Analysis Report Swift copy.pdf.exe

Overview

General Information

Sample Name: Swift copy.pdf.exe
Analysis ID: 385261
MD5: 5946d0ee4becb515a1cf39ef3f3dde56
SHA1: 3321193ab8c09ab1098d8104afd021145eca89c3
SHA256: 2e2c3bd3883976fc398bc30cadaa16043e792861e7b12db344cd285375df8605
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000005.00000002.389888963.0000000000FB0000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.wapgoals.com/ifne/"], "decoy": ["science1230.com", "louiesluncheonette.com", "radsum.info", "ziscogore.com", "smlet.com", "bbasgroup.com", "trailyerlife.com", "sparklingtheworld.com", "rileysboutique.com", "weightneutralmetflex.com", "haznegocioconnosotros.com", "hfuu.net", "tdfsz.com", "buymy1sthome.com", "karmicreaction.com", "yy111.xyz", "bkajaxkja.com", "midtownbuilder.com", "stepmed.life", "alkeses.com", "xstreamagile.com", "prostroyka.com", "xisiman1688.com", "eyelashextensionssanantonio.com", "arrowinsightshunter.com", "lehoachi.com", "rasodemeinkauntha.com", "columbiaprobateattorney.com", "ashleypeckich.com", "thevintagemarque.com", "lorofineart.com", "wearegrowthhackerz.com", "abramstrucking.net", "technomark.xyz", "cursalee.com", "ultimatecatnutrtion.com", "fundamentalflavors.com", "jamaicanallstars.net", "africanosworld.com", "maskfinland.com", "modkit.design", "xuannghiaduong.com", "indiafoodtraveling.com", "towhonoatelecilasyah.site", "agenciaorange.net", "shelterlaapparel.com", "criticalredux.com", "srl-4.com", "bioclear.energy", "mytransactionkeeper.com", "elektroliquid.com", "brabrains.com", "melodylandrum.com", "felipestephan.com", "rosemancreations.com", "lithoprints.art", "ulsanteam.com", "datingliste.online", "solitairenola.com", "kuppers.info", "burningpeel.com", "myscottdalechiropractor.com", "greenzebranetworks.com", "marktheoilguy.com"]}
Multi AV Scanner detection for submitted file
Source: Swift copy.pdf.exe Virustotal: Detection: 30% Perma Link
Source: Swift copy.pdf.exe ReversingLabs: Detection: 20%
Yara detected FormBook
Source: Yara match File source: 00000005.00000002.389888963.0000000000FB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.592938762.0000000003110000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.590975856.00000000000F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.389441848.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.352591073.000000000393F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.389845019.0000000000F80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 5.2.Swift copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Swift copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: Swift copy.pdf.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 5.2.Swift copy.pdf.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: Swift copy.pdf.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: Swift copy.pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: cscript.pdbUGP source: Swift copy.pdf.exe, 00000005.00000002.389930422.0000000000FF0000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000007.00000000.376832719.000000000DC20000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: Swift copy.pdf.exe, 00000005.00000002.389961809.0000000001070000.00000040.00000001.sdmp, cscript.exe, 0000000A.00000002.593735317.0000000004A2F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: Swift copy.pdf.exe, 00000005.00000002.389961809.0000000001070000.00000040.00000001.sdmp, cscript.exe
Source: Binary string: cscript.pdb source: Swift copy.pdf.exe, 00000005.00000002.389930422.0000000000FF0000.00000040.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000007.00000000.376832719.000000000DC20000.00000002.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_025865C8
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_02587338
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_02587337
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_025865B7

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49726 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49726 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49726 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49753 -> 51.222.80.112:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49753 -> 51.222.80.112:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49753 -> 51.222.80.112:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49758 -> 184.168.131.241:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49758 -> 184.168.131.241:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49758 -> 184.168.131.241:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.wapgoals.com/ifne/
Performs DNS queries to domains with low reputation
Source: C:\Windows\explorer.exe DNS query: www.technomark.xyz
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ifne/?AjR=71EtUWdYzxABpFekNdqC6lfpkzJYpQcnmhsYNVCZgcOb/UTZrYaS228nAxG5B59FDGhBRZlxww==&ndndsL=-Zh4XzYxhHVda6t HTTP/1.1Host: www.wapgoals.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ifne/?AjR=dOs+lg2asUoXBO5EZg435RwPxJJuMD/jvsmygwM2KrqI9lfFwJ6FtdZyv1m6A/DgItG0MeGBng==&ndndsL=-Zh4XzYxhHVda6t HTTP/1.1Host: www.criticalredux.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ifne/?AjR=zzTxArteMsObKw8PVSTAy3ItaE+XllOQAe/BMiW6EZ4sNP9JkFpsMwiszAJkxQMr59SfztPEEw==&ndndsL=-Zh4XzYxhHVda6t HTTP/1.1Host: www.rileysboutique.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ifne/?AjR=8GjGM9gH0JgPTr1fPV35mssmA8Ddbt0y6EKlVm4ORHEqitqlBaDBsMKhu0jqcrmxAKX5kfGUAw==&ndndsL=-Zh4XzYxhHVda6t HTTP/1.1Host: www.agenciaorange.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ifne/?AjR=rtUU9PmTXQaf/wGdlMxfwAVfjNGr3c9lw0dfQP58ZOH4+/gv/3vAFDrG/mXph96X+27XXnGiag==&ndndsL=-Zh4XzYxhHVda6t HTTP/1.1Host: www.technomark.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ifne/?AjR=uTh+jOJLcZ1+A+ZwJUR1QlGf4dkpQViro8P/md11fzExOFziGJv9l1WMjbCU3sRscsfoVkwx1Q==&ndndsL=-Zh4XzYxhHVda6t HTTP/1.1Host: www.indiafoodtraveling.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 204.11.56.48 204.11.56.48
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: IHNETUS IHNETUS
Source: Joe Sandbox View ASN Name: CONFLUENCE-NETWORK-INCVG CONFLUENCE-NETWORK-INCVG
Source: global traffic HTTP traffic detected: GET /ifne/?AjR=71EtUWdYzxABpFekNdqC6lfpkzJYpQcnmhsYNVCZgcOb/UTZrYaS228nAxG5B59FDGhBRZlxww==&ndndsL=-Zh4XzYxhHVda6t HTTP/1.1Host: www.wapgoals.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ifne/?AjR=dOs+lg2asUoXBO5EZg435RwPxJJuMD/jvsmygwM2KrqI9lfFwJ6FtdZyv1m6A/DgItG0MeGBng==&ndndsL=-Zh4XzYxhHVda6t HTTP/1.1Host: www.criticalredux.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ifne/?AjR=zzTxArteMsObKw8PVSTAy3ItaE+XllOQAe/BMiW6EZ4sNP9JkFpsMwiszAJkxQMr59SfztPEEw==&ndndsL=-Zh4XzYxhHVda6t HTTP/1.1Host: www.rileysboutique.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ifne/?AjR=8GjGM9gH0JgPTr1fPV35mssmA8Ddbt0y6EKlVm4ORHEqitqlBaDBsMKhu0jqcrmxAKX5kfGUAw==&ndndsL=-Zh4XzYxhHVda6t HTTP/1.1Host: www.agenciaorange.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ifne/?AjR=rtUU9PmTXQaf/wGdlMxfwAVfjNGr3c9lw0dfQP58ZOH4+/gv/3vAFDrG/mXph96X+27XXnGiag==&ndndsL=-Zh4XzYxhHVda6t HTTP/1.1Host: www.technomark.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ifne/?AjR=uTh+jOJLcZ1+A+ZwJUR1QlGf4dkpQViro8P/md11fzExOFziGJv9l1WMjbCU3sRscsfoVkwx1Q==&ndndsL=-Zh4XzYxhHVda6t HTTP/1.1Host: www.indiafoodtraveling.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.wapgoals.com
Source: Swift copy.pdf.exe, 00000000.00000003.328158175.0000000005739000.00000004.00000001.sdmp String found in binary or memory: http://en.w
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.eot
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.eot?#iefix
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.otf
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.svg#ubuntu-b
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.ttf
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.woff
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.woff2
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.eot
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.eot?#iefix
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.otf
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.svg#ubuntu-r
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.ttf
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.woff
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.woff2
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/pics/12471/arrow.png)
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/pics/12471/bodybg.png)
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/pics/12471/kwbg.jpg)
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/pics/12471/libg.png)
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/pics/12471/libgh.png)
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://i4.cdn-image.com/__media__/pics/12471/logo.png)
