Windows Analysis Report
Swift payment confirmation.exe

Overview

General Information

Sample name: Swift payment confirmation.exe
Analysis ID: 1545881
MD5: 92fdcc36be7b26d49f67f2f02fefbf07
SHA1: f84b37ff359f55cdfc1c60a640cc7081b523e5ce
SHA256: 61cf08eac40229e089f7630d5412aa0a8282c01d6348763d92d68e2fcb92e24e
Tags: exeuser-threatcat_ch
Infos:

Detection

DBatLoader, FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected DBatLoader
Yara detected FormBook
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates a thread in another existing process (thread injection)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Found malware configuration
Source: Swift payment confirmation.exe Malware Configuration Extractor: DBatLoader {"Download Url": ["https://bitbucket.org/akeem4u/canter/downloads/233_Hherfkswbzh"]}
Multi AV Scanner detection for submitted file
Source: Swift payment confirmation.exe ReversingLabs: Detection: 65%
Source: Swift payment confirmation.exe Virustotal: Detection: 61% Perma Link
Yara detected FormBook
Source: Yara match File source: 2.2.colorcpl.exe.6440000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.colorcpl.exe.6440000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2292243782.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2292379544.0000000006440000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: Swift payment confirmation.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Swift payment confirmation.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: unknown HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.102.228:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.102.228:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 3.5.29.82:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: Binary string: easinvoker.pdb source: Swift payment confirmation.exe, Swift payment confirmation.exe, 00000000.00000002.2174249610.00000000032DE000.00000004.00001000.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2042668817.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2041882325.000000007FE00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: colorcpl.exe, 00000002.00000003.2252350083.0000000004C3C000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000002.00000003.2255245800.0000000004DEA000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000002.00000002.2307528675.0000000026760000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000002.00000002.2307528675.00000000268FE000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: colorcpl.exe, colorcpl.exe, 00000002.00000003.2252350083.0000000004C3C000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000002.00000003.2255245800.0000000004DEA000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000002.00000002.2307528675.0000000026760000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000002.00000002.2307528675.00000000268FE000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdbGCTL source: Swift payment confirmation.exe, 00000000.00000002.2174249610.00000000032DE000.00000004.00001000.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000002.2173823942.0000000003211000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2042668817.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2042440140.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2041882325.000000007FE00000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032B5908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 0_2_032B5908

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://bitbucket.org/akeem4u/canter/downloads/233_Hherfkswbzh
Contains functionality to check if a connection to the internet is available
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032CE4B8 InternetCheckConnectionA, 0_2_032CE4B8
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.166.143.50 185.166.143.50
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /akeem4u/canter/downloads/233_Hherfkswbzh HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic HTTP traffic detected: GET /1889f89b-bf3e-4330-a7ab-fccb77ce4890/downloads/fd5ef9c0-51bf-40d2-8c89-83ab9690304a/233_Hherfkswbzh?response-content-disposition=attachment%3B%20filename%3D%22233_Hherfkswbzh%22&AWSAccessKeyId=ASIA6KOSE3BNHI54BTHA&Signature=tZ%2FwwJ1FN%2B1%2B9of%2FJeE%2Bo3BV4Ls%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBEaCXVzLWVhc3QtMSJHMEUCIFSQnqGQH2JEqKJhomymNnCA4lYnl%2BQwEzXvtXq0kv5eAiEAzwxPi7%2FqtIduS1Y4GA0jCPQlS4JfP3JMCl51SCYtQhwqsAIIif%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDNPNgKLBoJg8jVpiLCqEAi5vjLhoUXqOlKLnUE4wl75aM276pOHwyiPYxUuzjzqQA1B6E34B6OOSvX9lsRbi3LuXjpVmDTGcat73%2FcWzvA614Ma6TUDMKcSsazo27JULJRZ60HAvQ7Yunt8LD%2FQJa6KQ7ZNxzvc6Im2AB2zO8JFpXZv88sFixKhA48r6SwpoIz88YU5Xnr7RRc%2FcGRXaCf0kE5TOvVuhRKQjrWpgV5%2B3XwWgYItfw7g%2Fg07uObWaxd%2FrUrcnphxewukr1BGhYJb0b7RPPNZECMwI%2B6Rpgub3znYbt8xERbbjY20apm6JRP0ianWEOKjL4kwde4Jr5x2%2F02F%2BJ8VoBjfD%2FdKx4k1jafP8MJ31jLkGOp0BsobkkeqEKCksULQQEEm05vOtphj3NQN6JxFL1ca%2BqDpxc4FYHr%2FFeBn%2BuqLl2quhEkiq46Ben1DguLLCVBSRqgtlRbI5gEDRpi7ahaj02LzU0cUHpJaeveVZ5yc%2FzTJewE1gFKXv%2FHKIzbpWr%2Fy5ZmwOAXHetHAHouttNwAFZiO7EtSoxBRf85SWxv1o5A46RpmdrJqzzK2dRgwplQ%3D%3D&Expires=1730363813 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: global traffic HTTP traffic detected: GET /akeem4u/canter/downloads/233_Hherfkswbzh HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic HTTP traffic detected: GET /1889f89b-bf3e-4330-a7ab-fccb77ce4890/downloads/fd5ef9c0-51bf-40d2-8c89-83ab9690304a/233_Hherfkswbzh?response-content-disposition=attachment%3B%20filename%3D%22233_Hherfkswbzh%22&AWSAccessKeyId=ASIA6KOSE3BNHI54BTHA&Signature=tZ%2FwwJ1FN%2B1%2B9of%2FJeE%2Bo3BV4Ls%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBEaCXVzLWVhc3QtMSJHMEUCIFSQnqGQH2JEqKJhomymNnCA4lYnl%2BQwEzXvtXq0kv5eAiEAzwxPi7%2FqtIduS1Y4GA0jCPQlS4JfP3JMCl51SCYtQhwqsAIIif%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDNPNgKLBoJg8jVpiLCqEAi5vjLhoUXqOlKLnUE4wl75aM276pOHwyiPYxUuzjzqQA1B6E34B6OOSvX9lsRbi3LuXjpVmDTGcat73%2FcWzvA614Ma6TUDMKcSsazo27JULJRZ60HAvQ7Yunt8LD%2FQJa6KQ7ZNxzvc6Im2AB2zO8JFpXZv88sFixKhA48r6SwpoIz88YU5Xnr7RRc%2FcGRXaCf0kE5TOvVuhRKQjrWpgV5%2B3XwWgYItfw7g%2Fg07uObWaxd%2FrUrcnphxewukr1BGhYJb0b7RPPNZECMwI%2B6Rpgub3znYbt8xERbbjY20apm6JRP0ianWEOKjL4kwde4Jr5x2%2F02F%2BJ8VoBjfD%2FdKx4k1jafP8MJ31jLkGOp0BsobkkeqEKCksULQQEEm05vOtphj3NQN6JxFL1ca%2BqDpxc4FYHr%2FFeBn%2BuqLl2quhEkiq46Ben1DguLLCVBSRqgtlRbI5gEDRpi7ahaj02LzU0cUHpJaeveVZ5yc%2FzTJewE1gFKXv%2FHKIzbpWr%2Fy5ZmwOAXHetHAHouttNwAFZiO7EtSoxBRf85SWxv1o5A46RpmdrJqzzK2dRgwplQ%3D%3D&Expires=1730363813 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: global traffic HTTP traffic detected: GET /akeem4u/canter/downloads/233_Hherfkswbzh HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic HTTP traffic detected: GET /1889f89b-bf3e-4330-a7ab-fccb77ce4890/downloads/fd5ef9c0-51bf-40d2-8c89-83ab9690304a/233_Hherfkswbzh?response-content-disposition=attachment%3B%20filename%3D%22233_Hherfkswbzh%22&AWSAccessKeyId=ASIA6KOSE3BNHI54BTHA&Signature=tZ%2FwwJ1FN%2B1%2B9of%2FJeE%2Bo3BV4Ls%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBEaCXVzLWVhc3QtMSJHMEUCIFSQnqGQH2JEqKJhomymNnCA4lYnl%2BQwEzXvtXq0kv5eAiEAzwxPi7%2FqtIduS1Y4GA0jCPQlS4JfP3JMCl51SCYtQhwqsAIIif%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDNPNgKLBoJg8jVpiLCqEAi5vjLhoUXqOlKLnUE4wl75aM276pOHwyiPYxUuzjzqQA1B6E34B6OOSvX9lsRbi3LuXjpVmDTGcat73%2FcWzvA614Ma6TUDMKcSsazo27JULJRZ60HAvQ7Yunt8LD%2FQJa6KQ7ZNxzvc6Im2AB2zO8JFpXZv88sFixKhA48r6SwpoIz88YU5Xnr7RRc%2FcGRXaCf0kE5TOvVuhRKQjrWpgV5%2B3XwWgYItfw7g%2Fg07uObWaxd%2FrUrcnphxewukr1BGhYJb0b7RPPNZECMwI%2B6Rpgub3znYbt8xERbbjY20apm6JRP0ianWEOKjL4kwde4Jr5x2%2F02F%2BJ8VoBjfD%2FdKx4k1jafP8MJ31jLkGOp0BsobkkeqEKCksULQQEEm05vOtphj3NQN6JxFL1ca%2BqDpxc4FYHr%2FFeBn%2BuqLl2quhEkiq46Ben1DguLLCVBSRqgtlRbI5gEDRpi7ahaj02LzU0cUHpJaeveVZ5yc%2FzTJewE1gFKXv%2FHKIzbpWr%2Fy5ZmwOAXHetHAHouttNwAFZiO7EtSoxBRf85SWxv1o5A46RpmdrJqzzK2dRgwplQ%3D%3D&Expires=1730363813 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /akeem4u/canter/downloads/233_Hherfkswbzh HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic HTTP traffic detected: GET /1889f89b-bf3e-4330-a7ab-fccb77ce4890/downloads/fd5ef9c0-51bf-40d2-8c89-83ab9690304a/233_Hherfkswbzh?response-content-disposition=attachment%3B%20filename%3D%22233_Hherfkswbzh%22&AWSAccessKeyId=ASIA6KOSE3BNHI54BTHA&Signature=tZ%2FwwJ1FN%2B1%2B9of%2FJeE%2Bo3BV4Ls%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBEaCXVzLWVhc3QtMSJHMEUCIFSQnqGQH2JEqKJhomymNnCA4lYnl%2BQwEzXvtXq0kv5eAiEAzwxPi7%2FqtIduS1Y4GA0jCPQlS4JfP3JMCl51SCYtQhwqsAIIif%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDNPNgKLBoJg8jVpiLCqEAi5vjLhoUXqOlKLnUE4wl75aM276pOHwyiPYxUuzjzqQA1B6E34B6OOSvX9lsRbi3LuXjpVmDTGcat73%2FcWzvA614Ma6TUDMKcSsazo27JULJRZ60HAvQ7Yunt8LD%2FQJa6KQ7ZNxzvc6Im2AB2zO8JFpXZv88sFixKhA48r6SwpoIz88YU5Xnr7RRc%2FcGRXaCf0kE5TOvVuhRKQjrWpgV5%2B3XwWgYItfw7g%2Fg07uObWaxd%2FrUrcnphxewukr1BGhYJb0b7RPPNZECMwI%2B6Rpgub3znYbt8xERbbjY20apm6JRP0ianWEOKjL4kwde4Jr5x2%2F02F%2BJ8VoBjfD%2FdKx4k1jafP8MJ31jLkGOp0BsobkkeqEKCksULQQEEm05vOtphj3NQN6JxFL1ca%2BqDpxc4FYHr%2FFeBn%2BuqLl2quhEkiq46Ben1DguLLCVBSRqgtlRbI5gEDRpi7ahaj02LzU0cUHpJaeveVZ5yc%2FzTJewE1gFKXv%2FHKIzbpWr%2Fy5ZmwOAXHetHAHouttNwAFZiO7EtSoxBRf85SWxv1o5A46RpmdrJqzzK2dRgwplQ%3D%3D&Expires=1730363813 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: global traffic HTTP traffic detected: GET /akeem4u/canter/downloads/233_Hherfkswbzh HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic HTTP traffic detected: GET /1889f89b-bf3e-4330-a7ab-fccb77ce4890/downloads/fd5ef9c0-51bf-40d2-8c89-83ab9690304a/233_Hherfkswbzh?response-content-disposition=attachment%3B%20filename%3D%22233_Hherfkswbzh%22&AWSAccessKeyId=ASIA6KOSE3BNHI54BTHA&Signature=tZ%2FwwJ1FN%2B1%2B9of%2FJeE%2Bo3BV4Ls%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBEaCXVzLWVhc3QtMSJHMEUCIFSQnqGQH2JEqKJhomymNnCA4lYnl%2BQwEzXvtXq0kv5eAiEAzwxPi7%2FqtIduS1Y4GA0jCPQlS4JfP3JMCl51SCYtQhwqsAIIif%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDNPNgKLBoJg8jVpiLCqEAi5vjLhoUXqOlKLnUE4wl75aM276pOHwyiPYxUuzjzqQA1B6E34B6OOSvX9lsRbi3LuXjpVmDTGcat73%2FcWzvA614Ma6TUDMKcSsazo27JULJRZ60HAvQ7Yunt8LD%2FQJa6KQ7ZNxzvc6Im2AB2zO8JFpXZv88sFixKhA48r6SwpoIz88YU5Xnr7RRc%2FcGRXaCf0kE5TOvVuhRKQjrWpgV5%2B3XwWgYItfw7g%2Fg07uObWaxd%2FrUrcnphxewukr1BGhYJb0b7RPPNZECMwI%2B6Rpgub3znYbt8xERbbjY20apm6JRP0ianWEOKjL4kwde4Jr5x2%2F02F%2BJ8VoBjfD%2FdKx4k1jafP8MJ31jLkGOp0BsobkkeqEKCksULQQEEm05vOtphj3NQN6JxFL1ca%2BqDpxc4FYHr%2FFeBn%2BuqLl2quhEkiq46Ben1DguLLCVBSRqgtlRbI5gEDRpi7ahaj02LzU0cUHpJaeveVZ5yc%2FzTJewE1gFKXv%2FHKIzbpWr%2Fy5ZmwOAXHetHAHouttNwAFZiO7EtSoxBRf85SWxv1o5A46RpmdrJqzzK2dRgwplQ%3D%3D&Expires=1730363813 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: global traffic HTTP traffic detected: GET /akeem4u/canter/downloads/233_Hherfkswbzh HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bitbucket.org
Source: global traffic HTTP traffic detected: GET /1889f89b-bf3e-4330-a7ab-fccb77ce4890/downloads/fd5ef9c0-51bf-40d2-8c89-83ab9690304a/233_Hherfkswbzh?response-content-disposition=attachment%3B%20filename%3D%22233_Hherfkswbzh%22&AWSAccessKeyId=ASIA6KOSE3BNHI54BTHA&Signature=tZ%2FwwJ1FN%2B1%2B9of%2FJeE%2Bo3BV4Ls%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBEaCXVzLWVhc3QtMSJHMEUCIFSQnqGQH2JEqKJhomymNnCA4lYnl%2BQwEzXvtXq0kv5eAiEAzwxPi7%2FqtIduS1Y4GA0jCPQlS4JfP3JMCl51SCYtQhwqsAIIif%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDNPNgKLBoJg8jVpiLCqEAi5vjLhoUXqOlKLnUE4wl75aM276pOHwyiPYxUuzjzqQA1B6E34B6OOSvX9lsRbi3LuXjpVmDTGcat73%2FcWzvA614Ma6TUDMKcSsazo27JULJRZ60HAvQ7Yunt8LD%2FQJa6KQ7ZNxzvc6Im2AB2zO8JFpXZv88sFixKhA48r6SwpoIz88YU5Xnr7RRc%2FcGRXaCf0kE5TOvVuhRKQjrWpgV5%2B3XwWgYItfw7g%2Fg07uObWaxd%2FrUrcnphxewukr1BGhYJb0b7RPPNZECMwI%2B6Rpgub3znYbt8xERbbjY20apm6JRP0ianWEOKjL4kwde4Jr5x2%2F02F%2BJ8VoBjfD%2FdKx4k1jafP8MJ31jLkGOp0BsobkkeqEKCksULQQEEm05vOtphj3NQN6JxFL1ca%2BqDpxc4FYHr%2FFeBn%2BuqLl2quhEkiq46Ben1DguLLCVBSRqgtlRbI5gEDRpi7ahaj02LzU0cUHpJaeveVZ5yc%2FzTJewE1gFKXv%2FHKIzbpWr%2Fy5ZmwOAXHetHAHouttNwAFZiO7EtSoxBRf85SWxv1o5A46RpmdrJqzzK2dRgwplQ%3D%3D&Expires=1730363813 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: bbuseruploads.s3.amazonaws.com
