Windows Analysis Report
0321423605241625.exe

Overview

General Information

Sample Name: 0321423605241625.exe
Analysis ID: 756155
MD5: edb1382c354ec6c09c53473e5335703a
SHA1: a1a5fbfce034731cba1072bab6b97b26c8a90c79
SHA256: c2c6eec67a1561c3a49179ddf756480876d92588c2e83d64246a04c3d724cb3d
Tags: exemodiloaderxloader
Infos:

Detection

DBatLoader, FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Yara detected DBatLoader
Antivirus detection for URL or domain
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Writes to foreign memory regions
Machine Learning detection for sample
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to query locales information (e.g. system language)
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Abnormal high CPU Usage
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Extensive use of GetProcAddress (often used to hide API calls)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: 0321423605241625.exe ReversingLabs: Detection: 35%
Source: 0321423605241625.exe Virustotal: Detection: 40% Perma Link
Yara detected FormBook
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.553690913.0000000002C80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.553760643.0000000002D80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.305700476.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.305400692.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.306413915.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.306024723.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.396763474.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.474871458.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.498815518.0000000005140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.309972284.0000000004A7F000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.525904098.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.553544992.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.545995933.00000000046FE000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.495768965.0000000000F20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Antivirus / Scanner detection for submitted sample
Source: 0321423605241625.exe Avira: detected
Antivirus detection for URL or domain
Source: www.rematedeldia.com/euv4/ Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Avira: detection malicious, Label: HEUR/AGEN.1214697
Multi AV Scanner detection for dropped file
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe ReversingLabs: Detection: 35%
Machine Learning detection for sample
Source: 0321423605241625.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.0.colorcpl.exe.10410000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.0321423605241625.exe.2170000.0.unpack Avira: Label: TR/Hijacker.Gen
Source: 1.0.colorcpl.exe.10410000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.2.raserver.exe.525796c.4.unpack Avira: Label: TR/Crypt.XPACK.Gen8
Source: 1.0.colorcpl.exe.10410000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.colorcpl.exe.10410000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.2.raserver.exe.a3cda0.1.unpack Avira: Label: TR/Crypt.XPACK.Gen8
Source: 1.0.colorcpl.exe.10410000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.0321423605241625.exe.2231218.1.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 0321423605241625.exe Malware Configuration Extractor: DBatLoader {"Download Url": "https://onedrive.live.com/download?cid=E0CF7F9E6AAF27EF&resid=E0CF7F9E6AAF27EF%21846&authkey=AOLP5PRESPN2npo"}
Source: 00000009.00000002.553690913.0000000002C80000.00000040.10000000.00040000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.rematedeldia.com/euv4/"], "decoy": ["anniebapartments.com", "hagenbicycles.com", "herbalist101.com", "southerncorrosion.net", "kuechenpruefer.com", "tajniezdrzi.quest", "segurofunerarioar.com", "boardsandbeamsdecor.com", "alifdanismanlik.com", "pkem.top", "mddc.clinic", "handejqr.com", "crux-at.com", "awp.email", "hugsforbubbs.com", "cielotherepy.com", "turkcuyuz.com", "teamidc.com", "lankasirinspa.com", "68135.online", "oprimanumerodos.com", "launchclik.com", "customapronsnow.com", "thecuratedpour.com", "20dzwww.com", "encludemedia.com", "kreativevisibility.net", "mehfeels.com", "oecmgroup.com", "alert78.info", "1207rossmoyne.com", "spbutoto.com", "t1uba.com", "protection-onepa.com", "byausorsm26-plala.xyz", "bestpleasure4u.com", "allmnlenem.quest", "mobilpartes.com", "fabio.tools", "bubu3cin.com", "nathanmartinez.digital", "shristiprintingplaces.com", "silkyflawless.com", "berylgrote.top", "laidbackfurniture.store", "leatherman-neal.com", "uschargeport.com", "the-pumps.com", "deepootech.com", "drimev.com", "seo-art.agency", "jasabacklinkweb20.com", "tracynicolalamond.com", "dandtglaziers.com", "vulacils.com", "bendyourtongue.com", "gulfund.com", "ahmadfaizlajis.com", "595531.com", "metavillagehub.com", "librairie-adrienne.com", "77777.store", "gongwenbo.com", "game2plays.com"]}
Uses 32bit PE files
Source: 0321423605241625.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: unknown HTTPS traffic detected: 13.107.43.12:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: Binary string: colorcpl.pdbGCTL source: raserver.exe, 00000009.00000002.556117926.0000000005257000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000009.00000002.553458668.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: colorcpl.pdb source: raserver.exe, 00000009.00000002.556117926.0000000005257000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000009.00000002.553458668.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: colorcpl.exe, 00000001.00000003.306684881.000000000503F000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.505224906.0000000006F0F000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000003.308280419.00000000051D9000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.500567778.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000003.493545986.00000000049ED000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000002.553968858.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000003.499251021.0000000004B8C000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000002.554941231.0000000004E3F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: colorcpl.exe, colorcpl.exe, 00000001.00000003.306684881.000000000503F000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.505224906.0000000006F0F000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000003.308280419.00000000051D9000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.500567778.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000003.493545986.00000000049ED000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000002.553968858.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000003.499251021.0000000004B8C000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000002.554941231.0000000004E3F000.00000040.00000800.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02175B48 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 0_2_02175B48

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49715 -> 192.0.78.141:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49715 -> 192.0.78.141:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49715 -> 192.0.78.141:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49717 -> 52.85.92.84:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49717 -> 52.85.92.84:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49717 -> 52.85.92.84:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49719 -> 217.160.0.95:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49719 -> 217.160.0.95:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49719 -> 217.160.0.95:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.rematedeldia.com/euv4/
Source: Malware configuration extractor URLs: https://onedrive.live.com/download?cid=E0CF7F9E6AAF27EF&resid=E0CF7F9E6AAF27EF%21846&authkey=AOLP5PRESPN2npo
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 13.107.43.12 13.107.43.12
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: 0321423605241625.exe, 00000000.00000003.301183621.0000000000867000.00000004.00000020.00020000.00000000.sdmp, 0321423605241625.exe, 00000000.00000003.299996979.000000000085A000.00000004.00000020.00020000.00000000.sdmp, 0321423605241625.exe, 00000000.00000002.307512986.0000000000868000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 00000002.00000000.351845290.000000000091F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.310261242.000000000091F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.434855289.0000000000921000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: 0321423605241625.exe, 00000000.00000002.307058995.00000000007FF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/
Source: 0321423605241625.exe, 00000000.00000002.307058995.00000000007FF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/download?cid=E0CF7F9E6AAF27EF&resid=E0CF7F9E6AAF27EF%21846&authkey=AOLP5PR
Source: 0321423605241625.exe, 00000000.00000003.301194730.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 0321423605241625.exe, 00000000.00000003.301178169.0000000000864000.00000004.00000020.00020000.00000000.sdmp, 0321423605241625.exe, 00000000.00000002.307357943.0000000000862000.00000004.00000020.00020000.00000000.sdmp, 0321423605241625.exe, 00000000.00000003.299996979.000000000085A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ppqfqw.ph.files.1drv.com/
Source: 0321423605241625.exe, 00000000.00000003.301178169.0000000000864000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ppqfqw.ph.files.1drv.com/U0
Source: 0321423605241625.exe, 00000000.00000003.301194730.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 0321423605241625.exe, 00000000.00000002.307576454.0000000000874000.00000004.00000020.00020000.00000000.sdmp, 0321423605241625.exe, 00000000.00000003.299996979.000000000085A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ppqfqw.ph.files.1drv.com/_
Source: 0321423605241625.exe, 00000000.00000003.301194730.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 0321423605241625.exe, 00000000.00000002.307576454.0000000000874000.00000004.00000020.00020000.00000000.sdmp, 0321423605241625.exe, 00000000.00000003.299996979.000000000085A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ppqfqw.ph.files.1drv.com/s
Source: 0321423605241625.exe, 00000000.00000003.301289184.000000000089F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ppqfqw.ph.files.1drv.com/y4mCDNCh3rnIYpJlqIqXCF9hAcHbqZ_4sWcNl3-omCYoNehN1gOwskkZvXxiCnSz1O3
Source: 0321423605241625.exe, 00000000.00000002.307309131.0000000000858000.00000004.00000020.00020000.00000000.sdmp, 0321423605241625.exe, 00000000.00000003.301144762.0000000000850000.00000004.00000020.00020000.00000000.sdmp, 0321423605241625.exe, 00000000.00000002.307058995.00000000007FF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ppqfqw.ph.files.1drv.com/y4mcSg4TVpIg-eA6Y1ciUp4Dzz62AcO4SwOj-306Rp8dovP_vJs6bBF8upLxcpz7eVd