Source: Swift copy.pdf.exe, 00000000.00000002.351601216.0000000002791000.00000004.00000001.sdmp, Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Swift copy.pdf.exe, 00000000.00000003.332048994.000000000576D000.00000004.00000001.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.htmlv
Source: explorer.exe, 00000007.00000002.591935318.000000000095C000.00000004.00000020.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Swift copy.pdf.exe, 00000000.00000003.331103187.0000000005735000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com
Source: Swift copy.pdf.exe, 00000000.00000003.330492743.0000000005736000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comL
Source: Swift copy.pdf.exe, 00000000.00000003.330492743.0000000005736000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coma-d
Source: Swift copy.pdf.exe, 00000000.00000003.330492743.0000000005736000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comdjq
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Swift copy.pdf.exe, 00000000.00000003.330492743.0000000005736000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.como.
Source: Swift copy.pdf.exe, 00000000.00000003.331103187.0000000005735000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.como.n
Source: Swift copy.pdf.exe, 00000000.00000003.330492743.0000000005736000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coms
Source: Swift copy.pdf.exe, 00000000.00000003.330492743.0000000005736000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comu
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Swift copy.pdf.exe, 00000000.00000003.334591290.0000000005765000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html8
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Swift copy.pdf.exe, 00000000.00000003.334591290.0000000005765000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmll
Source: Swift copy.pdf.exe, 00000000.00000003.334358377.0000000005765000.00000004.00000001.sdmp, Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Swift copy.pdf.exe, 00000000.00000002.356233417.0000000005730000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comltom4~g
Source: Swift copy.pdf.exe, 00000000.00000002.356233417.0000000005730000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comm
Source: Swift copy.pdf.exe, 00000000.00000002.356233417.0000000005730000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.commH
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Swift copy.pdf.exe, 00000000.00000003.337103443.0000000005765000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/n
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Swift copy.pdf.exe, 00000000.00000003.337103443.0000000005765000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/z
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://www.indiafoodtraveling.com/px.js?ch=1
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://www.indiafoodtraveling.com/px.js?ch=2
Source: cscript.exe, 0000000A.00000002.595872841.00000000050E2000.00000004.00000001.sdmp String found in binary or memory: http://www.indiafoodtraveling.com/sk-logabpstatus.php?a=OHpkUkI0Y0QxUWRjUnVBV284aHBwcjQ2RmVkZlhNYU5Y
Source: Swift copy.pdf.exe, 00000000.00000003.331358786.0000000005738000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Swift copy.pdf.exe, 00000000.00000003.331358786.0000000005738000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Aq
Source: Swift copy.pdf.exe, 00000000.00000003.331358786.0000000005738000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/o.H
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Swift copy.pdf.exe, 00000000.00000003.332090387.0000000005765000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: cscript.exe, 0000000A.00000002.591457906.00000000002C7000.00000004.00000020.sdmp String found in binary or memory: http://www.stepmed.life/ifne/?AjR=cNnBXpKXSwxtuHjKs6rP8ZpLsoLiQU1uQw7AksJLx/bmQGd
Source: explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: Swift copy.pdf.exe, 00000000.00000003.328467490.000000000574B000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comF
Source: Swift copy.pdf.exe, 00000000.00000003.331103187.0000000005735000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comS~
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Swift copy.pdf.exe, 00000000.00000002.356278222.0000000005820000.00000002.00000001.sdmp, explorer.exe, 00000007.00000000.374916858.000000000B1A0000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Swift copy.pdf.exe, 00000000.00000003.330492743.0000000005736000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cnd&~u
Source: Swift copy.pdf.exe, 00000000.00000003.330492743.0000000005736000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cno.n
Source: Swift copy.pdf.exe, 00000000.00000003.330492743.0000000005736000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cns
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000005.00000002.389888963.0000000000FB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.592938762.0000000003110000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.590975856.00000000000F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.389441848.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.352591073.000000000393F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.389845019.0000000000F80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 5.2.Swift copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Swift copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000005.00000002.389888963.0000000000FB0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.389888963.0000000000FB0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.592938762.0000000003110000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.592938762.0000000003110000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.590975856.00000000000F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.590975856.00000000000F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.389441848.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.389441848.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.352591073.000000000393F000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.352591073.000000000393F000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.389845019.0000000000F80000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.389845019.0000000000F80000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.Swift copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.Swift copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.Swift copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.Swift copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Swift copy.pdf.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D23BBC NtQueryInformationProcess, 0_2_06D23BBC
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_004181B0 NtCreateFile, 5_2_004181B0
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_00418260 NtReadFile, 5_2_00418260
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_004182E0 NtClose, 5_2_004182E0
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_00418390 NtAllocateVirtualMemory, 5_2_00418390
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_004181AA NtCreateFile, 5_2_004181AA
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979840 NtDelayExecution,LdrInitializeThunk, 10_2_04979840
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979860 NtQuerySystemInformation,LdrInitializeThunk, 10_2_04979860
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049799A0 NtCreateSection,LdrInitializeThunk, 10_2_049799A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049795D0 NtClose,LdrInitializeThunk, 10_2_049795D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979910 NtAdjustPrivilegesToken,LdrInitializeThunk, 10_2_04979910
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979540 NtReadFile,LdrInitializeThunk, 10_2_04979540
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049796D0 NtCreateKey,LdrInitializeThunk, 10_2_049796D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049796E0 NtFreeVirtualMemory,LdrInitializeThunk, 10_2_049796E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979A50 NtCreateFile,LdrInitializeThunk, 10_2_04979A50
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979650 NtQueryValueKey,LdrInitializeThunk, 10_2_04979650
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979660 NtAllocateVirtualMemory,LdrInitializeThunk, 10_2_04979660
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979780 NtMapViewOfSection,LdrInitializeThunk, 10_2_04979780
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979FE0 NtCreateMutant,LdrInitializeThunk, 10_2_04979FE0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979710 NtQueryInformationToken,LdrInitializeThunk, 10_2_04979710
