manager
Source: explorer.exe, 00000002.00000000.340047701.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.299444707.000000000835D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.331402353.0000000005D90000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000000.339391657.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.340047701.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.266283121.0000000001080000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000002.00000000.340047701.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.266283121.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.308642994.0000000001080000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 0_2_022B5D0C
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: GetLocaleInfoA, 0_2_022BAA04
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: GetLocaleInfoA, 0_2_022BA9B8
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 0_2_022B5E18
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022B9438 GetLocalTime, 0_2_022B9438
Source: C:\Users\user\Desktop\Copie a bonului de plata.exe Code function: 0_2_022BB938 GetVersionExA, 0_2_022BB938

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 6.0.wscript.exe.10410000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.wscript.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.368934423.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.300982694.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.514213076.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.363700003.0000000004E70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.301779661.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.260531980.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.265578930.0000000004B07000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.511910785.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.367412831.0000000000AF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.362672301.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.259676945.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.514481833.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.301417348.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.300560859.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.333241932.00000000100D9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.349866867.00000000052F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.265182733.0000000004A77000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.363506192.0000000004E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.350083246.00000000060B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.259327533.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.260096262.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.305721420.00000000046D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\raserver.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\raserver.exe File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 6.0.wscript.exe.10410000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.wscript.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.wscript.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.368934423.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.300982694.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.514213076.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.363700003.0000000004E70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.301779661.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.260531980.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.265578930.0000000004B07000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.511910785.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.367412831.0000000000AF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.362672301.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.259676945.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.514481833.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.301417348.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.300560859.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.333241932.00000000100D9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.349866867.00000000052F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.265182733.0000000004A77000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.363506192.0000000004E40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.350083246.00000000060B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.259327533.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.260096262.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.305721420.00000000046D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 755986 Sample: Copie a bonului de plata.exe Startdate: 29/11/2022 Architecture: WINDOWS Score: 100 58 Malicious sample detected (through community Yara rule) 2->58 60 Antivirus detection for URL or domain 2->60 62 Antivirus / Scanner detection for submitted sample 2->62 64 7 other signatures 2->64 10 Copie a bonului de plata.exe 1 18 2->10         started        process3 dnsIp4 52 ppq0oq.ph.files.1drv.com 10->52 54 ph-files.fe.1drv.com 10->54 56 onedrive.live.com 10->56 44 C:\Users\Public\Libraries44dvmyrkf.exe, PE32 10->44 dropped 46 C:\Users\...46dvmyrkf.exe:Zone.Identifier, ASCII 10->46 dropped 86 Writes to foreign memory regions 10->86 88 Allocates memory in foreign processes 10->88 90 Creates a thread in another existing process (thread injection) 10->90 92 Injects a PE file into a foreign processes 10->92 15 colorcpl.exe 2 10->15         started        file5 signatures6 process7 signatures8 104 Modifies the context of a thread in another process (thread injection) 15->104 106 Maps a DLL or memory area into another process 15->106 108 Sample uses process hollowing technique 15->108 110 2 other signatures 15->110 18 explorer.exe 15->18 injected process9 dnsIp10 48 www.stillwatersagawork.com 212.32.237.90, 49724, 49725, 80 LEASEWEB-NL-AMS-01NetherlandsNL Netherlands 18->48 50 www.jam-nins.com 5.183.8.25, 49721, 49722, 80 INTERXSCH Germany 18->50 66 System process connects to network (likely due to code injection or exploit) 18->66 22 Ndvmyrkf.exe 18->22         started        25 raserver.exe 18 18->25         started        28 msdt.exe 18->28         started        signatures11 process12 file13 68 Antivirus detection for dropped file 22->68 70 Multi AV Scanner detection for dropped file 22->70 72 Machine Learning detection for dropped file 22->72 82 4 other signatures 22->82 30 wscript.exe 22->30         started        40 C:\Users\user\AppData\...\9N3logrv.ini, data 25->40 dropped 42 C:\Users\user\AppData\...\9N3logri.ini, data 25->42 dropped 74 Detected FormBook malware 25->74 76 Tries to steal Mail credentials (via file / registry access) 25->76 78 Tries to harvest and steal browser information (history, passwords, etc) 25->78 84 2 other signatures 25->84 33 cmd.exe 25->33         started        80 Tries to detect virtualization through RDTSC time measurements 28->80 signatures14 process15 file16 94 Modifies the context of a thread in another process (thread injection) 30->94 96 Maps a DLL or memory area into another process 30->96 98 Sample uses process hollowing technique 30->98 100 Tries to detect virtualization through RDTSC time measurements 30->100 38 C:\Users\user\AppData\Local\Temp\DB1, SQLite 33->38 dropped 102 Tries to harvest and steal browser information (history, passwords, etc) 33->102 36 conhost.exe 33->36         started        signatures17 process18
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
5.183.8.25
 www.jam-nins.com Germany
64463 INTERXSCH true
212.32.237.90
 www.stillwatersagawork.com Netherlands
60781 LEASEWEB-NL-AMS-01NetherlandsNL true

Contacted Domains

Name IP Active
www.jam-nins.com 5.183.8.25 true
www.stillwatersagawork.com 212.32.237.90 true
onedrive.live.com unknown unknown
ppq0oq.ph.files.1drv.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.xctech.world/3nop/ true
  • Avira URL Cloud: malware
 low
http://www.stillwatersagawork.com/3nop/ true
  • Avira URL Cloud: malware
 unknown
https://onedrive.live.com/download?cid=E0CF7F9E6AAF27EF&resid=E0CF7F9E6AAF27EF%21845&authkey=AIl8u0Az19Gihis false
    		high
    http://www.jam-nins.com/3nop/?lR-DA=FNGt6FUR7BoC+Wk2mT/OXzHG9rfZBcI/fjySAuf4KaFOaHLtldhTTP3Ojf6osS08NYIgkgrbcw==&5j=6leTg0VPe4i true
    • Avira URL Cloud: malware
    		 unknown
    http://www.jam-nins.com/3nop/ true
    • Avira URL Cloud: malware
    		 unknown
    http://www.stillwatersagawork.com/3nop/?lR-DA=uizPEf3ZCIKf+0vjz41ZIbJXQmeLMi3XcgBA4XxBdLh6ZlOYX2KmQQVjEXygOMnK9OyVSVhb/w==&5j=6leTg0VPe4i true
    • Avira URL Cloud: malware
    		 unknown