Source: global traffic DNS traffic detected: DNS query: bitbucket.org
Source: global traffic DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
Source: Swift payment confirmation.exe, Swift payment confirmation.exe, 00000000.00000002.2174249610.00000000032DE000.00000004.00001000.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000002.2173823942.0000000003239000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2042440140.0000000003003000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2042668817.000000007FBDF000.00000004.00001000.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000002.2217929734.000000007FE2F000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.pmail.com
Source: Swift payment confirmation.exe, 00000000.00000003.2091804394.0000000000894000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000002.2171637621.00000000008F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aui-cdn.atlassian.com/
Source: Swift payment confirmation.exe, 00000000.00000002.2171637621.00000000008F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net
Source: Swift payment confirmation.exe, 00000000.00000002.2171637621.00000000008F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: Swift payment confirmation.exe, 00000000.00000002.2171637621.00000000008F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;
Source: Swift payment confirmation.exe, 00000000.00000002.2171637621.0000000000892000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2090782300.00000000008E6000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2127766348.00000000008E2000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2091804394.0000000000894000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000002.2171637621.00000000008F5000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2127766348.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2127766348.00000000008ED000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/1889f89b-bf3e-4330-a7ab-fccb77ce4890/downloads/fd5ef9c0-51bf-
Source: Swift payment confirmation.exe, 00000000.00000002.2171637621.00000000008CB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/2
Source: Swift payment confirmation.exe, 00000000.00000003.2091804394.0000000000894000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/I
Source: Swift payment confirmation.exe, 00000000.00000003.2091804394.0000000000894000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/c
Source: Swift payment confirmation.exe, 00000000.00000002.2171637621.00000000008E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com:443/1889f89b-bf3e-4330-a7ab-fccb77ce4890/downloads/fd5ef9c0-5
Source: Swift payment confirmation.exe, 00000000.00000003.2091804394.0000000000894000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000002.2171637621.0000000000863000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/
Source: Swift payment confirmation.exe, 00000000.00000003.2091804394.0000000000894000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/A
Source: Swift payment confirmation.exe, 00000000.00000003.2091804394.0000000000894000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/H
Source: Swift payment confirmation.exe, 00000000.00000002.2192573378.0000000021088000.00000004.00001000.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2136347138.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000002.2171637621.000000000081E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/akeem4u/canter/downloads/233_Hherfkswbzh
Source: Swift payment confirmation.exe, 00000000.00000003.2091804394.0000000000894000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/akeem4u/canter/downloads/233_HherfkswbzhHG
Source: Swift payment confirmation.exe, 00000000.00000002.2171637621.000000000081E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/akeem4u/canter/downloads/233_Hherfkswbzhps.DLL
Source: Swift payment confirmation.exe, 00000000.00000003.2136347138.00000000008EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org:443/akeem4u/canter/downloads/233_Hherfkswbzh
Source: Swift payment confirmation.exe, 00000000.00000003.2091804394.0000000000894000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000002.2171637621.00000000008F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.cookielaw.org/
Source: Swift payment confirmation.exe, 00000000.00000003.2127766348.00000000008F2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: Swift payment confirmation.exe, 00000000.00000003.2091804394.0000000000894000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000002.2171637621.00000000008F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: Swift payment confirmation.exe, 00000000.00000003.2091804394.0000000000894000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000002.2171637621.00000000008F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: Swift payment confirmation.exe, 00000000.00000003.2127729872.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2090782300.00000000008E6000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2127766348.00000000008E2000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2091804394.0000000000894000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000002.2171637621.00000000008F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: Swift payment confirmation.exe, 00000000.00000003.2127729872.00000000008F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-websiteX-Frame-OptionsSAMEORIGINX-
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.102.228:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.217.102.228:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 3.5.29.82:443 -> 192.168.2.5:49712 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.colorcpl.exe.6440000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.colorcpl.exe.6440000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2292243782.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2292379544.0000000006440000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 2.2.colorcpl.exe.6440000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.colorcpl.exe.6440000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2292243782.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2292379544.0000000006440000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Swift payment confirmation.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032CB118 GetModuleHandleW,NtOpenProcess,IsBadReadPtr,IsBadReadPtr,GetModuleHandleW,NtCreateThreadEx, 0_2_032CB118
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C7A2C NtAllocateVirtualMemory, 0_2_032C7A2C
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C7D78 NtWriteVirtualMemory, 0_2_032C7D78
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032CDD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose, 0_2_032CDD70
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032CDBB0 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile, 0_2_032CDBB0
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C7A2A NtAllocateVirtualMemory, 0_2_032C7A2A
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C8D6E GetThreadContext,SetThreadContext,NtResumeThread, 0_2_032C8D6E
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C8D70 GetThreadContext,SetThreadContext,NtResumeThread, 0_2_032C8D70
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032CDC04 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile, 0_2_032CDC04
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032CDC8C RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose, 0_2_032CDC8C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_0646C3C3 NtClose, 2_2_0646C3C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_0644A775 NtCreateFile, 2_2_0644A775
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2C70 NtFreeVirtualMemory,LdrInitializeThunk, 2_2_267D2C70
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2DF0 NtQuerySystemInformation,LdrInitializeThunk, 2_2_267D2DF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2B60 NtClose,LdrInitializeThunk, 2_2_267D2B60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D35C0 NtCreateMutant,LdrInitializeThunk, 2_2_267D35C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D4650 NtSuspendThread, 2_2_267D4650
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D4340 NtSetContextThread, 2_2_267D4340
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2E30 NtWriteVirtualMemory, 2_2_267D2E30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2EE0 NtQueueApcThread, 2_2_267D2EE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2EA0 NtAdjustPrivilegesToken, 2_2_267D2EA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2E80 NtReadVirtualMemory, 2_2_267D2E80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2F60 NtCreateProcessEx, 2_2_267D2F60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2F30 NtCreateSection, 2_2_267D2F30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2FE0 NtCreateFile, 2_2_267D2FE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2FB0 NtResumeThread, 2_2_267D2FB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2FA0 NtQuerySection, 2_2_267D2FA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2F90 NtProtectVirtualMemory, 2_2_267D2F90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2C60 NtCreateKey, 2_2_267D2C60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2C00 NtQueryInformationProcess, 2_2_267D2C00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2CF0 NtOpenProcess, 2_2_267D2CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2CC0 NtQueryVirtualMemory, 2_2_267D2CC0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2CA0 NtQueryInformationToken, 2_2_267D2CA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2D30 NtUnmapViewOfSection, 2_2_267D2D30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2D10 NtMapViewOfSection, 2_2_267D2D10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2D00 NtSetInformationFile, 2_2_267D2D00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2DD0 NtDelayExecution, 2_2_267D2DD0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2DB0 NtEnumerateKey, 2_2_267D2DB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2AF0 NtWriteFile, 2_2_267D2AF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2AD0 NtReadFile, 2_2_267D2AD0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2AB0 NtWaitForSingleObject, 2_2_267D2AB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2BF0 NtAllocateVirtualMemory, 2_2_267D2BF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2BE0 NtQueryValueKey, 2_2_267D2BE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2BA0 NtEnumerateValueKey, 2_2_267D2BA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2B80 NtQueryInformationFile, 2_2_267D2B80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D3010 NtOpenDirectoryObject, 2_2_267D3010
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D3090 NtSetValueKey, 2_2_267D3090
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D3D70 NtOpenThread, 2_2_267D3D70
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D3D10 NtOpenProcessToken, 2_2_267D3D10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D39B0 NtGetContextThread, 2_2_267D39B0
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032D8128 CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess, 0_2_032D8128
Detected potential crypto function
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032B20C4 0_2_032B20C4
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032BCA4E 0_2_032BCA4E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_0644FE03 2_2_0644FE03
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_0644DE83 2_2_0644DE83
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_064424D0 2_2_064424D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_06442D00 2_2_06442D00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_0645652F 2_2_0645652F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_06456533 2_2_06456533