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049798A0 NtWriteVirtualMemory, 10_2_049798A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049798F0 NtReadVirtualMemory, 10_2_049798F0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979820 NtEnumerateKey, 10_2_04979820
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0497B040 NtSuspendThread, 10_2_0497B040
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049799D0 NtCreateProcessEx, 10_2_049799D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049795F0 NtQueryInformationFile, 10_2_049795F0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0497AD30 NtSetContextThread, 10_2_0497AD30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979520 NtWaitForSingleObject, 10_2_04979520
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979950 NtQueueApcThread, 10_2_04979950
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979560 NtWriteFile, 10_2_04979560
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979A80 NtOpenDirectoryObject, 10_2_04979A80
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979610 NtEnumerateValueKey, 10_2_04979610
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979A10 NtQuerySection, 10_2_04979A10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979A00 NtProtectVirtualMemory, 10_2_04979A00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979A20 NtResumeThread, 10_2_04979A20
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979670 NtQueryInformationProcess, 10_2_04979670
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0497A3B0 NtGetContextThread, 10_2_0497A3B0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049797A0 NtUnmapViewOfSection, 10_2_049797A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0497A710 NtOpenProcessToken, 10_2_0497A710
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979B00 NtSetValueKey, 10_2_04979B00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979730 NtQueryVirtualMemory, 10_2_04979730
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979770 NtSetInformationFile, 10_2_04979770
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0497A770 NtOpenThread, 10_2_0497A770
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04979760 NtOpenProcess, 10_2_04979760
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_03128390 NtAllocateVirtualMemory, 10_2_03128390
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_03128260 NtReadFile, 10_2_03128260
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_031282E0 NtClose, 10_2_031282E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_031281B0 NtCreateFile, 10_2_031281B0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_031281AA NtCreateFile, 10_2_031281AA
Detected potential crypto function
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_00D0C2B0 0_2_00D0C2B0
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_00D09968 0_2_00D09968
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_02580040 0_2_02580040
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_02583C68 0_2_02583C68
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_02580006 0_2_02580006
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_02583619 0_2_02583619
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_02583890 0_2_02583890
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_02586E48 0_2_02586E48
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_02583EFA 0_2_02583EFA
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_02583E8B 0_2_02583E8B
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_02580F6F 0_2_02580F6F
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_02580F80 0_2_02580F80
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D2C4D0 0_2_06D2C4D0
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D2E570 0_2_06D2E570
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D221A8 0_2_06D221A8
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D25140 0_2_06D25140
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D2DC78 0_2_06D2DC78
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D21DD8 0_2_06D21DD8
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D2FAC0 0_2_06D2FAC0
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D26A20 0_2_06D26A20
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D24B80 0_2_06D24B80
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D25B80 0_2_06D25B80
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D248A0 0_2_06D248A0
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D25613 0_2_06D25613
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D25620 0_2_06D25620
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D28470 0_2_06D28470
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D28460 0_2_06D28460
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D28278 0_2_06D28278
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D250F3 0_2_06D250F3
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D221A0 0_2_06D221A0
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D29113 0_2_06D29113
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D25133 0_2_06D25133
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_06D29120 0_2_06D29120
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_001C2050 0_2_001C2050
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 4_2_00112050 4_2_00112050
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_00401030 5_2_00401030
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_00408C50 5_2_00408C50
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_0041B493 5_2_0041B493
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_0041C585 5_2_0041C585
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_00402D88 5_2_00402D88
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_00402D90 5_2_00402D90
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_0041C591 5_2_0041C591
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_00402FB0 5_2_00402FB0
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_00502050 5_2_00502050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494B090 10_2_0494B090
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A020A8 10_2_04A020A8
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049620A0 10_2_049620A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494841F 10_2_0494841F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1002 10_2_049F1002
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04962581 10_2_04962581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494D5E0 10_2_0494D5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493F900 10_2_0493F900
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A02D07 10_2_04A02D07
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04930D20 10_2_04930D20
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04954120 10_2_04954120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A01D55 10_2_04A01D55
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A022AE 10_2_04A022AE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A02EF7 10_2_04A02EF7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04956E30 10_2_04956E30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496EBB0 10_2_0496EBB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A01FF1 10_2_04A01FF1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A02B28 10_2_04A02B28
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_03112FB0 10_2_03112FB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_03112D90 10_2_03112D90
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0312C591 10_2_0312C591
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0312C585 10_2_0312C585
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_03112D88 10_2_03112D88
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_03118C50 10_2_03118C50
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0312B493 10_2_0312B493
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\cscript.exe Code function: String function: 0493B150 appears 35 times
PE file contains strange resources
Source: Swift copy.pdf.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: Swift copy.pdf.exe Binary or memory string: OriginalFilename vs Swift copy.pdf.exe
Source: Swift copy.pdf.exe, 00000000.00000002.349185865.00000000001C2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameDefaultDecoder.exe> vs Swift copy.pdf.exe
Source: Swift copy.pdf.exe, 00000000.00000002.362132971.0000000006F50000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDSASignature.dll" vs Swift copy.pdf.exe
Source: Swift copy.pdf.exe, 00000000.00000002.362079019.0000000006D30000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSimpleUI.dll2 vs Swift copy.pdf.exe
Source: Swift copy.pdf.exe Binary or memory string: OriginalFilename vs Swift copy.pdf.exe