Source: unknown DNS traffic detected: queries for: onedrive.live.com
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02188CBC InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle, 0_2_02188CBC
Source: global traffic HTTP traffic detected: GET /y4mCDNCh3rnIYpJlqIqXCF9hAcHbqZ_4sWcNl3-omCYoNehN1gOwskkZvXxiCnSz1O3rlGujQmh2dpM-9vT8IEOnYjevggDBPg3L6krVTX5rpZ6Y9fWqq7mXN8HP0HSdlr6-fMy35G8DvzJqxvSasnXVIJpB-5dNG-tdgdNk_U_XYoTZ1ccJrC1sgInwIFqmsOi4T1bkt9-CIDRF_pvQqcEQA/Mwqrxeuzvim?download&psid=1 HTTP/1.1User-Agent: 92Host: ppqfqw.ph.files.1drv.comConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 13.107.43.12:443 -> 192.168.2.5:49708 version: TLS 1.2
Creates a DirectInput object (often for capturing keystrokes)
Source: 0321423605241625.exe, 00000000.00000002.306915554.00000000007CA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.553690913.0000000002C80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.553760643.0000000002D80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.305700476.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.305400692.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.306413915.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.306024723.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.396763474.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.474871458.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.498815518.0000000005140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.309972284.0000000004A7F000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.525904098.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.553544992.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.545995933.00000000046FE000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.495768965.0000000000F20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.553690913.0000000002C80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.553690913.0000000002C80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.553690913.0000000002C80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.553760643.0000000002D80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.553760643.0000000002D80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.553760643.0000000002D80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.305700476.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000000.305700476.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.305700476.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.305400692.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000000.305400692.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.305400692.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.306413915.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000000.306413915.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.306413915.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.306024723.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000000.306024723.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.306024723.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000000.396763474.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000000.396763474.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000000.396763474.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000000.474871458.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000000.474871458.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000000.474871458.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.498815518.0000000005140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.498815518.0000000005140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.498815518.0000000005140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.309972284.0000000004A7F000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.309972284.0000000004A7F000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.309972284.0000000004A7F000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.525904098.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.525904098.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.525904098.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.553544992.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.553544992.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.553544992.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.545995933.00000000046FE000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.545995933.00000000046FE000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.545995933.00000000046FE000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.495768965.0000000000F20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.495768965.0000000000F20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.495768965.0000000000F20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: 0321423605241625.exe PID: 3140, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: colorcpl.exe PID: 3576, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: Mwqrxeuz.exe PID: 5528, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: raserver.exe PID: 5928, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Uses 32bit PE files
Source: 0321423605241625.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Yara signature match
Source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.553690913.0000000002C80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.553690913.0000000002C80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.553690913.0000000002C80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.553760643.0000000002D80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.553760643.0000000002D80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.553760643.0000000002D80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.305700476.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000000.305700476.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.305700476.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.305400692.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000000.305400692.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.305400692.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.306413915.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000000.306413915.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.306413915.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.306024723.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000000.306024723.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.306024723.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000000.396763474.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000000.396763474.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000000.396763474.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000000.474871458.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000000.474871458.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000000.474871458.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.498815518.0000000005140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.498815518.0000000005140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.498815518.0000000005140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.309972284.0000000004A7F000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.309972284.0000000004A7F000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.309972284.0000000004A7F000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.525904098.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.525904098.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.525904098.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.553544992.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.553544992.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.553544992.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.545995933.00000000046FE000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.545995933.00000000046FE000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.545995933.00000000046FE000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.495768965.0000000000F20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.495768965.0000000000F20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.495768965.0000000000F20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: 0321423605241625.exe PID: 3140, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: colorcpl.exe PID: 3576, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: Mwqrxeuz.exe PID: 5528, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: raserver.exe PID: 5928, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: C:\Users\Public\Libraries\zuexrqwM.url, type: DROPPED Matched rule: Methodology_Shortcut_HotKey author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, score = 27.09.2019, reference = https://twitter.com/cglyer/status/1176184798248919044
Source: C:\Users\Public\Libraries\zuexrqwM.url, type: DROPPED Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, score = 27.09.2019, reference = https://twitter.com/cglyer/status/1176184798248919044
Detected potential crypto function
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_021720F4 0_2_021720F4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE2EF7 1_2_06EE2EF7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E36E30 1_2_06E36E30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EDD616 1_2_06EDD616
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE1FF1 1_2_06EE1FF1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EEDFCE 1_2_06EEDFCE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4496 1_2_06ED4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EDD466 1_2_06EDD466
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B477 1_2_06E3B477
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2841F 1_2_06E2841F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2D5E0 1_2_06E2D5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE25DD 1_2_06EE25DD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E42581 1_2_06E42581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED2D82 1_2_06ED2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE1D55 1_2_06EE1D55
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E10D20 1_2_06E10D20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE2D07 1_2_06EE2D07
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE22AE 1_2_06EE22AE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ECFA2B 1_2_06ECFA2B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B236 1_2_06E3B236