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_0644FBDB 2_2_0644FBDB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_0644FBE3 2_2_0644FBE3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_0646E9C3 2_2_0646E9C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_064411CD 2_2_064411CD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_064411D0 2_2_064411D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_064421A0 2_2_064421A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BC6E0 2_2_267BC6E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0770 2_2_267A0770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C4750 2_2_267C4750
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679C7C0 2_2_2679C7C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2684E4F6 2_2_2684E4F6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26844420 2_2_26844420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26852446 2_2_26852446
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26860591 2_2_26860591
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0535 2_2_267A0535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268202C0 2_2_268202C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840274 2_2_26840274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268603E6 2_2_268603E6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267AE3F0 2_2_267AE3F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685A352 2_2_2685A352
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26832000 2_2_26832000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268541A2 2_2_268541A2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268601AA 2_2_268601AA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268581CC 2_2_268581CC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26790100 2_2_26790100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683A118 2_2_2683A118
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26828158 2_2_26828158
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685CE93 2_2_2685CE93
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0E59 2_2_267A0E59
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685EEDB 2_2_2685EEDB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685EE26 2_2_2685EE26
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267B2E90 2_2_267B2E90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681EFA0 2_2_2681EFA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C0F30 2_2_267C0F30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267E2F28 2_2_267E2F28
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267ACFE0 2_2_267ACFE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26792FC8 2_2_26792FC8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26842F30 2_2_26842F30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26814F40 2_2_26814F40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840CB5 2_2_26840CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0C00 2_2_267A0C00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26790CF2 2_2_26790CF2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267AAD00 2_2_267AAD00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679ADE0 2_2_2679ADE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683CD1F 2_2_2683CD1F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267B8DBF 2_2_267B8DBF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679EA80 2_2_2679EA80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26856BD7 2_2_26856BD7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685AB40 2_2_2685AB40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A2840 2_2_267A2840
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267AA840 2_2_267AA840
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CE8F0 2_2_267CE8F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267868B8 2_2_267868B8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267B6962 2_2_267B6962
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2686A9A6 2_2_2686A9A6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A29A0 2_2_267A29A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268516CC 2_2_268516CC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267E5630 2_2_267E5630
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685F7B0 2_2_2685F7B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26791460 2_2_26791460
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685F43F 2_2_2685F43F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683D5B0 2_2_2683D5B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268695C3 2_2_268695C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26857571 2_2_26857571
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268412ED 2_2_268412ED
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BB2C0 2_2_267BB2C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A52A0 2_2_267A52A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678D34C 2_2_2678D34C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685132D 2_2_2685132D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267E739A 2_2_267E739A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2684F0CC 2_2_2684F0CC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685F0E0 2_2_2685F0E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268570E9 2_2_268570E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A70C0 2_2_267A70C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678F172 2_2_2678F172
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D516C 2_2_267D516C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267AB1B0 2_2_267AB1B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2686B16B 2_2_2686B16B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A9EB0 2_2_267A9EB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685FFB1 2_2_2685FFB1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685FF09 2_2_2685FF09
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26763FD5 2_2_26763FD5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26763FD2 2_2_26763FD2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A1F92 2_2_267A1F92
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685FCF2 2_2_2685FCF2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26819C32 2_2_26819C32
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A3D40 2_2_267A3D40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BFDC0 2_2_267BFDC0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26851D5A 2_2_26851D5A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26857D73 2_2_26857D73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26841AA3 2_2_26841AA3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683DAAC 2_2_2683DAAC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2684DAC6 2_2_2684DAC6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26857A46 2_2_26857A46
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685FA49 2_2_2685FA49
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267E5AA0 2_2_267E5AA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26813A6C 2_2_26813A6C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26815BF0 2_2_26815BF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267DDBF9 2_2_267DDBF9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685FB76 2_2_2685FB76
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BFB80 2_2_267BFB80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680D800 2_2_2680D800
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A38E0 2_2_267A38E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A9950 2_2_267A9950
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BB950 2_2_267BB950
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26835910 2_2_26835910
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: String function: 032B44DC appears 74 times
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: String function: 032B4860 appears 949 times
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: String function: 032B4500 appears 33 times
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: String function: 032B46D4 appears 244 times
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: String function: 032C894C appears 56 times
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: String function: 032C89D0 appears 45 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 267D5130 appears 58 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 2680EA12 appears 82 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 2678B970 appears 280 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 2681F290 appears 103 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 267E7E54 appears 111 times
Sample file is different than original file name gathered from version info
Source: Swift payment confirmation.exe Binary or memory string: OriginalFilename vs Swift payment confirmation.exe
Source: Swift payment confirmation.exe, 00000000.00000002.2174249610.00000000032DE000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs Swift payment confirmation.exe
Source: Swift payment confirmation.exe, 00000000.00000002.2174249610.00000000032DE000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs Swift payment confirmation.exe
Source: Swift payment confirmation.exe, 00000000.00000003.2042440140.0000000002FFF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs Swift payment confirmation.exe
Source: Swift payment confirmation.exe, 00000000.00000002.2173823942.0000000003239000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs Swift payment confirmation.exe
Source: Swift payment confirmation.exe, 00000000.00000003.2041882325.000000007FE4F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs Swift payment confirmation.exe
Source: Swift payment confirmation.exe, 00000000.00000003.2042440140.0000000003003000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs Swift payment confirmation.exe
Source: Swift payment confirmation.exe, 00000000.00000003.2042668817.000000007FBDF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs Swift payment confirmation.exe
Source: Swift payment confirmation.exe, 00000000.00000003.2042668817.000000007FBDF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs Swift payment confirmation.exe
Source: Swift payment confirmation.exe, 00000000.00000002.2173823942.0000000003235000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameeasinvoker.exej% vs Swift payment confirmation.exe
Source: Swift payment confirmation.exe, 00000000.00000002.2217929734.000000007FE2F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLOADER.EXEB vs Swift payment confirmation.exe
Uses 32bit PE files
Source: Swift payment confirmation.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Yara signature match
Source: 2.2.colorcpl.exe.6440000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.colorcpl.exe.6440000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2292243782.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2292379544.0000000006440000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: classification engine Classification label: mal100.troj.evad.winEXE@3/0@3/3
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032B7FD2 GetDiskFreeSpaceA, 0_2_032B7FD2
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032CAD98 CreateToolhelp32Snapshot, 0_2_032CAD98
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C6DC8 CoCreateInstance, 0_2_032C6DC8
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Swift payment confirmation.exe ReversingLabs: Detection: 65%
Source: Swift payment confirmation.exe Virustotal: Detection: 61%
Source: C:\Users\user\Desktop\Swift payment confirmation.exe File read: C:\Users\user\Desktop\Swift payment confirmation.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Swift payment confirmation.exe "C:\Users\user\Desktop\Swift payment confirmation.exe"
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: url.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Window found: window name: SysTabControl32 Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Window detected: Number of UI elements: 12