Source: Swift copy.pdf.exe, 00000004.00000002.347496434.0000000000112000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameDefaultDecoder.exe> vs Swift copy.pdf.exe
Source: Swift copy.pdf.exe Binary or memory string: OriginalFilename vs Swift copy.pdf.exe
Source: Swift copy.pdf.exe, 00000005.00000002.390364207.000000000131F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Swift copy.pdf.exe
Source: Swift copy.pdf.exe, 00000005.00000002.389930422.0000000000FF0000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamecscript.exe` vs Swift copy.pdf.exe
Source: Swift copy.pdf.exe, 00000005.00000002.389481115.0000000000502000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameDefaultDecoder.exe> vs Swift copy.pdf.exe
Source: Swift copy.pdf.exe Binary or memory string: OriginalFilenameDefaultDecoder.exe> vs Swift copy.pdf.exe
Uses 32bit PE files
Source: Swift copy.pdf.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 00000005.00000002.389888963.0000000000FB0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.389888963.0000000000FB0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.592938762.0000000003110000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.592938762.0000000003110000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.590975856.00000000000F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.590975856.00000000000F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.389441848.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.389441848.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.352591073.000000000393F000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.352591073.000000000393F000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.389845019.0000000000F80000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.389845019.0000000000F80000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.Swift copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.Swift copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.Swift copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.Swift copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Swift copy.pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@10/1@10/7
Source: C:\Users\user\Desktop\Swift copy.pdf.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Swift copy.pdf.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:724:120:WilError_01
Source: Swift copy.pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Swift copy.pdf.exe Virustotal: Detection: 30%
Source: Swift copy.pdf.exe ReversingLabs: Detection: 20%
Source: unknown Process created: C:\Users\user\Desktop\Swift copy.pdf.exe 'C:\Users\user\Desktop\Swift copy.pdf.exe'
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process created: C:\Users\user\Desktop\Swift copy.pdf.exe C:\Users\user\Desktop\Swift copy.pdf.exe
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process created: C:\Users\user\Desktop\Swift copy.pdf.exe C:\Users\user\Desktop\Swift copy.pdf.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cscript.exe
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Swift copy.pdf.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process created: C:\Users\user\Desktop\Swift copy.pdf.exe C:\Users\user\Desktop\Swift copy.pdf.exe Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process created: C:\Users\user\Desktop\Swift copy.pdf.exe C:\Users\user\Desktop\Swift copy.pdf.exe Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Swift copy.pdf.exe' Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Swift copy.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Swift copy.pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: cscript.pdbUGP source: Swift copy.pdf.exe, 00000005.00000002.389930422.0000000000FF0000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000007.00000000.376832719.000000000DC20000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: Swift copy.pdf.exe, 00000005.00000002.389961809.0000000001070000.00000040.00000001.sdmp, cscript.exe, 0000000A.00000002.593735317.0000000004A2F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: Swift copy.pdf.exe, 00000005.00000002.389961809.0000000001070000.00000040.00000001.sdmp, cscript.exe
Source: Binary string: cscript.pdb source: Swift copy.pdf.exe, 00000005.00000002.389930422.0000000000FF0000.00000040.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000007.00000000.376832719.000000000DC20000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_0258308A push ss; retf 0_2_02583094
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 0_2_02582AC6 push es; ret 0_2_02582AC7
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_0040C296 pushfd ; retf 5_2_0040C2B1
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_0041B3F2 push eax; ret 5_2_0041B3F8
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_0041B3FB push eax; ret 5_2_0041B462
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_0041B3A5 push eax; ret 5_2_0041B3F8
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_0041B45C push eax; ret 5_2_0041B462
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_004154CC push ss; iretd 5_2_004154CD
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_0040AFE9 push cs; ret 5_2_0040AFEC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0498D0D1 push ecx; ret 10_2_0498D0E4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0312B3A5 push eax; ret 10_2_0312B3F8
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0312B3F2 push eax; ret 10_2_0312B3F8
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0312B3FB push eax; ret 10_2_0312B462
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0311C296 pushfd ; retf 10_2_0311C2B1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0311AFE9 push cs; ret 10_2_0311AFEC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0312B45C push eax; ret 10_2_0312B462
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_031254CC push ss; iretd 10_2_031254CD
Source: initial sample Static PE information: section name: .text entropy: 7.95048824536

Hooking and other Techniques for Hiding and Protection:

barindex
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Source: initial sample Icon embedded in binary file: icon matches a legit application icon: icon (5001).png
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: pdf.exe Static PE information: Swift copy.pdf.exe
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Swift copy.pdf.exe PID: 6628, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Swift copy.pdf.exe RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Swift copy.pdf.exe RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 00000000031185E4 second address: 00000000031185EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 000000000311896E second address: 0000000003118974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_004088A0 rdtsc 5_2_004088A0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Swift copy.pdf.exe TID: 6632 Thread sleep time: -102883s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe TID: 6652 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 2524 Thread sleep time: -35000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe TID: 6780 Thread sleep time: -36000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Thread delayed: delay time: 102883 Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000007.00000000.373852974.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000007.00000000.373819513.00000000083EB000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000007.00000000.373679366.00000000082E2000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000002.606371070.0000000005D50000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000007.00000000.370918951.00000000063F6000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: cscript.exe, 0000000A.00000002.591526613.00000000002EC000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000007.00000002.606371070.0000000005D50000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000007.00000000.370918951.00000000063F6000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: vmware
Source: explorer.exe, 00000007.00000000.373819513.00000000083EB000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Swift copy.pdf.exe, 00000000.00000002.351677909.00000000027E5000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: explorer.exe, 00000007.00000000.373679366.00000000082E2000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000007.00000002.606371070.0000000005D50000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000007.00000000.373679366.00000000082E2000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000007.00000000.373852974.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000007.00000002.591935318.000000000095C000.00000004.00000020.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: explorer.exe, 00000007.00000002.606371070.0000000005D50000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_004088A0 rdtsc 5_2_004088A0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Code function: 5_2_00409B10 LdrLoadDll, 5_2_00409B10