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EC23E3 1_2_06EC23E3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED03DA 1_2_06ED03DA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4ABD8 1_2_06E4ABD8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EDDBD2 1_2_06EDDBD2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4EBB0 1_2_06E4EBB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4138B 1_2_06E4138B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3AB40 1_2_06E3AB40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EBCB4F 1_2_06EBCB4F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE2B28 1_2_06EE2B28
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE28EC 1_2_06EE28EC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E420A0 1_2_06E420A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE20A8 1_2_06EE20A8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2B090 1_2_06E2B090
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EEE824 1_2_06EEE824
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A830 1_2_06E3A830
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1002 1_2_06ED1002
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E399BF 1_2_06E399BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E34120 1_2_06E34120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1F900 1_2_06E1F900
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 06E1B150 appears 136 times
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: String function: 02174C24 appears 471 times
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: String function: 02176908 appears 32 times
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: String function: 021748A0 appears 60 times
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: String function: 02174A98 appears 136 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02189128 InetIsOffline,InetIsOffline,CopyFileA,WinExec,Sleep,OpenProcess,NtSuspendThread,InetIsOffline,ZwClose,InetIsOffline,InetIsOffline,ExitProcess, 0_2_02189128
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02183690 LoadLibraryA,GetModuleHandleA,GetProcAddress,RtlMoveMemory,GetCurrentProcess,NtFlushVirtualMemory,FreeLibrary, 0_2_02183690
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0218779C InetIsOffline,VirtualAlloc,GetProcAddress,FreeLibrary,VirtualFree,VirtualAllocEx,GetProcAddress,FreeLibrary,WriteProcessMemory,NtProtectVirtualMemory, 0_2_0218779C
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0218C0D9 Sleep,DeleteFileA,DeleteFileA,DeleteFileA,DeleteFileA,DeleteFileA,DeleteFileA,WinExec,Sleep,OpenProcess,NtSuspendThread,InetIsOffline,ZwClose,InetIsOffline,InetIsOffline,ExitProcess, 0_2_0218C0D9
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02189128 InetIsOffline,InetIsOffline,CopyFileA,WinExec,Sleep,OpenProcess,NtSuspendThread,InetIsOffline,ZwClose,InetIsOffline,InetIsOffline,ExitProcess, 0_2_02189128
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0218368E LoadLibraryA,GetModuleHandleA,GetProcAddress,RtlMoveMemory,GetCurrentProcess,NtFlushVirtualMemory,FreeLibrary, 0_2_0218368E
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0218773C InetIsOffline,VirtualAlloc,GetProcAddress,FreeLibrary,VirtualFree,VirtualAllocEx,GetProcAddress,FreeLibrary,WriteProcessMemory,NtProtectVirtualMemory, 0_2_0218773C
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02183990 InetIsOffline,CreateProcessA,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,VirtualAllocEx,VirtualAllocEx,GetProcAddress,FreeLibrary,NtProtectVirtualMemory,SetThreadContext,NtResumeThread, 0_2_02183990
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0218398E InetIsOffline,CreateProcessA,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,GetProcAddress,FreeLibrary,NtProtectVirtualMemory,SetThreadContext,NtResumeThread, 0_2_0218398E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E596E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_06E596E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59660 NtAllocateVirtualMemory,LdrInitializeThunk, 1_2_06E59660
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59FE0 NtCreateMutant,LdrInitializeThunk, 1_2_06E59FE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E597A0 NtUnmapViewOfSection,LdrInitializeThunk, 1_2_06E597A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59780 NtMapViewOfSection,LdrInitializeThunk, 1_2_06E59780
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59710 NtQueryInformationToken,LdrInitializeThunk, 1_2_06E59710
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E595D0 NtClose,LdrInitializeThunk, 1_2_06E595D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59540 NtReadFile,LdrInitializeThunk, 1_2_06E59540
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59A50 NtCreateFile,LdrInitializeThunk, 1_2_06E59A50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59A20 NtResumeThread,LdrInitializeThunk, 1_2_06E59A20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59A00 NtProtectVirtualMemory,LdrInitializeThunk, 1_2_06E59A00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E598F0 NtReadVirtualMemory,LdrInitializeThunk, 1_2_06E598F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59860 NtQuerySystemInformation,LdrInitializeThunk, 1_2_06E59860
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59840 NtDelayExecution,LdrInitializeThunk, 1_2_06E59840
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E599A0 NtCreateSection,LdrInitializeThunk, 1_2_06E599A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59910 NtAdjustPrivilegesToken,LdrInitializeThunk, 1_2_06E59910
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E596D0 NtCreateKey, 1_2_06E596D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59670 NtQueryInformationProcess, 1_2_06E59670
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59650 NtQueryValueKey, 1_2_06E59650
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59610 NtEnumerateValueKey, 1_2_06E59610
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59760 NtOpenProcess, 1_2_06E59760
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E5A770 NtOpenThread, 1_2_06E5A770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59770 NtSetInformationFile, 1_2_06E59770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59730 NtQueryVirtualMemory, 1_2_06E59730
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E5A710 NtOpenProcessToken, 1_2_06E5A710
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E595F0 NtQueryInformationFile, 1_2_06E595F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59560 NtWriteFile, 1_2_06E59560
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59520 NtWaitForSingleObject, 1_2_06E59520
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E5AD30 NtSetContextThread, 1_2_06E5AD30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59A80 NtOpenDirectoryObject, 1_2_06E59A80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59A10 NtQuerySection, 1_2_06E59A10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E5A3B0 NtGetContextThread, 1_2_06E5A3B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59B00 NtSetValueKey, 1_2_06E59B00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E598A0 NtWriteVirtualMemory, 1_2_06E598A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E5B040 NtSuspendThread, 1_2_06E5B040
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59820 NtEnumerateKey, 1_2_06E59820
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E599D0 NtCreateProcessEx, 1_2_06E599D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E59950 NtQueueApcThread, 1_2_06E59950
Abnormal high CPU Usage
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process Stats: CPU usage > 98%
Tries to load missing DLLs
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Section loaded: amtahoo.dll Jump to behavior
Source: 0321423605241625.exe ReversingLabs: Detection: 35%
Source: 0321423605241625.exe Virustotal: Detection: 40%
Source: C:\Users\user\Desktop\0321423605241625.exe File read: C:\Users\user\Desktop\0321423605241625.exe Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\0321423605241625.exe C:\Users\user\Desktop\0321423605241625.exe
Source: C:\Users\user\Desktop\0321423605241625.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\Public\Libraries\Mwqrxeuz.exe "C:\Users\Public\Libraries\Mwqrxeuz.exe"
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\raserver.exe C:\Windows\SysWOW64\raserver.exe
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\colorcpl.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0321423605241625.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\Public\Libraries\Mwqrxeuz.exe "C:\Users\Public\Libraries\Mwqrxeuz.exe" Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\colorcpl.exe" Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@11/5@8/1
Source: C:\Windows\explorer.exe File read: C:\Users\Public\Libraries\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0217823C GetDiskFreeSpaceA, 0_2_0217823C
Source: C:\Users\user\Desktop\0321423605241625.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02185770 CreateToolhelp32Snapshot, 0_2_02185770
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1412:120:WilError_01
Source: C:\Users\user\Desktop\0321423605241625.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Window found: window name: SysTabControl32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\colorcpl.exe Window detected: Number of UI elements: 12
Source: Binary string: colorcpl.pdbGCTL source: raserver.exe, 00000009.00000002.556117926.0000000005257000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000009.00000002.553458668.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: colorcpl.pdb source: raserver.exe, 00000009.00000002.556117926.0000000005257000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000009.00000002.553458668.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: colorcpl.exe, 00000001.00000003.306684881.000000000503F000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.505224906.0000000006F0F000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000003.308280419.00000000051D9000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.500567778.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000003.493545986.00000000049ED000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000002.553968858.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000003.499251021.0000000004B8C000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000002.554941231.0000000004E3F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: colorcpl.exe, colorcpl.exe, 00000001.00000003.306684881.000000000503F000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.505224906.0000000006F0F000.00000040.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000003.308280419.00000000051D9000.00000004.00000800.00020000.00000000.sdmp, colorcpl.exe, 00000001.00000002.500567778.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000003.493545986.00000000049ED000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000002.553968858.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000003.499251021.0000000004B8C000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 00000009.00000002.554941231.0000000004E3F000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