Source: Binary string: easinvoker.pdb source: Swift payment confirmation.exe, Swift payment confirmation.exe, 00000000.00000002.2174249610.00000000032DE000.00000004.00001000.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2042668817.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2041882325.000000007FE00000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: colorcpl.exe, 00000002.00000003.2252350083.0000000004C3C000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000002.00000003.2255245800.0000000004DEA000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000002.00000002.2307528675.0000000026760000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000002.00000002.2307528675.00000000268FE000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: colorcpl.exe, colorcpl.exe, 00000002.00000003.2252350083.0000000004C3C000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000002.00000003.2255245800.0000000004DEA000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000002.00000002.2307528675.0000000026760000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000002.00000002.2307528675.00000000268FE000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdbGCTL source: Swift payment confirmation.exe, 00000000.00000002.2174249610.00000000032DE000.00000004.00001000.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000002.2173823942.0000000003211000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2042668817.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2042440140.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000003.2041882325.000000007FE00000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
Yara detected DBatLoader
Source: Yara match File source: 0.2.Swift payment confirmation.exe.32b0000.0.unpack, type: UNPACKEDPE
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C894C LoadLibraryW,GetProcAddress,FreeLibrary, 0_2_032C894C
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032B332C push eax; ret 0_2_032B3368
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032DC378 push 032DC56Eh; ret 0_2_032DC566
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032BC349 push 8B032BC1h; ret 0_2_032BC34E
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032B63AE push 032B640Bh; ret 0_2_032B6403
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032B63B0 push 032B640Bh; ret 0_2_032B6403
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032DD2FC push 032DD367h; ret 0_2_032DD35F
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032CF108 push ecx; mov dword ptr [esp], edx 0_2_032CF10D
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032DD144 push 032DD1ECh; ret 0_2_032DD1E4
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032DD1F8 push 032DD288h; ret 0_2_032DD280
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C306C push 032C30B9h; ret 0_2_032C30B1
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C306B push 032C30B9h; ret 0_2_032C30B1
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032DD0AC push 032DD125h; ret 0_2_032DD11D
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032B6782 push 032B67C6h; ret 0_2_032B67BE
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032B6784 push 032B67C6h; ret 0_2_032B67BE
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032BC56C push ecx; mov dword ptr [esp], edx 0_2_032BC571
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032DC570 push 032DC56Eh; ret 0_2_032DC566
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032BD5A0 push 032BD5CCh; ret 0_2_032BD5C4
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032BCBEC push 032BCD72h; ret 0_2_032BCD6A
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_03324A50 push eax; ret 0_2_03324B20
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032BCA4E push 032BCD72h; ret 0_2_032BCD6A
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032CAAE0 push 032CAB18h; ret 0_2_032CAB10
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032CAADF push 032CAB18h; ret 0_2_032CAB10
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C8AD8 push 032C8B10h; ret 0_2_032C8B08
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C790C push 032C7989h; ret 0_2_032C7981
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C6948 push 032C69F3h; ret 0_2_032C69EB
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C6946 push 032C69F3h; ret 0_2_032C69EB
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C886C push 032C88AEh; ret 0_2_032C88A6
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C2F60 push 032C2FD6h; ret 0_2_032C2FCE
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C5E7C push ecx; mov dword ptr [esp], edx 0_2_032C5E7E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_06442F80 push eax; ret 2_2_06442F82
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_06446C76 pushad ; ret 2_2_06446C77

Hooking and other Techniques for Hiding and Protection
barindex
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Source: initial sample Icon embedded in binary file: icon matches a legit application icon: adobe 12.png
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032CAB1C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_032CAB1C
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D096E rdtsc 2_2_267D096E
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\colorcpl.exe API coverage: 0.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 1288 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032B5908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 0_2_032B5908
Source: Swift payment confirmation.exe, 00000000.00000002.2171637621.000000000087D000.00000004.00000020.00020000.00000000.sdmp, Swift payment confirmation.exe, 00000000.00000002.2171637621.000000000081E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\Swift payment confirmation.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032CF744 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent, 0_2_032CF744
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D096E rdtsc 2_2_267D096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2C70 NtFreeVirtualMemory,LdrInitializeThunk, 2_2_267D2C70
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032C894C LoadLibraryW,GetProcAddress,FreeLibrary, 0_2_032C894C
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C2674 mov eax, dword ptr fs:[00000030h] 2_2_267C2674
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CA660 mov eax, dword ptr fs:[00000030h] 2_2_267CA660
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CA660 mov eax, dword ptr fs:[00000030h] 2_2_267CA660
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267AC640 mov eax, dword ptr fs:[00000030h] 2_2_267AC640
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679262C mov eax, dword ptr fs:[00000030h] 2_2_2679262C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C6620 mov eax, dword ptr fs:[00000030h] 2_2_267C6620
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C8620 mov eax, dword ptr fs:[00000030h] 2_2_267C8620
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267AE627 mov eax, dword ptr fs:[00000030h] 2_2_267AE627
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2619 mov eax, dword ptr fs:[00000030h] 2_2_267D2619
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268106F1 mov eax, dword ptr fs:[00000030h] 2_2_268106F1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268106F1 mov eax, dword ptr fs:[00000030h] 2_2_268106F1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A260B mov eax, dword ptr fs:[00000030h] 2_2_267A260B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A260B mov eax, dword ptr fs:[00000030h] 2_2_267A260B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A260B mov eax, dword ptr fs:[00000030h] 2_2_267A260B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A260B mov eax, dword ptr fs:[00000030h] 2_2_267A260B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A260B mov eax, dword ptr fs:[00000030h] 2_2_267A260B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A260B mov eax, dword ptr fs:[00000030h] 2_2_267A260B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A260B mov eax, dword ptr fs:[00000030h] 2_2_267A260B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680E6F2 mov eax, dword ptr fs:[00000030h] 2_2_2680E6F2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680E6F2 mov eax, dword ptr fs:[00000030h] 2_2_2680E6F2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680E6F2 mov eax, dword ptr fs:[00000030h] 2_2_2680E6F2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680E6F2 mov eax, dword ptr fs:[00000030h] 2_2_2680E6F2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680E609 mov eax, dword ptr fs:[00000030h] 2_2_2680E609
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CA6C7 mov ebx, dword ptr fs:[00000030h] 2_2_267CA6C7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CA6C7 mov eax, dword ptr fs:[00000030h] 2_2_267CA6C7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C66B0 mov eax, dword ptr fs:[00000030h] 2_2_267C66B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CC6A6 mov eax, dword ptr fs:[00000030h] 2_2_267CC6A6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26794690 mov eax, dword ptr fs:[00000030h] 2_2_26794690
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26794690 mov eax, dword ptr fs:[00000030h] 2_2_26794690
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685866E mov eax, dword ptr fs:[00000030h] 2_2_2685866E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685866E mov eax, dword ptr fs:[00000030h] 2_2_2685866E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26798770 mov eax, dword ptr fs:[00000030h] 2_2_26798770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0770 mov eax, dword ptr fs:[00000030h] 2_2_267A0770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0770 mov eax, dword ptr fs:[00000030h] 2_2_267A0770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0770 mov eax, dword ptr fs:[00000030h] 2_2_267A0770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0770 mov eax, dword ptr fs:[00000030h] 2_2_267A0770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0770 mov eax, dword ptr fs:[00000030h] 2_2_267A0770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0770 mov eax, dword ptr fs:[00000030h] 2_2_267A0770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0770 mov eax, dword ptr fs:[00000030h] 2_2_267A0770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0770 mov eax, dword ptr fs:[00000030h] 2_2_267A0770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0770 mov eax, dword ptr fs:[00000030h] 2_2_267A0770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0770 mov eax, dword ptr fs:[00000030h] 2_2_267A0770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0770 mov eax, dword ptr fs:[00000030h] 2_2_267A0770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0770 mov eax, dword ptr fs:[00000030h] 2_2_267A0770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683678E mov eax, dword ptr fs:[00000030h] 2_2_2683678E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268447A0 mov eax, dword ptr fs:[00000030h] 2_2_268447A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26790750 mov eax, dword ptr fs:[00000030h] 2_2_26790750
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2750 mov eax, dword ptr fs:[00000030h] 2_2_267D2750
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D2750 mov eax, dword ptr fs:[00000030h] 2_2_267D2750
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C674D mov esi, dword ptr fs:[00000030h] 2_2_267C674D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C674D mov eax, dword ptr fs:[00000030h] 2_2_267C674D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C674D mov eax, dword ptr fs:[00000030h] 2_2_267C674D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C273C mov eax, dword ptr fs:[00000030h] 2_2_267C273C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C273C mov ecx, dword ptr fs:[00000030h] 2_2_267C273C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C273C mov eax, dword ptr fs:[00000030h] 2_2_267C273C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268107C3 mov eax, dword ptr fs:[00000030h] 2_2_268107C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CC720 mov eax, dword ptr fs:[00000030h] 2_2_267CC720