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494849B mov eax, dword ptr fs:[00000030h] 10_2_0494849B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04939080 mov eax, dword ptr fs:[00000030h] 10_2_04939080
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B3884 mov eax, dword ptr fs:[00000030h] 10_2_049B3884
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B3884 mov eax, dword ptr fs:[00000030h] 10_2_049B3884
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496F0BF mov ecx, dword ptr fs:[00000030h] 10_2_0496F0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496F0BF mov eax, dword ptr fs:[00000030h] 10_2_0496F0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496F0BF mov eax, dword ptr fs:[00000030h] 10_2_0496F0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049620A0 mov eax, dword ptr fs:[00000030h] 10_2_049620A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049620A0 mov eax, dword ptr fs:[00000030h] 10_2_049620A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049620A0 mov eax, dword ptr fs:[00000030h] 10_2_049620A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049620A0 mov eax, dword ptr fs:[00000030h] 10_2_049620A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049620A0 mov eax, dword ptr fs:[00000030h] 10_2_049620A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049620A0 mov eax, dword ptr fs:[00000030h] 10_2_049620A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049790AF mov eax, dword ptr fs:[00000030h] 10_2_049790AF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049CB8D0 mov eax, dword ptr fs:[00000030h] 10_2_049CB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049CB8D0 mov ecx, dword ptr fs:[00000030h] 10_2_049CB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049CB8D0 mov eax, dword ptr fs:[00000030h] 10_2_049CB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049CB8D0 mov eax, dword ptr fs:[00000030h] 10_2_049CB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049CB8D0 mov eax, dword ptr fs:[00000030h] 10_2_049CB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049CB8D0 mov eax, dword ptr fs:[00000030h] 10_2_049CB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F14FB mov eax, dword ptr fs:[00000030h] 10_2_049F14FB
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B6CF0 mov eax, dword ptr fs:[00000030h] 10_2_049B6CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B6CF0 mov eax, dword ptr fs:[00000030h] 10_2_049B6CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B6CF0 mov eax, dword ptr fs:[00000030h] 10_2_049B6CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A08CD6 mov eax, dword ptr fs:[00000030h] 10_2_04A08CD6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049358EC mov eax, dword ptr fs:[00000030h] 10_2_049358EC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B7016 mov eax, dword ptr fs:[00000030h] 10_2_049B7016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B7016 mov eax, dword ptr fs:[00000030h] 10_2_049B7016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B7016 mov eax, dword ptr fs:[00000030h] 10_2_049B7016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B6C0A mov eax, dword ptr fs:[00000030h] 10_2_049B6C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B6C0A mov eax, dword ptr fs:[00000030h] 10_2_049B6C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B6C0A mov eax, dword ptr fs:[00000030h] 10_2_049B6C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B6C0A mov eax, dword ptr fs:[00000030h] 10_2_049B6C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1C06 mov eax, dword ptr fs:[00000030h] 10_2_049F1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1C06 mov eax, dword ptr fs:[00000030h] 10_2_049F1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1C06 mov eax, dword ptr fs:[00000030h] 10_2_049F1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1C06 mov eax, dword ptr fs:[00000030h] 10_2_049F1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1C06 mov eax, dword ptr fs:[00000030h] 10_2_049F1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1C06 mov eax, dword ptr fs:[00000030h] 10_2_049F1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1C06 mov eax, dword ptr fs:[00000030h] 10_2_049F1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1C06 mov eax, dword ptr fs:[00000030h] 10_2_049F1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1C06 mov eax, dword ptr fs:[00000030h] 10_2_049F1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1C06 mov eax, dword ptr fs:[00000030h] 10_2_049F1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1C06 mov eax, dword ptr fs:[00000030h] 10_2_049F1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1C06 mov eax, dword ptr fs:[00000030h] 10_2_049F1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1C06 mov eax, dword ptr fs:[00000030h] 10_2_049F1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1C06 mov eax, dword ptr fs:[00000030h] 10_2_049F1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A0740D mov eax, dword ptr fs:[00000030h] 10_2_04A0740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A0740D mov eax, dword ptr fs:[00000030h] 10_2_04A0740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A0740D mov eax, dword ptr fs:[00000030h] 10_2_04A0740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A04015 mov eax, dword ptr fs:[00000030h] 10_2_04A04015
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A04015 mov eax, dword ptr fs:[00000030h] 10_2_04A04015
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496BC2C mov eax, dword ptr fs:[00000030h] 10_2_0496BC2C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496002D mov eax, dword ptr fs:[00000030h] 10_2_0496002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496002D mov eax, dword ptr fs:[00000030h] 10_2_0496002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496002D mov eax, dword ptr fs:[00000030h] 10_2_0496002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496002D mov eax, dword ptr fs:[00000030h] 10_2_0496002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496002D mov eax, dword ptr fs:[00000030h] 10_2_0496002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494B02A mov eax, dword ptr fs:[00000030h] 10_2_0494B02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494B02A mov eax, dword ptr fs:[00000030h] 10_2_0494B02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494B02A mov eax, dword ptr fs:[00000030h] 10_2_0494B02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494B02A mov eax, dword ptr fs:[00000030h] 10_2_0494B02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04950050 mov eax, dword ptr fs:[00000030h] 10_2_04950050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04950050 mov eax, dword ptr fs:[00000030h] 10_2_04950050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049CC450 mov eax, dword ptr fs:[00000030h] 10_2_049CC450
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049CC450 mov eax, dword ptr fs:[00000030h] 10_2_049CC450
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A01074 mov eax, dword ptr fs:[00000030h] 10_2_04A01074
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496A44B mov eax, dword ptr fs:[00000030h] 10_2_0496A44B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F2073 mov eax, dword ptr fs:[00000030h] 10_2_049F2073
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0495746D mov eax, dword ptr fs:[00000030h] 10_2_0495746D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04962990 mov eax, dword ptr fs:[00000030h] 10_2_04962990
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A005AC mov eax, dword ptr fs:[00000030h] 10_2_04A005AC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A005AC mov eax, dword ptr fs:[00000030h] 10_2_04A005AC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496FD9B mov eax, dword ptr fs:[00000030h] 10_2_0496FD9B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496FD9B mov eax, dword ptr fs:[00000030h] 10_2_0496FD9B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496A185 mov eax, dword ptr fs:[00000030h] 10_2_0496A185
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0495C182 mov eax, dword ptr fs:[00000030h] 10_2_0495C182