Yara detected DBatLoader
Source: Yara match File source: 0.2.0321423605241625.exe.3baeed8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.0321423605241625.exe.2170000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.0321423605241625.exe.3baeed8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.308860487.0000000003BAE000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.308375056.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0218F2A4 push 0218F310h; ret 0_2_0218F308
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0218F0AC push 0218F125h; ret 0_2_0218F11D
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0218F144 push 0218F1ECh; ret 0_2_0218F1E4
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0218F1F8 push 0218F288h; ret 0_2_0218F280
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02190667 pushad ; ret 0_2_0219068D
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0217C718 push ecx; mov dword ptr [esp], edx 0_2_0217C71D
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0217D78C push 0217D7B8h; ret 0_2_0217D7B0
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02185488 push 021854F2h; ret 0_2_021854EA
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_021844AC push 021844EEh; ret 0_2_021844E6
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_021884FB push 02188554h; ret 0_2_0218854C
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_021884FC push 02188554h; ret 0_2_0218854C
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_021835A8 push 02183653h; ret 0_2_0218364B
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_021835A6 push 02183653h; ret 0_2_0218364B
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_021765FC push 02176657h; ret 0_2_0217664F
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_021765FA push 02176657h; ret 0_2_0217664F
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02176A48 push 02176A8Ah; ret 0_2_02176A82
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0217CB4C push 0217CFA2h; ret 0_2_0217CF9A
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02173894 push eax; ret 0_2_021738D0
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0217CE1C push 0217CFA2h; ret 0_2_0217CF9A
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0217FEA0 push 0217FF16h; ret 0_2_0217FF0E
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0217FFA4 push 0217FFF1h; ret 0_2_0217FFE9
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0217FFA3 push 0217FFF1h; ret 0_2_0217FFE9
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02188C58 push ecx; mov dword ptr [esp], edx 0_2_02188C5D
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0218EC64 push 0218EE54h; ret 0_2_0218EE4C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E6D0D1 push ecx; ret 1_2_06E6D0E4
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02186388 InetIsOffline,VirtualAlloc,GetProcAddress,FreeLibrary,VirtualAlloc,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualAlloc,VirtualProtect,FreeLibrary, 0_2_02186388
Drops PE files
Source: C:\Users\user\Desktop\0321423605241625.exe File created: C:\Users\Public\Libraries\Mwqrxeuz.exe Jump to dropped file
Source: C:\Users\user\Desktop\0321423605241625.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Mwqrxeuz Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Mwqrxeuz Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_021854F4 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_021854F4
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mwqrxeuz.exe Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\SysWOW64\colorcpl.exe RDTSC instruction interceptor: First address: 0000000010418604 second address: 000000001041860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe RDTSC instruction interceptor: First address: 000000001041899E second address: 00000000104189A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe RDTSC instruction interceptor: First address: 0000000002D88604 second address: 0000000002D8860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe RDTSC instruction interceptor: First address: 0000000002D8899E second address: 0000000002D889A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\raserver.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E56DE6 rdtsc 1_2_06E56DE6
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\colorcpl.exe API coverage: 4.2 %
Source: C:\Users\user\Desktop\0321423605241625.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02175B48 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 0_2_02175B48
Source: C:\Users\user\Desktop\0321423605241625.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\0321423605241625.exe API call chain: ExitProcess graph end node
Source: explorer.exe, 00000002.00000000.387219526.0000000008631000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000002.00000000.477730191.000000000ED50000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.333810974.00000000086E7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}i
Source: explorer.exe, 00000002.00000000.333810974.00000000086E7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.477730191.000000000ED50000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}217G
Source: explorer.exe, 00000002.00000000.312701350.00000000043B0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 0321423605241625.exe, 00000000.00000002.307257682.000000000083B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000002.00000000.333810974.00000000086E7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: 0321423605241625.exe, 00000000.00000002.307058995.00000000007FF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0X
Source: explorer.exe, 00000002.00000000.387219526.0000000008631000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: Mwqrxeuz.exe, 00000003.00000002.542721424.000000000074D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 0321423605241625.exe, 00000000.00000002.307257682.000000000083B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW$
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02186388 InetIsOffline,VirtualAlloc,GetProcAddress,FreeLibrary,VirtualAlloc,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualAlloc,VirtualProtect,FreeLibrary, 0_2_02186388
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E56DE6 rdtsc 1_2_06E56DE6
Enables debug privileges
Source: C:\Windows\SysWOW64\colorcpl.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E276E2 mov eax, dword ptr fs:[00000030h] 1_2_06E276E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E416E0 mov ecx, dword ptr fs:[00000030h] 1_2_06E416E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E58EC7 mov eax, dword ptr fs:[00000030h] 1_2_06E58EC7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E436CC mov eax, dword ptr fs:[00000030h] 1_2_06E436CC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ECFEC0 mov eax, dword ptr fs:[00000030h] 1_2_06ECFEC0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE8ED6 mov eax, dword ptr fs:[00000030h] 1_2_06EE8ED6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE0EA5 mov eax, dword ptr fs:[00000030h] 1_2_06EE0EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE0EA5 mov eax, dword ptr fs:[00000030h] 1_2_06EE0EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE0EA5 mov eax, dword ptr fs:[00000030h] 1_2_06EE0EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E946A7 mov eax, dword ptr fs:[00000030h] 1_2_06E946A7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EAFE87 mov eax, dword ptr fs:[00000030h] 1_2_06EAFE87
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2766D mov eax, dword ptr fs:[00000030h] 1_2_06E2766D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3AE73 mov eax, dword ptr fs:[00000030h] 1_2_06E3AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3AE73 mov eax, dword ptr fs:[00000030h] 1_2_06E3AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3AE73 mov eax, dword ptr fs:[00000030h] 1_2_06E3AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3AE73 mov eax, dword ptr fs:[00000030h] 1_2_06E3AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3AE73 mov eax, dword ptr fs:[00000030h] 1_2_06E3AE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E27E41 mov eax, dword ptr fs:[00000030h] 1_2_06E27E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E27E41 mov eax, dword ptr fs:[00000030h] 1_2_06E27E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E27E41 mov eax, dword ptr fs:[00000030h] 1_2_06E27E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E27E41 mov eax, dword ptr fs:[00000030h] 1_2_06E27E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E27E41 mov eax, dword ptr fs:[00000030h] 1_2_06E27E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E27E41 mov eax, dword ptr fs:[00000030h] 1_2_06E27E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EDAE44 mov eax, dword ptr fs:[00000030h] 1_2_06EDAE44
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EDAE44 mov eax, dword ptr fs:[00000030h] 1_2_06EDAE44
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1E620 mov eax, dword ptr fs:[00000030h] 1_2_06E1E620
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ECFE3F mov eax, dword ptr fs:[00000030h] 1_2_06ECFE3F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1C600 mov eax, dword ptr fs:[00000030h] 1_2_06E1C600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1C600 mov eax, dword ptr fs:[00000030h] 1_2_06E1C600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1C600 mov eax, dword ptr fs:[00000030h] 1_2_06E1C600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E48E00 mov eax, dword ptr fs:[00000030h] 1_2_06E48E00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1608 mov eax, dword ptr fs:[00000030h] 1_2_06ED1608
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4A61C mov eax, dword ptr fs:[00000030h] 1_2_06E4A61C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4A61C mov eax, dword ptr fs:[00000030h] 1_2_06E4A61C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E537F5 mov eax, dword ptr fs:[00000030h] 1_2_06E537F5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E28794 mov eax, dword ptr fs:[00000030h] 1_2_06E28794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E97794 mov eax, dword ptr fs:[00000030h] 1_2_06E97794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E97794 mov eax, dword ptr fs:[00000030h] 1_2_06E97794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E97794 mov eax, dword ptr fs:[00000030h] 1_2_06E97794