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CC720 mov eax, dword ptr fs:[00000030h] 2_2_267CC720
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681E7E1 mov eax, dword ptr fs:[00000030h] 2_2_2681E7E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26790710 mov eax, dword ptr fs:[00000030h] 2_2_26790710
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C0710 mov eax, dword ptr fs:[00000030h] 2_2_267C0710
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CC700 mov eax, dword ptr fs:[00000030h] 2_2_267CC700
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267947FB mov eax, dword ptr fs:[00000030h] 2_2_267947FB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267947FB mov eax, dword ptr fs:[00000030h] 2_2_267947FB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267B27ED mov eax, dword ptr fs:[00000030h] 2_2_267B27ED
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267B27ED mov eax, dword ptr fs:[00000030h] 2_2_267B27ED
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267B27ED mov eax, dword ptr fs:[00000030h] 2_2_267B27ED
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680C730 mov eax, dword ptr fs:[00000030h] 2_2_2680C730
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679C7C0 mov eax, dword ptr fs:[00000030h] 2_2_2679C7C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26814755 mov eax, dword ptr fs:[00000030h] 2_2_26814755
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267907AF mov eax, dword ptr fs:[00000030h] 2_2_267907AF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681E75D mov eax, dword ptr fs:[00000030h] 2_2_2681E75D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BA470 mov eax, dword ptr fs:[00000030h] 2_2_267BA470
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BA470 mov eax, dword ptr fs:[00000030h] 2_2_267BA470
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BA470 mov eax, dword ptr fs:[00000030h] 2_2_267BA470
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2684A49A mov eax, dword ptr fs:[00000030h] 2_2_2684A49A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267B245A mov eax, dword ptr fs:[00000030h] 2_2_267B245A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681A4B0 mov eax, dword ptr fs:[00000030h] 2_2_2681A4B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CE443 mov eax, dword ptr fs:[00000030h] 2_2_267CE443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CE443 mov eax, dword ptr fs:[00000030h] 2_2_267CE443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CE443 mov eax, dword ptr fs:[00000030h] 2_2_267CE443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CE443 mov eax, dword ptr fs:[00000030h] 2_2_267CE443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CE443 mov eax, dword ptr fs:[00000030h] 2_2_267CE443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CE443 mov eax, dword ptr fs:[00000030h] 2_2_267CE443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CE443 mov eax, dword ptr fs:[00000030h] 2_2_267CE443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CE443 mov eax, dword ptr fs:[00000030h] 2_2_267CE443
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CA430 mov eax, dword ptr fs:[00000030h] 2_2_267CA430
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678E420 mov eax, dword ptr fs:[00000030h] 2_2_2678E420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678E420 mov eax, dword ptr fs:[00000030h] 2_2_2678E420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678E420 mov eax, dword ptr fs:[00000030h] 2_2_2678E420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678C427 mov eax, dword ptr fs:[00000030h] 2_2_2678C427
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C8402 mov eax, dword ptr fs:[00000030h] 2_2_267C8402
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C8402 mov eax, dword ptr fs:[00000030h] 2_2_267C8402
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C8402 mov eax, dword ptr fs:[00000030h] 2_2_267C8402
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267904E5 mov ecx, dword ptr fs:[00000030h] 2_2_267904E5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26816420 mov eax, dword ptr fs:[00000030h] 2_2_26816420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26816420 mov eax, dword ptr fs:[00000030h] 2_2_26816420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26816420 mov eax, dword ptr fs:[00000030h] 2_2_26816420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26816420 mov eax, dword ptr fs:[00000030h] 2_2_26816420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26816420 mov eax, dword ptr fs:[00000030h] 2_2_26816420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26816420 mov eax, dword ptr fs:[00000030h] 2_2_26816420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26816420 mov eax, dword ptr fs:[00000030h] 2_2_26816420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C44B0 mov ecx, dword ptr fs:[00000030h] 2_2_267C44B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267964AB mov eax, dword ptr fs:[00000030h] 2_2_267964AB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2684A456 mov eax, dword ptr fs:[00000030h] 2_2_2684A456
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681C460 mov ecx, dword ptr fs:[00000030h] 2_2_2681C460
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C656A mov eax, dword ptr fs:[00000030h] 2_2_267C656A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C656A mov eax, dword ptr fs:[00000030h] 2_2_267C656A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C656A mov eax, dword ptr fs:[00000030h] 2_2_267C656A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268105A7 mov eax, dword ptr fs:[00000030h] 2_2_268105A7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268105A7 mov eax, dword ptr fs:[00000030h] 2_2_268105A7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268105A7 mov eax, dword ptr fs:[00000030h] 2_2_268105A7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26798550 mov eax, dword ptr fs:[00000030h] 2_2_26798550
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26798550 mov eax, dword ptr fs:[00000030h] 2_2_26798550
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BE53E mov eax, dword ptr fs:[00000030h] 2_2_267BE53E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BE53E mov eax, dword ptr fs:[00000030h] 2_2_267BE53E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BE53E mov eax, dword ptr fs:[00000030h] 2_2_267BE53E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BE53E mov eax, dword ptr fs:[00000030h] 2_2_267BE53E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BE53E mov eax, dword ptr fs:[00000030h] 2_2_267BE53E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0535 mov eax, dword ptr fs:[00000030h] 2_2_267A0535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0535 mov eax, dword ptr fs:[00000030h] 2_2_267A0535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0535 mov eax, dword ptr fs:[00000030h] 2_2_267A0535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0535 mov eax, dword ptr fs:[00000030h] 2_2_267A0535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0535 mov eax, dword ptr fs:[00000030h] 2_2_267A0535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0535 mov eax, dword ptr fs:[00000030h] 2_2_267A0535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26826500 mov eax, dword ptr fs:[00000030h] 2_2_26826500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26864500 mov eax, dword ptr fs:[00000030h] 2_2_26864500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26864500 mov eax, dword ptr fs:[00000030h] 2_2_26864500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26864500 mov eax, dword ptr fs:[00000030h] 2_2_26864500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26864500 mov eax, dword ptr fs:[00000030h] 2_2_26864500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26864500 mov eax, dword ptr fs:[00000030h] 2_2_26864500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26864500 mov eax, dword ptr fs:[00000030h] 2_2_26864500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26864500 mov eax, dword ptr fs:[00000030h] 2_2_26864500
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CC5ED mov eax, dword ptr fs:[00000030h] 2_2_267CC5ED
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CC5ED mov eax, dword ptr fs:[00000030h] 2_2_267CC5ED
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267925E0 mov eax, dword ptr fs:[00000030h] 2_2_267925E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BE5E7 mov eax, dword ptr fs:[00000030h] 2_2_267BE5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BE5E7 mov eax, dword ptr fs:[00000030h] 2_2_267BE5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BE5E7 mov eax, dword ptr fs:[00000030h] 2_2_267BE5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BE5E7 mov eax, dword ptr fs:[00000030h] 2_2_267BE5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BE5E7 mov eax, dword ptr fs:[00000030h] 2_2_267BE5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BE5E7 mov eax, dword ptr fs:[00000030h] 2_2_267BE5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BE5E7 mov eax, dword ptr fs:[00000030h] 2_2_267BE5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BE5E7 mov eax, dword ptr fs:[00000030h] 2_2_267BE5E7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267965D0 mov eax, dword ptr fs:[00000030h] 2_2_267965D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CA5D0 mov eax, dword ptr fs:[00000030h] 2_2_267CA5D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CA5D0 mov eax, dword ptr fs:[00000030h] 2_2_267CA5D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CE5CF mov eax, dword ptr fs:[00000030h] 2_2_267CE5CF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CE5CF mov eax, dword ptr fs:[00000030h] 2_2_267CE5CF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267B45B1 mov eax, dword ptr fs:[00000030h] 2_2_267B45B1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267B45B1 mov eax, dword ptr fs:[00000030h] 2_2_267B45B1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CE59C mov eax, dword ptr fs:[00000030h] 2_2_267CE59C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C4588 mov eax, dword ptr fs:[00000030h] 2_2_267C4588
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26792582 mov eax, dword ptr fs:[00000030h] 2_2_26792582
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26792582 mov ecx, dword ptr fs:[00000030h] 2_2_26792582
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26810283 mov eax, dword ptr fs:[00000030h] 2_2_26810283
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26810283 mov eax, dword ptr fs:[00000030h] 2_2_26810283
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26810283 mov eax, dword ptr fs:[00000030h] 2_2_26810283
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678826B mov eax, dword ptr fs:[00000030h] 2_2_2678826B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26794260 mov eax, dword ptr fs:[00000030h] 2_2_26794260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26794260 mov eax, dword ptr fs:[00000030h] 2_2_26794260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26794260 mov eax, dword ptr fs:[00000030h] 2_2_26794260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26796259 mov eax, dword ptr fs:[00000030h] 2_2_26796259
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268262A0 mov eax, dword ptr fs:[00000030h] 2_2_268262A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268262A0 mov ecx, dword ptr fs:[00000030h] 2_2_268262A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268262A0 mov eax, dword ptr fs:[00000030h] 2_2_268262A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268262A0 mov eax, dword ptr fs:[00000030h] 2_2_268262A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268262A0 mov eax, dword ptr fs:[00000030h] 2_2_268262A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268262A0 mov eax, dword ptr fs:[00000030h] 2_2_268262A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678A250 mov eax, dword ptr fs:[00000030h] 2_2_2678A250