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04962581 mov eax, dword ptr fs:[00000030h] 10_2_04962581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04962581 mov eax, dword ptr fs:[00000030h] 10_2_04962581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04962581 mov eax, dword ptr fs:[00000030h] 10_2_04962581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04962581 mov eax, dword ptr fs:[00000030h] 10_2_04962581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04932D8A mov eax, dword ptr fs:[00000030h] 10_2_04932D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04932D8A mov eax, dword ptr fs:[00000030h] 10_2_04932D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04932D8A mov eax, dword ptr fs:[00000030h] 10_2_04932D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04932D8A mov eax, dword ptr fs:[00000030h] 10_2_04932D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04932D8A mov eax, dword ptr fs:[00000030h] 10_2_04932D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04961DB5 mov eax, dword ptr fs:[00000030h] 10_2_04961DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04961DB5 mov eax, dword ptr fs:[00000030h] 10_2_04961DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04961DB5 mov eax, dword ptr fs:[00000030h] 10_2_04961DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B51BE mov eax, dword ptr fs:[00000030h] 10_2_049B51BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B51BE mov eax, dword ptr fs:[00000030h] 10_2_049B51BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B51BE mov eax, dword ptr fs:[00000030h] 10_2_049B51BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B51BE mov eax, dword ptr fs:[00000030h] 10_2_049B51BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049661A0 mov eax, dword ptr fs:[00000030h] 10_2_049661A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049661A0 mov eax, dword ptr fs:[00000030h] 10_2_049661A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049635A1 mov eax, dword ptr fs:[00000030h] 10_2_049635A1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B69A6 mov eax, dword ptr fs:[00000030h] 10_2_049B69A6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B6DC9 mov eax, dword ptr fs:[00000030h] 10_2_049B6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B6DC9 mov eax, dword ptr fs:[00000030h] 10_2_049B6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B6DC9 mov eax, dword ptr fs:[00000030h] 10_2_049B6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B6DC9 mov ecx, dword ptr fs:[00000030h] 10_2_049B6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B6DC9 mov eax, dword ptr fs:[00000030h] 10_2_049B6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B6DC9 mov eax, dword ptr fs:[00000030h] 10_2_049B6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049E8DF1 mov eax, dword ptr fs:[00000030h] 10_2_049E8DF1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493B1E1 mov eax, dword ptr fs:[00000030h] 10_2_0493B1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493B1E1 mov eax, dword ptr fs:[00000030h] 10_2_0493B1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493B1E1 mov eax, dword ptr fs:[00000030h] 10_2_0493B1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049C41E8 mov eax, dword ptr fs:[00000030h] 10_2_049C41E8
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494D5E0 mov eax, dword ptr fs:[00000030h] 10_2_0494D5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494D5E0 mov eax, dword ptr fs:[00000030h] 10_2_0494D5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04939100 mov eax, dword ptr fs:[00000030h] 10_2_04939100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04939100 mov eax, dword ptr fs:[00000030h] 10_2_04939100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04939100 mov eax, dword ptr fs:[00000030h] 10_2_04939100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A08D34 mov eax, dword ptr fs:[00000030h] 10_2_04A08D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04943D34 mov eax, dword ptr fs:[00000030h] 10_2_04943D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04943D34 mov eax, dword ptr fs:[00000030h] 10_2_04943D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04943D34 mov eax, dword ptr fs:[00000030h] 10_2_04943D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04943D34 mov eax, dword ptr fs:[00000030h] 10_2_04943D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04943D34 mov eax, dword ptr fs:[00000030h] 10_2_04943D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04943D34 mov eax, dword ptr fs:[00000030h] 10_2_04943D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04943D34 mov eax, dword ptr fs:[00000030h] 10_2_04943D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04943D34 mov eax, dword ptr fs:[00000030h] 10_2_04943D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04943D34 mov eax, dword ptr fs:[00000030h] 10_2_04943D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04943D34 mov eax, dword ptr fs:[00000030h] 10_2_04943D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04943D34 mov eax, dword ptr fs:[00000030h] 10_2_04943D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04943D34 mov eax, dword ptr fs:[00000030h] 10_2_04943D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04943D34 mov eax, dword ptr fs:[00000030h] 10_2_04943D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493AD30 mov eax, dword ptr fs:[00000030h] 10_2_0493AD30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496513A mov eax, dword ptr fs:[00000030h] 10_2_0496513A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496513A mov eax, dword ptr fs:[00000030h] 10_2_0496513A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049BA537 mov eax, dword ptr fs:[00000030h] 10_2_049BA537
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04964D3B mov eax, dword ptr fs:[00000030h] 10_2_04964D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04964D3B mov eax, dword ptr fs:[00000030h] 10_2_04964D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04964D3B mov eax, dword ptr fs:[00000030h] 10_2_04964D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04954120 mov eax, dword ptr fs:[00000030h] 10_2_04954120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04954120 mov eax, dword ptr fs:[00000030h] 10_2_04954120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04954120 mov eax, dword ptr fs:[00000030h] 10_2_04954120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04954120 mov eax, dword ptr fs:[00000030h] 10_2_04954120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04954120 mov ecx, dword ptr fs:[00000030h] 10_2_04954120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04957D50 mov eax, dword ptr fs:[00000030h] 10_2_04957D50
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0495B944 mov eax, dword ptr fs:[00000030h] 10_2_0495B944
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0495B944 mov eax, dword ptr fs:[00000030h] 10_2_0495B944
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04973D43 mov eax, dword ptr fs:[00000030h] 10_2_04973D43
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B3540 mov eax, dword ptr fs:[00000030h] 10_2_049B3540
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493B171 mov eax, dword ptr fs:[00000030h] 10_2_0493B171
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493B171 mov eax, dword ptr fs:[00000030h] 10_2_0493B171
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0495C577 mov eax, dword ptr fs:[00000030h] 10_2_0495C577
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0495C577 mov eax, dword ptr fs:[00000030h] 10_2_0495C577
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493C962 mov eax, dword ptr fs:[00000030h] 10_2_0493C962
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496D294 mov eax, dword ptr fs:[00000030h] 10_2_0496D294
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496D294 mov eax, dword ptr fs:[00000030h] 10_2_0496D294
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A00EA5 mov eax, dword ptr fs:[00000030h] 10_2_04A00EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A00EA5 mov eax, dword ptr fs:[00000030h] 10_2_04A00EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A00EA5 mov eax, dword ptr fs:[00000030h] 10_2_04A00EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049CFE87 mov eax, dword ptr fs:[00000030h] 10_2_049CFE87
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494AAB0 mov eax, dword ptr fs:[00000030h] 10_2_0494AAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494AAB0 mov eax, dword ptr fs:[00000030h] 10_2_0494AAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496FAB0 mov eax, dword ptr fs:[00000030h] 10_2_0496FAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049352A5 mov eax, dword ptr fs:[00000030h] 10_2_049352A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049352A5 mov eax, dword ptr fs:[00000030h] 10_2_049352A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049352A5 mov eax, dword ptr fs:[00000030h] 10_2_049352A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049352A5 mov eax, dword ptr fs:[00000030h] 10_2_049352A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049352A5 mov eax, dword ptr fs:[00000030h] 10_2_049352A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B46A7 mov eax, dword ptr fs:[00000030h] 10_2_049B46A7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04978EC7 mov eax, dword ptr fs:[00000030h] 10_2_04978EC7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049636CC mov eax, dword ptr fs:[00000030h] 10_2_049636CC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04962ACB mov eax, dword ptr fs:[00000030h] 10_2_04962ACB