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2FF60 mov eax, dword ptr fs:[00000030h] 1_2_06E2FF60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE8F6A mov eax, dword ptr fs:[00000030h] 1_2_06EE8F6A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2EF40 mov eax, dword ptr fs:[00000030h] 1_2_06E2EF40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E14F2E mov eax, dword ptr fs:[00000030h] 1_2_06E14F2E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E14F2E mov eax, dword ptr fs:[00000030h] 1_2_06E14F2E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4E730 mov eax, dword ptr fs:[00000030h] 1_2_06E4E730
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B73D mov eax, dword ptr fs:[00000030h] 1_2_06E3B73D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B73D mov eax, dword ptr fs:[00000030h] 1_2_06E3B73D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE070D mov eax, dword ptr fs:[00000030h] 1_2_06EE070D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE070D mov eax, dword ptr fs:[00000030h] 1_2_06EE070D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4A70E mov eax, dword ptr fs:[00000030h] 1_2_06E4A70E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4A70E mov eax, dword ptr fs:[00000030h] 1_2_06E4A70E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3F716 mov eax, dword ptr fs:[00000030h] 1_2_06E3F716
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EAFF10 mov eax, dword ptr fs:[00000030h] 1_2_06EAFF10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EAFF10 mov eax, dword ptr fs:[00000030h] 1_2_06EAFF10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED14FB mov eax, dword ptr fs:[00000030h] 1_2_06ED14FB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E96CF0 mov eax, dword ptr fs:[00000030h] 1_2_06E96CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E96CF0 mov eax, dword ptr fs:[00000030h] 1_2_06E96CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E96CF0 mov eax, dword ptr fs:[00000030h] 1_2_06E96CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE8CD6 mov eax, dword ptr fs:[00000030h] 1_2_06EE8CD6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2849B mov eax, dword ptr fs:[00000030h] 1_2_06E2849B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4496 mov eax, dword ptr fs:[00000030h] 1_2_06ED4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4496 mov eax, dword ptr fs:[00000030h] 1_2_06ED4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4496 mov eax, dword ptr fs:[00000030h] 1_2_06ED4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4496 mov eax, dword ptr fs:[00000030h] 1_2_06ED4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4496 mov eax, dword ptr fs:[00000030h] 1_2_06ED4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4496 mov eax, dword ptr fs:[00000030h] 1_2_06ED4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4496 mov eax, dword ptr fs:[00000030h] 1_2_06ED4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4496 mov eax, dword ptr fs:[00000030h] 1_2_06ED4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4496 mov eax, dword ptr fs:[00000030h] 1_2_06ED4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4496 mov eax, dword ptr fs:[00000030h] 1_2_06ED4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4496 mov eax, dword ptr fs:[00000030h] 1_2_06ED4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4496 mov eax, dword ptr fs:[00000030h] 1_2_06ED4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4496 mov eax, dword ptr fs:[00000030h] 1_2_06ED4496
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3746D mov eax, dword ptr fs:[00000030h] 1_2_06E3746D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B477 mov eax, dword ptr fs:[00000030h] 1_2_06E3B477
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B477 mov eax, dword ptr fs:[00000030h] 1_2_06E3B477
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B477 mov eax, dword ptr fs:[00000030h] 1_2_06E3B477
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B477 mov eax, dword ptr fs:[00000030h] 1_2_06E3B477
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B477 mov eax, dword ptr fs:[00000030h] 1_2_06E3B477
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B477 mov eax, dword ptr fs:[00000030h] 1_2_06E3B477
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B477 mov eax, dword ptr fs:[00000030h] 1_2_06E3B477
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B477 mov eax, dword ptr fs:[00000030h] 1_2_06E3B477
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B477 mov eax, dword ptr fs:[00000030h] 1_2_06E3B477
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B477 mov eax, dword ptr fs:[00000030h] 1_2_06E3B477
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B477 mov eax, dword ptr fs:[00000030h] 1_2_06E3B477
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B477 mov eax, dword ptr fs:[00000030h] 1_2_06E3B477
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4AC7B mov eax, dword ptr fs:[00000030h] 1_2_06E4AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4AC7B mov eax, dword ptr fs:[00000030h] 1_2_06E4AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4AC7B mov eax, dword ptr fs:[00000030h] 1_2_06E4AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4AC7B mov eax, dword ptr fs:[00000030h] 1_2_06E4AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4AC7B mov eax, dword ptr fs:[00000030h] 1_2_06E4AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4AC7B mov eax, dword ptr fs:[00000030h] 1_2_06E4AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4AC7B mov eax, dword ptr fs:[00000030h] 1_2_06E4AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4AC7B mov eax, dword ptr fs:[00000030h] 1_2_06E4AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4AC7B mov eax, dword ptr fs:[00000030h] 1_2_06E4AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4AC7B mov eax, dword ptr fs:[00000030h] 1_2_06E4AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4AC7B mov eax, dword ptr fs:[00000030h] 1_2_06E4AC7B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4A44B mov eax, dword ptr fs:[00000030h] 1_2_06E4A44B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EAC450 mov eax, dword ptr fs:[00000030h] 1_2_06EAC450
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EAC450 mov eax, dword ptr fs:[00000030h] 1_2_06EAC450
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4BC2C mov eax, dword ptr fs:[00000030h] 1_2_06E4BC2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE740D mov eax, dword ptr fs:[00000030h] 1_2_06EE740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE740D mov eax, dword ptr fs:[00000030h] 1_2_06EE740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE740D mov eax, dword ptr fs:[00000030h] 1_2_06EE740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E96C0A mov eax, dword ptr fs:[00000030h] 1_2_06E96C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E96C0A mov eax, dword ptr fs:[00000030h] 1_2_06E96C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E96C0A mov eax, dword ptr fs:[00000030h] 1_2_06E96C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E96C0A mov eax, dword ptr fs:[00000030h] 1_2_06E96C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1C06 mov eax, dword ptr fs:[00000030h] 1_2_06ED1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1C06 mov eax, dword ptr fs:[00000030h] 1_2_06ED1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1C06 mov eax, dword ptr fs:[00000030h] 1_2_06ED1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1C06 mov eax, dword ptr fs:[00000030h] 1_2_06ED1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1C06 mov eax, dword ptr fs:[00000030h] 1_2_06ED1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1C06 mov eax, dword ptr fs:[00000030h] 1_2_06ED1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1C06 mov eax, dword ptr fs:[00000030h] 1_2_06ED1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1C06 mov eax, dword ptr fs:[00000030h] 1_2_06ED1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1C06 mov eax, dword ptr fs:[00000030h] 1_2_06ED1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1C06 mov eax, dword ptr fs:[00000030h] 1_2_06ED1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1C06 mov eax, dword ptr fs:[00000030h] 1_2_06ED1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1C06 mov eax, dword ptr fs:[00000030h] 1_2_06ED1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1C06 mov eax, dword ptr fs:[00000030h] 1_2_06ED1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED1C06 mov eax, dword ptr fs:[00000030h] 1_2_06ED1C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2D5E0 mov eax, dword ptr fs:[00000030h] 1_2_06E2D5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2D5E0 mov eax, dword ptr fs:[00000030h] 1_2_06E2D5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EDFDE2 mov eax, dword ptr fs:[00000030h] 1_2_06EDFDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EDFDE2 mov eax, dword ptr fs:[00000030h] 1_2_06EDFDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EDFDE2 mov eax, dword ptr fs:[00000030h] 1_2_06EDFDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EDFDE2 mov eax, dword ptr fs:[00000030h] 1_2_06EDFDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EC8DF1 mov eax, dword ptr fs:[00000030h] 1_2_06EC8DF1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E96DC9 mov eax, dword ptr fs:[00000030h] 1_2_06E96DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E96DC9 mov eax, dword ptr fs:[00000030h] 1_2_06E96DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E96DC9 mov eax, dword ptr fs:[00000030h] 1_2_06E96DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E96DC9 mov ecx, dword ptr fs:[00000030h] 1_2_06E96DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E96DC9 mov eax, dword ptr fs:[00000030h] 1_2_06E96DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E96DC9 mov eax, dword ptr fs:[00000030h] 1_2_06E96DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE05AC mov eax, dword ptr fs:[00000030h] 1_2_06EE05AC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE05AC mov eax, dword ptr fs:[00000030h] 1_2_06EE05AC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E435A1 mov eax, dword ptr fs:[00000030h] 1_2_06E435A1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E41DB5 mov eax, dword ptr fs:[00000030h] 1_2_06E41DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E41DB5 mov eax, dword ptr fs:[00000030h] 1_2_06E41DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E41DB5 mov eax, dword ptr fs:[00000030h] 1_2_06E41DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E42581 mov eax, dword ptr fs:[00000030h] 