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678823B mov eax, dword ptr fs:[00000030h] 2_2_2678823B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268662D6 mov eax, dword ptr fs:[00000030h] 2_2_268662D6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A02E1 mov eax, dword ptr fs:[00000030h] 2_2_267A02E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A02E1 mov eax, dword ptr fs:[00000030h] 2_2_267A02E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A02E1 mov eax, dword ptr fs:[00000030h] 2_2_267A02E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679A2C3 mov eax, dword ptr fs:[00000030h] 2_2_2679A2C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679A2C3 mov eax, dword ptr fs:[00000030h] 2_2_2679A2C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679A2C3 mov eax, dword ptr fs:[00000030h] 2_2_2679A2C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679A2C3 mov eax, dword ptr fs:[00000030h] 2_2_2679A2C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679A2C3 mov eax, dword ptr fs:[00000030h] 2_2_2679A2C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26818243 mov eax, dword ptr fs:[00000030h] 2_2_26818243
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26818243 mov ecx, dword ptr fs:[00000030h] 2_2_26818243
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2684A250 mov eax, dword ptr fs:[00000030h] 2_2_2684A250
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2684A250 mov eax, dword ptr fs:[00000030h] 2_2_2684A250
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A02A0 mov eax, dword ptr fs:[00000030h] 2_2_267A02A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A02A0 mov eax, dword ptr fs:[00000030h] 2_2_267A02A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2686625D mov eax, dword ptr fs:[00000030h] 2_2_2686625D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840274 mov eax, dword ptr fs:[00000030h] 2_2_26840274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840274 mov eax, dword ptr fs:[00000030h] 2_2_26840274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840274 mov eax, dword ptr fs:[00000030h] 2_2_26840274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840274 mov eax, dword ptr fs:[00000030h] 2_2_26840274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840274 mov eax, dword ptr fs:[00000030h] 2_2_26840274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840274 mov eax, dword ptr fs:[00000030h] 2_2_26840274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840274 mov eax, dword ptr fs:[00000030h] 2_2_26840274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840274 mov eax, dword ptr fs:[00000030h] 2_2_26840274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840274 mov eax, dword ptr fs:[00000030h] 2_2_26840274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840274 mov eax, dword ptr fs:[00000030h] 2_2_26840274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840274 mov eax, dword ptr fs:[00000030h] 2_2_26840274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840274 mov eax, dword ptr fs:[00000030h] 2_2_26840274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CE284 mov eax, dword ptr fs:[00000030h] 2_2_267CE284
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CE284 mov eax, dword ptr fs:[00000030h] 2_2_267CE284
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268163C0 mov eax, dword ptr fs:[00000030h] 2_2_268163C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2684C3CD mov eax, dword ptr fs:[00000030h] 2_2_2684C3CD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268343D4 mov eax, dword ptr fs:[00000030h] 2_2_268343D4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268343D4 mov eax, dword ptr fs:[00000030h] 2_2_268343D4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683E3DB mov eax, dword ptr fs:[00000030h] 2_2_2683E3DB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683E3DB mov eax, dword ptr fs:[00000030h] 2_2_2683E3DB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683E3DB mov ecx, dword ptr fs:[00000030h] 2_2_2683E3DB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683E3DB mov eax, dword ptr fs:[00000030h] 2_2_2683E3DB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678C310 mov ecx, dword ptr fs:[00000030h] 2_2_2678C310
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267B0310 mov ecx, dword ptr fs:[00000030h] 2_2_267B0310
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CA30B mov eax, dword ptr fs:[00000030h] 2_2_267CA30B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CA30B mov eax, dword ptr fs:[00000030h] 2_2_267CA30B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CA30B mov eax, dword ptr fs:[00000030h] 2_2_267CA30B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C63FF mov eax, dword ptr fs:[00000030h] 2_2_267C63FF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267AE3F0 mov eax, dword ptr fs:[00000030h] 2_2_267AE3F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267AE3F0 mov eax, dword ptr fs:[00000030h] 2_2_267AE3F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267AE3F0 mov eax, dword ptr fs:[00000030h] 2_2_267AE3F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A03E9 mov eax, dword ptr fs:[00000030h] 2_2_267A03E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A03E9 mov eax, dword ptr fs:[00000030h] 2_2_267A03E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A03E9 mov eax, dword ptr fs:[00000030h] 2_2_267A03E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A03E9 mov eax, dword ptr fs:[00000030h] 2_2_267A03E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A03E9 mov eax, dword ptr fs:[00000030h] 2_2_267A03E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A03E9 mov eax, dword ptr fs:[00000030h] 2_2_267A03E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A03E9 mov eax, dword ptr fs:[00000030h] 2_2_267A03E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A03E9 mov eax, dword ptr fs:[00000030h] 2_2_267A03E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26868324 mov eax, dword ptr fs:[00000030h] 2_2_26868324
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26868324 mov ecx, dword ptr fs:[00000030h] 2_2_26868324
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26868324 mov eax, dword ptr fs:[00000030h] 2_2_26868324
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26868324 mov eax, dword ptr fs:[00000030h] 2_2_26868324
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679A3C0 mov eax, dword ptr fs:[00000030h] 2_2_2679A3C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679A3C0 mov eax, dword ptr fs:[00000030h] 2_2_2679A3C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679A3C0 mov eax, dword ptr fs:[00000030h] 2_2_2679A3C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679A3C0 mov eax, dword ptr fs:[00000030h] 2_2_2679A3C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679A3C0 mov eax, dword ptr fs:[00000030h] 2_2_2679A3C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679A3C0 mov eax, dword ptr fs:[00000030h] 2_2_2679A3C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267983C0 mov eax, dword ptr fs:[00000030h] 2_2_267983C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267983C0 mov eax, dword ptr fs:[00000030h] 2_2_267983C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267983C0 mov eax, dword ptr fs:[00000030h] 2_2_267983C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267983C0 mov eax, dword ptr fs:[00000030h] 2_2_267983C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26812349 mov eax, dword ptr fs:[00000030h] 2_2_26812349
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2686634F mov eax, dword ptr fs:[00000030h] 2_2_2686634F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26838350 mov ecx, dword ptr fs:[00000030h] 2_2_26838350
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2685A352 mov eax, dword ptr fs:[00000030h] 2_2_2685A352
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681035C mov eax, dword ptr fs:[00000030h] 2_2_2681035C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681035C mov eax, dword ptr fs:[00000030h] 2_2_2681035C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681035C mov eax, dword ptr fs:[00000030h] 2_2_2681035C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681035C mov ecx, dword ptr fs:[00000030h] 2_2_2681035C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681035C mov eax, dword ptr fs:[00000030h] 2_2_2681035C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681035C mov eax, dword ptr fs:[00000030h] 2_2_2681035C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26788397 mov eax, dword ptr fs:[00000030h] 2_2_26788397
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26788397 mov eax, dword ptr fs:[00000030h] 2_2_26788397
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26788397 mov eax, dword ptr fs:[00000030h] 2_2_26788397
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678E388 mov eax, dword ptr fs:[00000030h] 2_2_2678E388
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678E388 mov eax, dword ptr fs:[00000030h] 2_2_2678E388
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678E388 mov eax, dword ptr fs:[00000030h] 2_2_2678E388
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267B438F mov eax, dword ptr fs:[00000030h] 2_2_267B438F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267B438F mov eax, dword ptr fs:[00000030h] 2_2_267B438F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683437C mov eax, dword ptr fs:[00000030h] 2_2_2683437C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BC073 mov eax, dword ptr fs:[00000030h] 2_2_267BC073
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26792050 mov eax, dword ptr fs:[00000030h] 2_2_26792050
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268280A8 mov eax, dword ptr fs:[00000030h] 2_2_268280A8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268560B8 mov eax, dword ptr fs:[00000030h] 2_2_268560B8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268560B8 mov ecx, dword ptr fs:[00000030h] 2_2_268560B8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678A020 mov eax, dword ptr fs:[00000030h] 2_2_2678A020
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678C020 mov eax, dword ptr fs:[00000030h] 2_2_2678C020
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268120DE mov eax, dword ptr fs:[00000030h] 2_2_268120DE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268160E0 mov eax, dword ptr fs:[00000030h] 2_2_268160E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267AE016 mov eax, dword ptr fs:[00000030h] 2_2_267AE016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267AE016 mov eax, dword ptr fs:[00000030h] 2_2_267AE016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267AE016 mov eax, dword ptr fs:[00000030h] 2_2_267AE016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267AE016 mov eax, dword ptr fs:[00000030h] 2_2_267AE016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26814000 mov ecx, dword ptr fs:[00000030h] 2_2_26814000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26832000 mov eax, dword ptr fs:[00000030h] 2_2_26832000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26832000 mov eax, dword ptr fs:[00000030h] 2_2_26832000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26832000 mov eax, dword ptr fs:[00000030h] 2_2_26832000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26832000 mov eax, dword ptr fs:[00000030h] 2_2_26832000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26832000 mov eax, dword ptr fs:[00000030h] 2_2_26832000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26832000 mov eax, dword ptr fs:[00000030h] 2_2_26832000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26832000 mov eax, dword ptr fs:[00000030h] 2_2_26832000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26832000 mov eax, dword ptr fs:[00000030h] 2_2_26832000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678C0F0 mov eax, dword ptr fs:[00000030h] 2_2_2678C0F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D20F0 mov ecx, dword ptr fs:[00000030h] 2_2_267D20F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267980E9 mov eax, dword ptr fs:[00000030h] 2_2_267980E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678A0E3 mov ecx, dword ptr fs:[00000030h] 2_2_2678A0E3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26826030 mov eax, dword ptr fs:[00000030h] 2_2_26826030