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049EFEC0 mov eax, dword ptr fs:[00000030h] 10_2_049EFEC0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04962AE4 mov eax, dword ptr fs:[00000030h] 10_2_04962AE4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049616E0 mov ecx, dword ptr fs:[00000030h] 10_2_049616E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A08ED6 mov eax, dword ptr fs:[00000030h] 10_2_04A08ED6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049476E2 mov eax, dword ptr fs:[00000030h] 10_2_049476E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04935210 mov eax, dword ptr fs:[00000030h] 10_2_04935210
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04935210 mov ecx, dword ptr fs:[00000030h] 10_2_04935210
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04935210 mov eax, dword ptr fs:[00000030h] 10_2_04935210
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04935210 mov eax, dword ptr fs:[00000030h] 10_2_04935210
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493AA16 mov eax, dword ptr fs:[00000030h] 10_2_0493AA16
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493AA16 mov eax, dword ptr fs:[00000030h] 10_2_0493AA16
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04953A1C mov eax, dword ptr fs:[00000030h] 10_2_04953A1C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496A61C mov eax, dword ptr fs:[00000030h] 10_2_0496A61C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496A61C mov eax, dword ptr fs:[00000030h] 10_2_0496A61C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493C600 mov eax, dword ptr fs:[00000030h] 10_2_0493C600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493C600 mov eax, dword ptr fs:[00000030h] 10_2_0493C600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493C600 mov eax, dword ptr fs:[00000030h] 10_2_0493C600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04968E00 mov eax, dword ptr fs:[00000030h] 10_2_04968E00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F1608 mov eax, dword ptr fs:[00000030h] 10_2_049F1608
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04948A0A mov eax, dword ptr fs:[00000030h] 10_2_04948A0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049EFE3F mov eax, dword ptr fs:[00000030h] 10_2_049EFE3F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493E620 mov eax, dword ptr fs:[00000030h] 10_2_0493E620
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04974A2C mov eax, dword ptr fs:[00000030h] 10_2_04974A2C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04974A2C mov eax, dword ptr fs:[00000030h] 10_2_04974A2C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A08A62 mov eax, dword ptr fs:[00000030h] 10_2_04A08A62
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049C4257 mov eax, dword ptr fs:[00000030h] 10_2_049C4257
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04939240 mov eax, dword ptr fs:[00000030h] 10_2_04939240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04939240 mov eax, dword ptr fs:[00000030h] 10_2_04939240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04939240 mov eax, dword ptr fs:[00000030h] 10_2_04939240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04939240 mov eax, dword ptr fs:[00000030h] 10_2_04939240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04947E41 mov eax, dword ptr fs:[00000030h] 10_2_04947E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04947E41 mov eax, dword ptr fs:[00000030h] 10_2_04947E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04947E41 mov eax, dword ptr fs:[00000030h] 10_2_04947E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04947E41 mov eax, dword ptr fs:[00000030h] 10_2_04947E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04947E41 mov eax, dword ptr fs:[00000030h] 10_2_04947E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04947E41 mov eax, dword ptr fs:[00000030h] 10_2_04947E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0495AE73 mov eax, dword ptr fs:[00000030h] 10_2_0495AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0495AE73 mov eax, dword ptr fs:[00000030h] 10_2_0495AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0495AE73 mov eax, dword ptr fs:[00000030h] 10_2_0495AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0495AE73 mov eax, dword ptr fs:[00000030h] 10_2_0495AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0495AE73 mov eax, dword ptr fs:[00000030h] 10_2_0495AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0497927A mov eax, dword ptr fs:[00000030h] 10_2_0497927A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494766D mov eax, dword ptr fs:[00000030h] 10_2_0494766D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049EB260 mov eax, dword ptr fs:[00000030h] 10_2_049EB260
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049EB260 mov eax, dword ptr fs:[00000030h] 10_2_049EB260
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04948794 mov eax, dword ptr fs:[00000030h] 10_2_04948794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04962397 mov eax, dword ptr fs:[00000030h] 10_2_04962397
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A05BA5 mov eax, dword ptr fs:[00000030h] 10_2_04A05BA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496B390 mov eax, dword ptr fs:[00000030h] 10_2_0496B390
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B7794 mov eax, dword ptr fs:[00000030h] 10_2_049B7794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B7794 mov eax, dword ptr fs:[00000030h] 10_2_049B7794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B7794 mov eax, dword ptr fs:[00000030h] 10_2_049B7794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F138A mov eax, dword ptr fs:[00000030h] 10_2_049F138A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04941B8F mov eax, dword ptr fs:[00000030h] 10_2_04941B8F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04941B8F mov eax, dword ptr fs:[00000030h] 10_2_04941B8F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049ED380 mov ecx, dword ptr fs:[00000030h] 10_2_049ED380
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04964BAD mov eax, dword ptr fs:[00000030h] 10_2_04964BAD
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04964BAD mov eax, dword ptr fs:[00000030h] 10_2_04964BAD
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04964BAD mov eax, dword ptr fs:[00000030h] 10_2_04964BAD
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B53CA mov eax, dword ptr fs:[00000030h] 10_2_049B53CA
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049B53CA mov eax, dword ptr fs:[00000030h] 10_2_049B53CA
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049737F5 mov eax, dword ptr fs:[00000030h] 10_2_049737F5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049603E2 mov eax, dword ptr fs:[00000030h] 10_2_049603E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049603E2 mov eax, dword ptr fs:[00000030h] 10_2_049603E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049603E2 mov eax, dword ptr fs:[00000030h] 10_2_049603E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049603E2 mov eax, dword ptr fs:[00000030h] 10_2_049603E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049603E2 mov eax, dword ptr fs:[00000030h] 10_2_049603E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049603E2 mov eax, dword ptr fs:[00000030h] 10_2_049603E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0495DBE9 mov eax, dword ptr fs:[00000030h] 10_2_0495DBE9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0495F716 mov eax, dword ptr fs:[00000030h] 10_2_0495F716
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049F131B mov eax, dword ptr fs:[00000030h] 10_2_049F131B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049CFF10 mov eax, dword ptr fs:[00000030h] 10_2_049CFF10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_049CFF10 mov eax, dword ptr fs:[00000030h] 10_2_049CFF10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496A70E mov eax, dword ptr fs:[00000030h] 10_2_0496A70E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496A70E mov eax, dword ptr fs:[00000030h] 10_2_0496A70E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0496E730 mov eax, dword ptr fs:[00000030h] 10_2_0496E730