1_2_06E42581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E42581 mov eax, dword ptr fs:[00000030h] 1_2_06E42581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E42581 mov eax, dword ptr fs:[00000030h] 1_2_06E42581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E42581 mov eax, dword ptr fs:[00000030h] 1_2_06E42581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E12D8A mov eax, dword ptr fs:[00000030h] 1_2_06E12D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E12D8A mov eax, dword ptr fs:[00000030h] 1_2_06E12D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E12D8A mov eax, dword ptr fs:[00000030h] 1_2_06E12D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E12D8A mov eax, dword ptr fs:[00000030h] 1_2_06E12D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E12D8A mov eax, dword ptr fs:[00000030h] 1_2_06E12D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED2D82 mov eax, dword ptr fs:[00000030h] 1_2_06ED2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED2D82 mov eax, dword ptr fs:[00000030h] 1_2_06ED2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED2D82 mov eax, dword ptr fs:[00000030h] 1_2_06ED2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED2D82 mov eax, dword ptr fs:[00000030h] 1_2_06ED2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED2D82 mov eax, dword ptr fs:[00000030h] 1_2_06ED2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED2D82 mov eax, dword ptr fs:[00000030h] 1_2_06ED2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED2D82 mov eax, dword ptr fs:[00000030h] 1_2_06ED2D82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4FD9B mov eax, dword ptr fs:[00000030h] 1_2_06E4FD9B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4FD9B mov eax, dword ptr fs:[00000030h] 1_2_06E4FD9B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3C577 mov eax, dword ptr fs:[00000030h] 1_2_06E3C577
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3C577 mov eax, dword ptr fs:[00000030h] 1_2_06E3C577
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E53D43 mov eax, dword ptr fs:[00000030h] 1_2_06E53D43
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E93540 mov eax, dword ptr fs:[00000030h] 1_2_06E93540
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EC3D40 mov eax, dword ptr fs:[00000030h] 1_2_06EC3D40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E37D50 mov eax, dword ptr fs:[00000030h] 1_2_06E37D50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1AD30 mov eax, dword ptr fs:[00000030h] 1_2_06E1AD30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EDE539 mov eax, dword ptr fs:[00000030h] 1_2_06EDE539
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E23D34 mov eax, dword ptr fs:[00000030h] 1_2_06E23D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E23D34 mov eax, dword ptr fs:[00000030h] 1_2_06E23D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E23D34 mov eax, dword ptr fs:[00000030h] 1_2_06E23D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E23D34 mov eax, dword ptr fs:[00000030h] 1_2_06E23D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E23D34 mov eax, dword ptr fs:[00000030h] 1_2_06E23D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E23D34 mov eax, dword ptr fs:[00000030h] 1_2_06E23D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E23D34 mov eax, dword ptr fs:[00000030h] 1_2_06E23D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E23D34 mov eax, dword ptr fs:[00000030h] 1_2_06E23D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E23D34 mov eax, dword ptr fs:[00000030h] 1_2_06E23D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E23D34 mov eax, dword ptr fs:[00000030h] 1_2_06E23D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E23D34 mov eax, dword ptr fs:[00000030h] 1_2_06E23D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E23D34 mov eax, dword ptr fs:[00000030h] 1_2_06E23D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E23D34 mov eax, dword ptr fs:[00000030h] 1_2_06E23D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE8D34 mov eax, dword ptr fs:[00000030h] 1_2_06EE8D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E9A537 mov eax, dword ptr fs:[00000030h] 1_2_06E9A537
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E44D3B mov eax, dword ptr fs:[00000030h] 1_2_06E44D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E44D3B mov eax, dword ptr fs:[00000030h] 1_2_06E44D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E44D3B mov eax, dword ptr fs:[00000030h] 1_2_06E44D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E42AE4 mov eax, dword ptr fs:[00000030h] 1_2_06E42AE4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF mov eax, dword ptr fs:[00000030h] 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF mov eax, dword ptr fs:[00000030h] 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF mov eax, dword ptr fs:[00000030h] 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF mov eax, dword ptr fs:[00000030h] 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF mov eax, dword ptr fs:[00000030h] 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF mov eax, dword ptr fs:[00000030h] 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF mov eax, dword ptr fs:[00000030h] 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF mov eax, dword ptr fs:[00000030h] 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF mov eax, dword ptr fs:[00000030h] 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF mov eax, dword ptr fs:[00000030h] 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF mov eax, dword ptr fs:[00000030h] 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF mov eax, dword ptr fs:[00000030h] 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF mov eax, dword ptr fs:[00000030h] 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED4AEF mov eax, dword ptr fs:[00000030h] 1_2_06ED4AEF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E42ACB mov eax, dword ptr fs:[00000030h] 1_2_06E42ACB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E152A5 mov eax, dword ptr fs:[00000030h] 1_2_06E152A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E152A5 mov eax, dword ptr fs:[00000030h] 1_2_06E152A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E152A5 mov eax, dword ptr fs:[00000030h] 1_2_06E152A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E152A5 mov eax, dword ptr fs:[00000030h] 1_2_06E152A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E152A5 mov eax, dword ptr fs:[00000030h] 1_2_06E152A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2AAB0 mov eax, dword ptr fs:[00000030h] 1_2_06E2AAB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2AAB0 mov eax, dword ptr fs:[00000030h] 1_2_06E2AAB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4FAB0 mov eax, dword ptr fs:[00000030h] 1_2_06E4FAB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4D294 mov eax, dword ptr fs:[00000030h] 1_2_06E4D294
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4D294 mov eax, dword ptr fs:[00000030h] 1_2_06E4D294
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ECB260 mov eax, dword ptr fs:[00000030h] 1_2_06ECB260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ECB260 mov eax, dword ptr fs:[00000030h] 1_2_06ECB260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE8A62 mov eax, dword ptr fs:[00000030h] 1_2_06EE8A62
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E5927A mov eax, dword ptr fs:[00000030h] 1_2_06E5927A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E19240 mov eax, dword ptr fs:[00000030h] 1_2_06E19240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E19240 mov eax, dword ptr fs:[00000030h] 1_2_06E19240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E19240 mov eax, dword ptr fs:[00000030h] 1_2_06E19240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E19240 mov eax, dword ptr fs:[00000030h] 1_2_06E19240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EDEA55 mov eax, dword ptr fs:[00000030h] 1_2_06EDEA55
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EA4257 mov eax, dword ptr fs:[00000030h] 1_2_06EA4257
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E54A2C mov eax, dword ptr fs:[00000030h] 1_2_06E54A2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E54A2C mov eax, dword ptr fs:[00000030h] 1_2_06E54A2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A229 mov eax, dword ptr fs:[00000030h] 1_2_06E3A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A229 mov eax, dword ptr fs:[00000030h] 1_2_06E3A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A229 mov eax, dword ptr fs:[00000030h] 1_2_06E3A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A229 mov eax, dword ptr fs:[00000030h] 1_2_06E3A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A229 mov eax, dword ptr fs:[00000030h] 1_2_06E3A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A229 mov eax, dword ptr fs:[00000030h] 1_2_06E3A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A229 mov eax, dword ptr fs:[00000030h] 1_2_06E3A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A229 mov eax, dword ptr fs:[00000030h] 1_2_06E3A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A229 mov eax, dword ptr fs:[00000030h] 1_2_06E3A229
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B236 mov eax, dword ptr fs:[00000030h] 1_2_06E3B236
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B236 mov eax, dword ptr fs:[00000030h] 1_2_06E3B236
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B236 mov eax, dword ptr fs:[00000030h] 1_2_06E3B236
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B236 mov eax, dword ptr fs:[00000030h] 1_2_06E3B236
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B236 mov eax, dword ptr fs:[00000030h] 1_2_06E3B236
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B236 mov eax, dword ptr fs:[00000030h] 1_2_06E3B236
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E28A0A mov eax, dword ptr fs:[00000030h] 1_2_06E28A0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E15210 mov eax, dword ptr fs:[00000030h] 1_2_06E15210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E15210 mov ecx, dword ptr fs:[00000030h] 1_2_06E15210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E15210 mov eax, dword ptr fs:[00000030h] 1_2_06E15210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E15210 mov eax, dword ptr fs:[00000030h] 1_2_06E15210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1AA16 mov eax, dword ptr fs:[00000030h] 1_2_06E1AA16
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1AA16 mov eax, dword ptr fs:[00000030h] 1_2_06E1AA16
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EDAA16 mov eax, dword ptr fs:[00000030h] 1_2_06EDAA16
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EDAA16 mov eax, dword ptr fs:[00000030h] 1_2_06EDAA16