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26816050 mov eax, dword ptr fs:[00000030h] 2_2_26816050
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267880A0 mov eax, dword ptr fs:[00000030h] 2_2_267880A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679208A mov eax, dword ptr fs:[00000030h] 2_2_2679208A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26834180 mov eax, dword ptr fs:[00000030h] 2_2_26834180
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26834180 mov eax, dword ptr fs:[00000030h] 2_2_26834180
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2684C188 mov eax, dword ptr fs:[00000030h] 2_2_2684C188
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2684C188 mov eax, dword ptr fs:[00000030h] 2_2_2684C188
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681019F mov eax, dword ptr fs:[00000030h] 2_2_2681019F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681019F mov eax, dword ptr fs:[00000030h] 2_2_2681019F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681019F mov eax, dword ptr fs:[00000030h] 2_2_2681019F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681019F mov eax, dword ptr fs:[00000030h] 2_2_2681019F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26796154 mov eax, dword ptr fs:[00000030h] 2_2_26796154
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26796154 mov eax, dword ptr fs:[00000030h] 2_2_26796154
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678C156 mov eax, dword ptr fs:[00000030h] 2_2_2678C156
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268561C3 mov eax, dword ptr fs:[00000030h] 2_2_268561C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268561C3 mov eax, dword ptr fs:[00000030h] 2_2_268561C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680E1D0 mov eax, dword ptr fs:[00000030h] 2_2_2680E1D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680E1D0 mov eax, dword ptr fs:[00000030h] 2_2_2680E1D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680E1D0 mov ecx, dword ptr fs:[00000030h] 2_2_2680E1D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680E1D0 mov eax, dword ptr fs:[00000030h] 2_2_2680E1D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680E1D0 mov eax, dword ptr fs:[00000030h] 2_2_2680E1D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C0124 mov eax, dword ptr fs:[00000030h] 2_2_267C0124
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_268661E5 mov eax, dword ptr fs:[00000030h] 2_2_268661E5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C01F8 mov eax, dword ptr fs:[00000030h] 2_2_267C01F8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683E10E mov eax, dword ptr fs:[00000030h] 2_2_2683E10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683E10E mov ecx, dword ptr fs:[00000030h] 2_2_2683E10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683E10E mov eax, dword ptr fs:[00000030h] 2_2_2683E10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683E10E mov eax, dword ptr fs:[00000030h] 2_2_2683E10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683E10E mov ecx, dword ptr fs:[00000030h] 2_2_2683E10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683E10E mov eax, dword ptr fs:[00000030h] 2_2_2683E10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683E10E mov eax, dword ptr fs:[00000030h] 2_2_2683E10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683E10E mov ecx, dword ptr fs:[00000030h] 2_2_2683E10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683E10E mov eax, dword ptr fs:[00000030h] 2_2_2683E10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683E10E mov ecx, dword ptr fs:[00000030h] 2_2_2683E10E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26850115 mov eax, dword ptr fs:[00000030h] 2_2_26850115
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683A118 mov ecx, dword ptr fs:[00000030h] 2_2_2683A118
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683A118 mov eax, dword ptr fs:[00000030h] 2_2_2683A118
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683A118 mov eax, dword ptr fs:[00000030h] 2_2_2683A118
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2683A118 mov eax, dword ptr fs:[00000030h] 2_2_2683A118
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26824144 mov eax, dword ptr fs:[00000030h] 2_2_26824144
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26824144 mov eax, dword ptr fs:[00000030h] 2_2_26824144
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26824144 mov ecx, dword ptr fs:[00000030h] 2_2_26824144
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26824144 mov eax, dword ptr fs:[00000030h] 2_2_26824144
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26824144 mov eax, dword ptr fs:[00000030h] 2_2_26824144
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26828158 mov eax, dword ptr fs:[00000030h] 2_2_26828158
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26864164 mov eax, dword ptr fs:[00000030h] 2_2_26864164
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26864164 mov eax, dword ptr fs:[00000030h] 2_2_26864164
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678A197 mov eax, dword ptr fs:[00000030h] 2_2_2678A197
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678A197 mov eax, dword ptr fs:[00000030h] 2_2_2678A197
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678A197 mov eax, dword ptr fs:[00000030h] 2_2_2678A197
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D0185 mov eax, dword ptr fs:[00000030h] 2_2_267D0185
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26796E71 mov eax, dword ptr fs:[00000030h] 2_2_26796E71
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681CEA0 mov eax, dword ptr fs:[00000030h] 2_2_2681CEA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681CEA0 mov eax, dword ptr fs:[00000030h] 2_2_2681CEA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2681CEA0 mov eax, dword ptr fs:[00000030h] 2_2_2681CEA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678EE5A mov eax, dword ptr fs:[00000030h] 2_2_2678EE5A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2682AEB0 mov eax, dword ptr fs:[00000030h] 2_2_2682AEB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2682AEB0 mov eax, dword ptr fs:[00000030h] 2_2_2682AEB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26846ED0 mov ecx, dword ptr fs:[00000030h] 2_2_26846ED0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26788E1D mov eax, dword ptr fs:[00000030h] 2_2_26788E1D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BAE00 mov eax, dword ptr fs:[00000030h] 2_2_267BAE00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BAE00 mov eax, dword ptr fs:[00000030h] 2_2_267BAE00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BAE00 mov eax, dword ptr fs:[00000030h] 2_2_267BAE00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BAE00 mov ecx, dword ptr fs:[00000030h] 2_2_267BAE00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BAE00 mov eax, dword ptr fs:[00000030h] 2_2_267BAE00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BAE00 mov eax, dword ptr fs:[00000030h] 2_2_267BAE00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BAE00 mov eax, dword ptr fs:[00000030h] 2_2_267BAE00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BAE00 mov eax, dword ptr fs:[00000030h] 2_2_267BAE00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BAE00 mov eax, dword ptr fs:[00000030h] 2_2_267BAE00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BAE00 mov eax, dword ptr fs:[00000030h] 2_2_267BAE00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C8EF5 mov eax, dword ptr fs:[00000030h] 2_2_267C8EF5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26796EE0 mov eax, dword ptr fs:[00000030h] 2_2_26796EE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26796EE0 mov eax, dword ptr fs:[00000030h] 2_2_26796EE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26796EE0 mov eax, dword ptr fs:[00000030h] 2_2_26796EE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26796EE0 mov eax, dword ptr fs:[00000030h] 2_2_26796EE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26826E20 mov eax, dword ptr fs:[00000030h] 2_2_26826E20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26826E20 mov eax, dword ptr fs:[00000030h] 2_2_26826E20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26826E20 mov ecx, dword ptr fs:[00000030h] 2_2_26826E20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26862E4F mov eax, dword ptr fs:[00000030h] 2_2_26862E4F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26862E4F mov eax, dword ptr fs:[00000030h] 2_2_26862E4F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C2E9C mov eax, dword ptr fs:[00000030h] 2_2_267C2E9C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C2E9C mov ecx, dword ptr fs:[00000030h] 2_2_267C2E9C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678AE90 mov eax, dword ptr fs:[00000030h] 2_2_2678AE90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678AE90 mov eax, dword ptr fs:[00000030h] 2_2_2678AE90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678AE90 mov eax, dword ptr fs:[00000030h] 2_2_2678AE90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26810E7F mov eax, dword ptr fs:[00000030h] 2_2_26810E7F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26810E7F mov eax, dword ptr fs:[00000030h] 2_2_26810E7F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26810E7F mov eax, dword ptr fs:[00000030h] 2_2_26810E7F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BAF69 mov eax, dword ptr fs:[00000030h] 2_2_267BAF69
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BAF69 mov eax, dword ptr fs:[00000030h] 2_2_267BAF69
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678CF50 mov eax, dword ptr fs:[00000030h] 2_2_2678CF50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678CF50 mov eax, dword ptr fs:[00000030h] 2_2_2678CF50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678CF50 mov eax, dword ptr fs:[00000030h] 2_2_2678CF50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678CF50 mov eax, dword ptr fs:[00000030h] 2_2_2678CF50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678CF50 mov eax, dword ptr fs:[00000030h] 2_2_2678CF50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678CF50 mov eax, dword ptr fs:[00000030h] 2_2_2678CF50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CCF50 mov eax, dword ptr fs:[00000030h] 2_2_267CCF50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267BEF28 mov eax, dword ptr fs:[00000030h] 2_2_267BEF28
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26864FE7 mov eax, dword ptr fs:[00000030h] 2_2_26864FE7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CCF1F mov eax, dword ptr fs:[00000030h] 2_2_267CCF1F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26792F12 mov eax, dword ptr fs:[00000030h] 2_2_26792F12