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A0070D mov eax, dword ptr fs:[00000030h] 10_2_04A0070D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A0070D mov eax, dword ptr fs:[00000030h] 10_2_04A0070D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04934F2E mov eax, dword ptr fs:[00000030h] 10_2_04934F2E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04934F2E mov eax, dword ptr fs:[00000030h] 10_2_04934F2E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A08F6A mov eax, dword ptr fs:[00000030h] 10_2_04A08F6A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493F358 mov eax, dword ptr fs:[00000030h] 10_2_0493F358
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493DB40 mov eax, dword ptr fs:[00000030h] 10_2_0493DB40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494EF40 mov eax, dword ptr fs:[00000030h] 10_2_0494EF40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04963B7A mov eax, dword ptr fs:[00000030h] 10_2_04963B7A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04963B7A mov eax, dword ptr fs:[00000030h] 10_2_04963B7A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0493DB60 mov ecx, dword ptr fs:[00000030h] 10_2_0493DB60
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_0494FF60 mov eax, dword ptr fs:[00000030h] 10_2_0494FF60
Source: C:\Windows\SysWOW64\cscript.exe Code function: 10_2_04A08B58 mov eax, dword ptr fs:[00000030h] 10_2_04A08B58
Enables debug privileges
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.agenciaorange.net
Source: C:\Windows\explorer.exe Domain query: www.lehoachi.com
Source: C:\Windows\explorer.exe Network Connect: 204.11.56.48 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 74.208.236.87 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.technomark.xyz
Source: C:\Windows\explorer.exe Domain query: www.wapgoals.com
Source: C:\Windows\explorer.exe Network Connect: 174.136.25.55 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 45.33.51.100 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.rileysboutique.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 51.222.80.112 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.stepmed.life
Source: C:\Windows\explorer.exe Domain query: www.indiafoodtraveling.com
Source: C:\Windows\explorer.exe Network Connect: 5.101.123.53 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.criticalredux.com
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Memory written: C:\Users\user\Desktop\Swift copy.pdf.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Thread register set: target process: 3440 Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Thread register set: target process: 3440 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Section unmapped: C:\Windows\SysWOW64\cscript.exe base address: 30000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process created: C:\Users\user\Desktop\Swift copy.pdf.exe C:\Users\user\Desktop\Swift copy.pdf.exe Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Process created: C:\Users\user\Desktop\Swift copy.pdf.exe C:\Users\user\Desktop\Swift copy.pdf.exe Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Swift copy.pdf.exe' Jump to behavior
Source: explorer.exe, 00000007.00000002.592968697.0000000000EE0000.00000002.00000001.sdmp, cscript.exe, 0000000A.00000002.593147820.0000000003500000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000002.592968697.0000000000EE0000.00000002.00000001.sdmp, cscript.exe, 0000000A.00000002.593147820.0000000003500000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000007.00000002.592968697.0000000000EE0000.00000002.00000001.sdmp, cscript.exe, 0000000A.00000002.593147820.0000000003500000.00000002.00000001.sdmp Binary or memory string: &Program Manager
Source: explorer.exe, 00000007.00000002.592968697.0000000000EE0000.00000002.00000001.sdmp, cscript.exe, 0000000A.00000002.593147820.0000000003500000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Users\user\Desktop\Swift copy.pdf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Swift copy.pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000005.00000002.389888963.0000000000FB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.592938762.0000000003110000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.590975856.00000000000F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.389441848.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.352591073.000000000393F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.389845019.0000000000F80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 5.2.Swift copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Swift copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000005.00000002.389888963.0000000000FB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.592938762.0000000003110000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.590975856.00000000000F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.389441848.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.352591073.000000000393F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.389845019.0000000000F80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 5.2.Swift copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Swift copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 385261 Sample: Swift copy.pdf.exe Startdate: 12/04/2021 Architecture: WINDOWS Score: 100 36 www.marktheoilguy.com 2->36 38 marktheoilguy.com 2->38 48 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->48 50 Found malware configuration 2->50 52 Malicious sample detected (through community Yara rule) 2->52 54 10 other signatures 2->54 11 Swift copy.pdf.exe 3 2->11         started        signatures3 process4 file5 34 C:\Users\user\...\Swift copy.pdf.exe.log, ASCII 11->34 dropped 66 Injects a PE file into a foreign processes 11->66 15 Swift copy.pdf.exe 11->15         started        18 Swift copy.pdf.exe 11->18         started        signatures6 process7 signatures8 68 Modifies the context of a thread in another process (thread injection) 15->68 70 Maps a DLL or memory area into another process 15->70 72 Sample uses process hollowing technique 15->72 74 Queues an APC in another process (thread injection) 15->74 20 explorer.exe 15->20 injected process9 dnsIp10 40 www.stepmed.life 5.101.123.53, 80 PAGM-ASEE Estonia 20->40 42 agenciaorange.net 51.222.80.112, 49753, 80 OVHFR France 20->42 44 10 other IPs or domains 20->44 56 System process connects to network (likely due to code injection or exploit) 20->56 58 Performs DNS queries to domains with low reputation 20->58 24 cscript.exe 12 20->24         started        28 autoconv.exe 20->28         started        signatures11 process12 dnsIp13 46 www.stepmed.life 24->46 60 Modifies the context of a thread in another process (thread injection) 24->60 62 Maps a DLL or memory area into another process 24->62 64 Tries to detect virtualization through RDTSC time measurements 24->64 30 cmd.exe 1 24->30         started        signatures14 process15 process16 32 conhost.exe 30->32         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
174.136.25.55
 technomark.xyz United States
33494 IHNETUS true
204.11.56.48
 www.indiafoodtraveling.com Virgin Islands (BRITISH)
40034 CONFLUENCE-NETWORK-INCVG true
45.33.51.100
 hosted.fireside.fm United States
63949 LINODE-APLinodeLLCUS false
74.208.236.87
 www.rileysboutique.com United States
8560 ONEANDONE-ASBrauerstrasse48DE true
34.102.136.180
 wapgoals.com United States
15169 GOOGLEUS false
51.222.80.112
 agenciaorange.net France
16276 OVHFR true
5.101.123.53
 www.stepmed.life Estonia
198068 PAGM-ASEE true

Contacted Domains

Name IP Active
hosted.fireside.fm 45.33.51.100 true
wapgoals.com 34.102.136.180 true
marktheoilguy.com 184.168.131.241 true
www.rileysboutique.com 74.208.236.87 true
technomark.xyz 174.136.25.55 true
www.stepmed.life 5.101.123.53 true
agenciaorange.net 51.222.80.112 true
www.indiafoodtraveling.com 204.11.56.48 true
www.agenciaorange.net unknown unknown
www.lehoachi.com unknown unknown
www.marktheoilguy.com unknown unknown
www.technomark.xyz unknown unknown
www.wapgoals.com unknown unknown
www.criticalredux.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.criticalredux.com/ifne/?AjR=dOs+lg2asUoXBO5EZg435RwPxJJuMD/jvsmygwM2KrqI9lfFwJ6FtdZyv1m6A/DgItG0MeGBng==&ndndsL=-Zh4XzYxhHVda6t true
  • Avira URL Cloud: safe
 unknown
www.wapgoals.com/ifne/ true
  • Avira URL Cloud: safe
 low
http://www.agenciaorange.net/ifne/?AjR=8GjGM9gH0JgPTr1fPV35mssmA8Ddbt0y6EKlVm4ORHEqitqlBaDBsMKhu0jqcrmxAKX5kfGUAw==&ndndsL=-Zh4XzYxhHVda6t true
  • Avira URL Cloud: safe
 unknown
http://www.wapgoals.com/ifne/?AjR=71EtUWdYzxABpFekNdqC6lfpkzJYpQcnmhsYNVCZgcOb/UTZrYaS228nAxG5B59FDGhBRZlxww==&ndndsL=-Zh4XzYxhHVda6t false
  • Avira URL Cloud: safe
 unknown
http://www.rileysboutique.com/ifne/?AjR=zzTxArteMsObKw8PVSTAy3ItaE+XllOQAe/BMiW6EZ4sNP9JkFpsMwiszAJkxQMr59SfztPEEw==&ndndsL=-Zh4XzYxhHVda6t true
  • Avira URL Cloud: safe
 unknown
http://www.indiafoodtraveling.com/ifne/?AjR=uTh+jOJLcZ1+A+ZwJUR1QlGf4dkpQViro8P/md11fzExOFziGJv9l1WMjbCU3sRscsfoVkwx1Q==&ndndsL=-Zh4XzYxhHVda6t true
  • Avira URL Cloud: safe
 unknown