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E33A1C mov eax, dword ptr fs:[00000030h] 1_2_06E33A1C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E403E2 mov eax, dword ptr fs:[00000030h] 1_2_06E403E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E403E2 mov eax, dword ptr fs:[00000030h] 1_2_06E403E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E403E2 mov eax, dword ptr fs:[00000030h] 1_2_06E403E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E403E2 mov eax, dword ptr fs:[00000030h] 1_2_06E403E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E403E2 mov eax, dword ptr fs:[00000030h] 1_2_06E403E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E403E2 mov eax, dword ptr fs:[00000030h] 1_2_06E403E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3DBE9 mov eax, dword ptr fs:[00000030h] 1_2_06E3DBE9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EC23E3 mov ecx, dword ptr fs:[00000030h] 1_2_06EC23E3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EC23E3 mov ecx, dword ptr fs:[00000030h] 1_2_06EC23E3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EC23E3 mov eax, dword ptr fs:[00000030h] 1_2_06EC23E3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E953CA mov eax, dword ptr fs:[00000030h] 1_2_06E953CA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E953CA mov eax, dword ptr fs:[00000030h] 1_2_06E953CA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E44BAD mov eax, dword ptr fs:[00000030h] 1_2_06E44BAD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E44BAD mov eax, dword ptr fs:[00000030h] 1_2_06E44BAD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E44BAD mov eax, dword ptr fs:[00000030h] 1_2_06E44BAD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE5BA5 mov eax, dword ptr fs:[00000030h] 1_2_06EE5BA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED138A mov eax, dword ptr fs:[00000030h] 1_2_06ED138A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ECD380 mov ecx, dword ptr fs:[00000030h] 1_2_06ECD380
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E21B8F mov eax, dword ptr fs:[00000030h] 1_2_06E21B8F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E21B8F mov eax, dword ptr fs:[00000030h] 1_2_06E21B8F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4138B mov eax, dword ptr fs:[00000030h] 1_2_06E4138B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4138B mov eax, dword ptr fs:[00000030h] 1_2_06E4138B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4138B mov eax, dword ptr fs:[00000030h] 1_2_06E4138B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E42397 mov eax, dword ptr fs:[00000030h] 1_2_06E42397
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4B390 mov eax, dword ptr fs:[00000030h] 1_2_06E4B390
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1DB60 mov ecx, dword ptr fs:[00000030h] 1_2_06E1DB60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E43B7A mov eax, dword ptr fs:[00000030h] 1_2_06E43B7A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E43B7A mov eax, dword ptr fs:[00000030h] 1_2_06E43B7A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1DB40 mov eax, dword ptr fs:[00000030h] 1_2_06E1DB40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE8B58 mov eax, dword ptr fs:[00000030h] 1_2_06EE8B58
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1F358 mov eax, dword ptr fs:[00000030h] 1_2_06E1F358
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A309 mov eax, dword ptr fs:[00000030h] 1_2_06E3A309
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED131B mov eax, dword ptr fs:[00000030h] 1_2_06ED131B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E140E1 mov eax, dword ptr fs:[00000030h] 1_2_06E140E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E140E1 mov eax, dword ptr fs:[00000030h] 1_2_06E140E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E140E1 mov eax, dword ptr fs:[00000030h] 1_2_06E140E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B8E4 mov eax, dword ptr fs:[00000030h] 1_2_06E3B8E4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B8E4 mov eax, dword ptr fs:[00000030h] 1_2_06E3B8E4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E158EC mov eax, dword ptr fs:[00000030h] 1_2_06E158EC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EAB8D0 mov eax, dword ptr fs:[00000030h] 1_2_06EAB8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EAB8D0 mov ecx, dword ptr fs:[00000030h] 1_2_06EAB8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EAB8D0 mov eax, dword ptr fs:[00000030h] 1_2_06EAB8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EAB8D0 mov eax, dword ptr fs:[00000030h] 1_2_06EAB8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EAB8D0 mov eax, dword ptr fs:[00000030h] 1_2_06EAB8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EAB8D0 mov eax, dword ptr fs:[00000030h] 1_2_06EAB8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E420A0 mov eax, dword ptr fs:[00000030h] 1_2_06E420A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E420A0 mov eax, dword ptr fs:[00000030h] 1_2_06E420A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E420A0 mov eax, dword ptr fs:[00000030h] 1_2_06E420A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E420A0 mov eax, dword ptr fs:[00000030h] 1_2_06E420A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E420A0 mov eax, dword ptr fs:[00000030h] 1_2_06E420A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E420A0 mov eax, dword ptr fs:[00000030h] 1_2_06E420A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E590AF mov eax, dword ptr fs:[00000030h] 1_2_06E590AF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4F0BF mov ecx, dword ptr fs:[00000030h] 1_2_06E4F0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4F0BF mov eax, dword ptr fs:[00000030h] 1_2_06E4F0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4F0BF mov eax, dword ptr fs:[00000030h] 1_2_06E4F0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E19080 mov eax, dword ptr fs:[00000030h] 1_2_06E19080
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E93884 mov eax, dword ptr fs:[00000030h] 1_2_06E93884
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E93884 mov eax, dword ptr fs:[00000030h] 1_2_06E93884
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE1074 mov eax, dword ptr fs:[00000030h] 1_2_06EE1074
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED2073 mov eax, dword ptr fs:[00000030h] 1_2_06ED2073
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E30050 mov eax, dword ptr fs:[00000030h] 1_2_06E30050
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E30050 mov eax, dword ptr fs:[00000030h] 1_2_06E30050
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2B02A mov eax, dword ptr fs:[00000030h] 1_2_06E2B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2B02A mov eax, dword ptr fs:[00000030h] 1_2_06E2B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2B02A mov eax, dword ptr fs:[00000030h] 1_2_06E2B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E2B02A mov eax, dword ptr fs:[00000030h] 1_2_06E2B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4002D mov eax, dword ptr fs:[00000030h] 1_2_06E4002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4002D mov eax, dword ptr fs:[00000030h] 1_2_06E4002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4002D mov eax, dword ptr fs:[00000030h] 1_2_06E4002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4002D mov eax, dword ptr fs:[00000030h] 1_2_06E4002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4002D mov eax, dword ptr fs:[00000030h] 1_2_06E4002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A830 mov eax, dword ptr fs:[00000030h] 1_2_06E3A830
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A830 mov eax, dword ptr fs:[00000030h] 1_2_06E3A830
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A830 mov eax, dword ptr fs:[00000030h] 1_2_06E3A830
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3A830 mov eax, dword ptr fs:[00000030h] 1_2_06E3A830
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE4015 mov eax, dword ptr fs:[00000030h] 1_2_06EE4015
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EE4015 mov eax, dword ptr fs:[00000030h] 1_2_06EE4015
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E97016 mov eax, dword ptr fs:[00000030h] 1_2_06E97016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E97016 mov eax, dword ptr fs:[00000030h] 1_2_06E97016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E97016 mov eax, dword ptr fs:[00000030h] 1_2_06E97016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1B1E1 mov eax, dword ptr fs:[00000030h] 1_2_06E1B1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1B1E1 mov eax, dword ptr fs:[00000030h] 1_2_06E1B1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1B1E1 mov eax, dword ptr fs:[00000030h] 1_2_06E1B1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06EA41E8 mov eax, dword ptr fs:[00000030h] 1_2_06EA41E8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E461A0 mov eax, dword ptr fs:[00000030h] 1_2_06E461A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E461A0 mov eax, dword ptr fs:[00000030h] 1_2_06E461A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED49A4 mov eax, dword ptr fs:[00000030h] 1_2_06ED49A4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED49A4 mov eax, dword ptr fs:[00000030h] 1_2_06ED49A4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED49A4 mov eax, dword ptr fs:[00000030h] 1_2_06ED49A4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06ED49A4 mov eax, dword ptr fs:[00000030h] 1_2_06ED49A4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E969A6 mov eax, dword ptr fs:[00000030h] 1_2_06E969A6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E951BE mov eax, dword ptr fs:[00000030h] 1_2_06E951BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E951BE mov eax, dword ptr fs:[00000030h] 1_2_06E951BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E951BE mov eax, dword ptr fs:[00000030h] 1_2_06E951BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E951BE mov eax, dword ptr fs:[00000030h] 1_2_06E951BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E399BF mov ecx, dword ptr fs:[00000030h] 1_2_06E399BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E399BF mov ecx, dword ptr fs:[00000030h] 1_2_06E399BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E399BF mov eax, dword ptr fs:[00000030h] 1_2_06E399BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E399BF mov ecx, dword ptr fs:[00000030h] 1_2_06E399BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E399BF mov ecx, dword ptr fs:[00000030h] 1_2_06E399BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E399BF mov eax, dword ptr fs:[00000030h] 1_2_06E399BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E399BF mov ecx, dword ptr fs:[00000030h] 1_2_06E399BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E399BF mov ecx, dword ptr fs:[00000030h] 1_2_06E399BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E399BF mov eax, dword ptr fs:[00000030h] 1_2_06E399BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E399BF mov ecx, dword ptr fs:[00000030h] 1_2_06E399BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E399BF mov ecx, dword ptr fs:[00000030h] 1_2_06E399BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E399BF mov eax, dword ptr fs:[00000030h] 1_2_06E399BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3C182 mov eax, dword ptr fs:[00000030h] 1_2_06E3C182