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26846FF7 mov eax, dword ptr fs:[00000030h] 2_2_26846FF7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26846F00 mov eax, dword ptr fs:[00000030h] 2_2_26846F00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D0FF6 mov eax, dword ptr fs:[00000030h] 2_2_267D0FF6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D0FF6 mov eax, dword ptr fs:[00000030h] 2_2_267D0FF6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D0FF6 mov eax, dword ptr fs:[00000030h] 2_2_267D0FF6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267D0FF6 mov eax, dword ptr fs:[00000030h] 2_2_267D0FF6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267ACFE0 mov eax, dword ptr fs:[00000030h] 2_2_267ACFE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267ACFE0 mov eax, dword ptr fs:[00000030h] 2_2_267ACFE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678EFD8 mov eax, dword ptr fs:[00000030h] 2_2_2678EFD8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678EFD8 mov eax, dword ptr fs:[00000030h] 2_2_2678EFD8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678EFD8 mov eax, dword ptr fs:[00000030h] 2_2_2678EFD8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26792FC8 mov eax, dword ptr fs:[00000030h] 2_2_26792FC8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26792FC8 mov eax, dword ptr fs:[00000030h] 2_2_26792FC8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26792FC8 mov eax, dword ptr fs:[00000030h] 2_2_26792FC8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26792FC8 mov eax, dword ptr fs:[00000030h] 2_2_26792FC8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26814F40 mov eax, dword ptr fs:[00000030h] 2_2_26814F40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26814F40 mov eax, dword ptr fs:[00000030h] 2_2_26814F40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26814F40 mov eax, dword ptr fs:[00000030h] 2_2_26814F40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26814F40 mov eax, dword ptr fs:[00000030h] 2_2_26814F40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26834F42 mov eax, dword ptr fs:[00000030h] 2_2_26834F42
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26830F50 mov eax, dword ptr fs:[00000030h] 2_2_26830F50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26832F60 mov eax, dword ptr fs:[00000030h] 2_2_26832F60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26832F60 mov eax, dword ptr fs:[00000030h] 2_2_26832F60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C2F98 mov eax, dword ptr fs:[00000030h] 2_2_267C2F98
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C2F98 mov eax, dword ptr fs:[00000030h] 2_2_267C2F98
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26864F68 mov eax, dword ptr fs:[00000030h] 2_2_26864F68
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CCF80 mov eax, dword ptr fs:[00000030h] 2_2_267CCF80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680CCA0 mov ecx, dword ptr fs:[00000030h] 2_2_2680CCA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680CCA0 mov eax, dword ptr fs:[00000030h] 2_2_2680CCA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680CCA0 mov eax, dword ptr fs:[00000030h] 2_2_2680CCA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2680CCA0 mov eax, dword ptr fs:[00000030h] 2_2_2680CCA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C4C59 mov eax, dword ptr fs:[00000030h] 2_2_267C4C59
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679AC50 mov eax, dword ptr fs:[00000030h] 2_2_2679AC50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679AC50 mov eax, dword ptr fs:[00000030h] 2_2_2679AC50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679AC50 mov eax, dword ptr fs:[00000030h] 2_2_2679AC50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679AC50 mov eax, dword ptr fs:[00000030h] 2_2_2679AC50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679AC50 mov eax, dword ptr fs:[00000030h] 2_2_2679AC50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2679AC50 mov eax, dword ptr fs:[00000030h] 2_2_2679AC50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26796C50 mov eax, dword ptr fs:[00000030h] 2_2_26796C50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26796C50 mov eax, dword ptr fs:[00000030h] 2_2_26796C50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26796C50 mov eax, dword ptr fs:[00000030h] 2_2_26796C50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840CB5 mov eax, dword ptr fs:[00000030h] 2_2_26840CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840CB5 mov eax, dword ptr fs:[00000030h] 2_2_26840CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840CB5 mov eax, dword ptr fs:[00000030h] 2_2_26840CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840CB5 mov eax, dword ptr fs:[00000030h] 2_2_26840CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840CB5 mov eax, dword ptr fs:[00000030h] 2_2_26840CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840CB5 mov eax, dword ptr fs:[00000030h] 2_2_26840CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840CB5 mov eax, dword ptr fs:[00000030h] 2_2_26840CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840CB5 mov eax, dword ptr fs:[00000030h] 2_2_26840CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840CB5 mov eax, dword ptr fs:[00000030h] 2_2_26840CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840CB5 mov eax, dword ptr fs:[00000030h] 2_2_26840CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840CB5 mov eax, dword ptr fs:[00000030h] 2_2_26840CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840CB5 mov eax, dword ptr fs:[00000030h] 2_2_26840CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26840CB5 mov eax, dword ptr fs:[00000030h] 2_2_26840CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678EC20 mov eax, dword ptr fs:[00000030h] 2_2_2678EC20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0C00 mov eax, dword ptr fs:[00000030h] 2_2_267A0C00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0C00 mov eax, dword ptr fs:[00000030h] 2_2_267A0C00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0C00 mov eax, dword ptr fs:[00000030h] 2_2_267A0C00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267A0C00 mov eax, dword ptr fs:[00000030h] 2_2_267A0C00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267CCC00 mov eax, dword ptr fs:[00000030h] 2_2_267CCC00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C2CF0 mov eax, dword ptr fs:[00000030h] 2_2_267C2CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C2CF0 mov eax, dword ptr fs:[00000030h] 2_2_267C2CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C2CF0 mov eax, dword ptr fs:[00000030h] 2_2_267C2CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C2CF0 mov eax, dword ptr fs:[00000030h] 2_2_267C2CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26814C0F mov eax, dword ptr fs:[00000030h] 2_2_26814C0F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2682CC20 mov eax, dword ptr fs:[00000030h] 2_2_2682CC20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2682CC20 mov eax, dword ptr fs:[00000030h] 2_2_2682CC20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26788CD0 mov eax, dword ptr fs:[00000030h] 2_2_26788CD0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_2678CCC8 mov eax, dword ptr fs:[00000030h] 2_2_2678CCC8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26834C34 mov eax, dword ptr fs:[00000030h] 2_2_26834C34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26834C34 mov eax, dword ptr fs:[00000030h] 2_2_26834C34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26834C34 mov eax, dword ptr fs:[00000030h] 2_2_26834C34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26834C34 mov eax, dword ptr fs:[00000030h] 2_2_26834C34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26834C34 mov eax, dword ptr fs:[00000030h] 2_2_26834C34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26834C34 mov eax, dword ptr fs:[00000030h] 2_2_26834C34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26834C34 mov ecx, dword ptr fs:[00000030h] 2_2_26834C34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267B8CB1 mov eax, dword ptr fs:[00000030h] 2_2_267B8CB1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267B8CB1 mov eax, dword ptr fs:[00000030h] 2_2_267B8CB1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26788C8D mov eax, dword ptr fs:[00000030h] 2_2_26788C8D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26790D59 mov eax, dword ptr fs:[00000030h] 2_2_26790D59
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26790D59 mov eax, dword ptr fs:[00000030h] 2_2_26790D59
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26790D59 mov eax, dword ptr fs:[00000030h] 2_2_26790D59
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26798D59 mov eax, dword ptr fs:[00000030h] 2_2_26798D59
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26798D59 mov eax, dword ptr fs:[00000030h] 2_2_26798D59
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26798D59 mov eax, dword ptr fs:[00000030h] 2_2_26798D59
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26798D59 mov eax, dword ptr fs:[00000030h] 2_2_26798D59
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26798D59 mov eax, dword ptr fs:[00000030h] 2_2_26798D59
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26858DAE mov eax, dword ptr fs:[00000030h] 2_2_26858DAE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26858DAE mov eax, dword ptr fs:[00000030h] 2_2_26858DAE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26864DAD mov eax, dword ptr fs:[00000030h] 2_2_26864DAD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26814DD7 mov eax, dword ptr fs:[00000030h] 2_2_26814DD7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26814DD7 mov eax, dword ptr fs:[00000030h] 2_2_26814DD7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267C4D1D mov eax, dword ptr fs:[00000030h] 2_2_267C4D1D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26786D10 mov eax, dword ptr fs:[00000030h] 2_2_26786D10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26786D10 mov eax, dword ptr fs:[00000030h] 2_2_26786D10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26786D10 mov eax, dword ptr fs:[00000030h] 2_2_26786D10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26830DF0 mov eax, dword ptr fs:[00000030h] 2_2_26830DF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_26830DF0 mov eax, dword ptr fs:[00000030h] 2_2_26830DF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 2_2_267AAD00 mov eax, dword ptr fs:[00000030h] 2_2_267AAD00

HIPS / PFW / Operating System Protection Evasion
barindex
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 6440000 protect: page execute and read and write Jump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Thread created: C:\Windows\SysWOW64\colorcpl.exe EIP: 6441560 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 6440000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Memory written: C:\Windows\SysWOW64\colorcpl.exe base: 6440000 Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 0_2_032B5ACC
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: GetLocaleInfoA, 0_2_032BA7C4
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 0_2_032B5BD8
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: GetLocaleInfoA, 0_2_032BA810
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032B920C GetLocalTime, 0_2_032B920C
Source: C:\Users\user\Desktop\Swift payment confirmation.exe Code function: 0_2_032BB78C GetVersionExA, 0_2_032BB78C

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.colorcpl.exe.6440000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.colorcpl.exe.6440000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2292243782.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2292379544.0000000006440000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.colorcpl.exe.6440000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.colorcpl.exe.6440000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2292243782.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2292379544.0000000006440000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
3.5.29.82
 unknown United States
14618 AMAZON-AESUS false
52.217.102.228
 s3-w.us-east-1.amazonaws.com United States
16509 AMAZON-02US false
185.166.143.50
 bitbucket.org Germany
16509 AMAZON-02US true

Contacted Domains

Name IP Active
s3-w.us-east-1.amazonaws.com 52.217.102.228 true
bitbucket.org 185.166.143.50 true
bbuseruploads.s3.amazonaws.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://bitbucket.org/akeem4u/canter/downloads/233_Hherfkswbzh true
    		unknown