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4A185 mov eax, dword ptr fs:[00000030h] 1_2_06E4A185
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E42990 mov eax, dword ptr fs:[00000030h] 1_2_06E42990
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1C962 mov eax, dword ptr fs:[00000030h] 1_2_06E1C962
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1B171 mov eax, dword ptr fs:[00000030h] 1_2_06E1B171
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E1B171 mov eax, dword ptr fs:[00000030h] 1_2_06E1B171
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B944 mov eax, dword ptr fs:[00000030h] 1_2_06E3B944
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E3B944 mov eax, dword ptr fs:[00000030h] 1_2_06E3B944
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E34120 mov eax, dword ptr fs:[00000030h] 1_2_06E34120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E34120 mov eax, dword ptr fs:[00000030h] 1_2_06E34120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E34120 mov eax, dword ptr fs:[00000030h] 1_2_06E34120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E34120 mov eax, dword ptr fs:[00000030h] 1_2_06E34120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E34120 mov ecx, dword ptr fs:[00000030h] 1_2_06E34120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4513A mov eax, dword ptr fs:[00000030h] 1_2_06E4513A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E4513A mov eax, dword ptr fs:[00000030h] 1_2_06E4513A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E19100 mov eax, dword ptr fs:[00000030h] 1_2_06E19100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E19100 mov eax, dword ptr fs:[00000030h] 1_2_06E19100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E19100 mov eax, dword ptr fs:[00000030h] 1_2_06E19100
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\colorcpl.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 1_2_06E596E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_06E596E0

HIPS / PFW / Operating System Protection Evasion
barindex
Sample uses process hollowing technique
Source: C:\Windows\SysWOW64\colorcpl.exe Section unmapped: C:\Windows\SysWOW64\raserver.exe base address: 870000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\0321423605241625.exe Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 10410000 Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 4A80000 Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 4FA0000 Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\0321423605241625.exe Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 10410000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 4A80000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\0321423605241625.exe Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 4FA0000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\0321423605241625.exe Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 10410000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\colorcpl.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\colorcpl.exe Thread register set: target process: 3324 Jump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\0321423605241625.exe Thread created: C:\Windows\SysWOW64\colorcpl.exe EIP: 4FA0000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\colorcpl.exe" Jump to behavior
Source: explorer.exe, 00000002.00000000.333633898.00000000086B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.387636315.00000000086B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.435849586.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000000.435849586.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.310463769.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.352140639.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: uProgram Manager*r
Source: explorer.exe, 00000002.00000000.435849586.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.310463769.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.352140639.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000002.00000000.435849586.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.310463769.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.352140639.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000000.351540998.0000000000878000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.434029800.0000000000878000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.309952416.0000000000878000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ProgmanLoc*U
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 0_2_02175D0C
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: GetLocaleInfoA, 0_2_0217AA04
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: GetLocaleInfoA, 0_2_0217A9B8
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 0_2_02175E18
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_02179438 GetLocalTime, 0_2_02179438
Source: C:\Users\user\Desktop\0321423605241625.exe Code function: 0_2_0217B938 GetVersionExA, 0_2_0217B938

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.553690913.0000000002C80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.553760643.0000000002D80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.305700476.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.305400692.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.306413915.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.306024723.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.396763474.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.474871458.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.498815518.0000000005140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.309972284.0000000004A7F000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.525904098.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.553544992.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.545995933.00000000046FE000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.495768965.0000000000F20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.colorcpl.exe.10410000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.colorcpl.exe.10410000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.553690913.0000000002C80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.553760643.0000000002D80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.305700476.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.305400692.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.306413915.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.306024723.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.396763474.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.474871458.000000000E3BF000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.498815518.0000000005140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.309972284.0000000004A7F000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.525904098.0000000010410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.553544992.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.545995933.00000000046FE000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.495768965.0000000000F20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 756155 Sample: 0321423605241625.exe Startdate: 29/11/2022 Architecture: WINDOWS Score: 100 36 www.thecuratedpour.com 2->36 38 www.segurofunerarioar.com 2->38 40 7 other IPs or domains 2->40 56 Snort IDS alert for network traffic 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 Antivirus detection for URL or domain 2->60 62 6 other signatures 2->62 11 0321423605241625.exe 1 18 2->11         started        signatures3 process4 dnsIp5 42 l-0003.l-dc-msedge.net 13.107.43.12, 443, 49708 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 11->42 44 ppqfqw.ph.files.1drv.com 11->44 46 2 other IPs or domains 11->46 32 C:\Users\Public\Libraries\Mwqrxeuz.exe, PE32 11->32 dropped 34 C:\Users\...\Mwqrxeuz.exe:Zone.Identifier, ASCII 11->34 dropped 74 Writes to foreign memory regions 11->74 76 Allocates memory in foreign processes 11->76 78 Creates a thread in another existing process (thread injection) 11->78 80 Injects a PE file into a foreign processes 11->80 16 colorcpl.exe 2 11->16         started        file6 signatures7 process8 signatures9 48 Modifies the context of a thread in another process (thread injection) 16->48 50 Maps a DLL or memory area into another process 16->50 52 Sample uses process hollowing technique 16->52 54 2 other signatures 16->54 19 explorer.exe 4 2 16->19 injected process10 process11 21 Mwqrxeuz.exe 19->21         started        24 raserver.exe 19->24         started        signatures12 64 Antivirus detection for dropped file 21->64 66 Multi AV Scanner detection for dropped file 21->66 68 Machine Learning detection for dropped file 21->68 26 colorcpl.exe 21->26         started        70 Maps a DLL or memory area into another process 24->70 72 Tries to detect virtualization through RDTSC time measurements 24->72 28 cmd.exe 1 24->28         started        process13 process14 30 conhost.exe 28->30         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.43.12
 l-0003.l-dc-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Contacted Domains

Name IP Active
www.kuechenpruefer.com 217.160.0.95 true
librairie-adrienne.com 192.0.78.141 true
l-0003.l-dc-msedge.net 13.107.43.12 true
www.customapronsnow.com 52.85.92.84 true
shops.myshopify.com 23.227.38.74 true
www.thecuratedpour.com unknown unknown
onedrive.live.com unknown unknown
www.segurofunerarioar.com unknown unknown
www.librairie-adrienne.com unknown unknown
ppqfqw.ph.files.1drv.com unknown unknown
www.rematedeldia.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.rematedeldia.com/euv4/ true
  • Avira URL Cloud: malware
 low
https://onedrive.live.com/download?cid=E0CF7F9E6AAF27EF&resid=E0CF7F9E6AAF27EF%21846&authkey=AOLP5PRESPN2npo false
    		high
    https://ppqfqw.ph.files.1drv.com/y4mCDNCh3rnIYpJlqIqXCF9hAcHbqZ_4sWcNl3-omCYoNehN1gOwskkZvXxiCnSz1O3rlGujQmh2dpM-9vT8IEOnYjevggDBPg3L6krVTX5rpZ6Y9fWqq7mXN8HP0HSdlr6-fMy35G8DvzJqxvSasnXVIJpB-5dNG-tdgdNk_U_XYoTZ1ccJrC1sgInwIFqmsOi4T1bkt9-CIDRF_pvQqcEQA/Mwqrxeuzvim?download&psid=1 false
      		high