Windows Analysis Report SWIFT_MT103.exe

Overview

General Information

Sample Name: SWIFT_MT103.exe
Analysis ID: 458843
MD5: b54e7fb4262c31a414b6dbcb49a5d800
SHA1: 060dbdd923a63f4c782afe0d252bbc2e2585d255
SHA256: 6c282c90bf6e72212f3c2038601a503d9e9e36bb417687fc8b16362fe854fa3d
Tags: exenull
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Suspicious Process Start Without DLL
Sigma detected: Suspicious Rundll32 Without Any CommandLine Params
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 0000000B.00000002.357804367.0000000000400000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.bodymoisturizer.online/q4kr/"], "decoy": ["realmodapk.com", "hanoharuka.com", "shivalikspiritualproducts.com", "womenshealthclinincagra.com", "racketpark.com", "startuporig.com", "azkachinas.com", "klanblog.com", "linuxradio.tools", "siteoficial-liquida.com", "glsbuyer.com", "bestdeez.com", "teens2cash.com", "valleyviewconstruct.com", "myfortniteskins.com", "cambecare.com", "csec2011.com", "idookap.com", "warmwallsrecords.com", "smartmirror.one", "alertreels.com", "oiop.online", "61cratoslot.com", "hispanicassoclv.com", "pennyforyourprep.com", "fayansistanbul.com", "superbartendergigs.club", "herr-nourimann.com", "oatkc.net", "romahony.com", "sportcrea.com", "crystalnieblas.com", "lcmet.com", "nwaymyatthu-mm.com", "edsufferen.club", "apispotlight.com", "shadowcatrecording.com", "capwisefin.com", "themesinsider.com", "kadrisells.com", "db-82.com", "rentyoursubmarine.com", "rin-ronshop.com", "donzfamilia.com", "loyalcollegeofart.com", "socialize.site", "shadesailstructure.com", "smcenterbiz.com", "zcdonghua.com", "1420radiolider.com", "ckenpo.com", "trucksitasa.com", "getthistle.com", "usvisanicaragua.com", "josiemaxwrites.com", "dehaagennutraceuticals.com", "noiaapp.com", "blinbins.com", "getreitive.com", "turmericbar.com", "manifestwealthrightnow.com", "garagekuhn.com", "longviewfinancialadvisor.com", "hallworthcapital.com"]}
Multi AV Scanner detection for submitted file
Source: SWIFT_MT103.exe Metadefender: Detection: 31% Perma Link
Source: SWIFT_MT103.exe ReversingLabs: Detection: 78%
Yara detected FormBook
Source: Yara match File source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.357804367.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.301061394.0000000003A29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.358391118.0000000001100000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.465035906.0000000000250000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.467645501.0000000004190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.467412388.00000000029C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.358413416.0000000001130000.00000040.00000001.sdmp, type: MEMORY
Machine Learning detection for sample
Source: SWIFT_MT103.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 11.2.RegSvcs.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: SWIFT_MT103.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: SWIFT_MT103.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wscui.pdbUGP source: explorer.exe, 0000000E.00000000.349194222.0000000006300000.00000002.00000001.sdmp
Source: Binary string: RegSvcs.pdb, source: rundll32.exe, 00000015.00000002.470769360.0000000004907000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 0000000B.00000002.358812103.000000000170F000.00000040.00000001.sdmp, rundll32.exe, 00000015.00000002.468350002.00000000044EF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, rundll32.exe
Source: Binary string: rundll32.pdb source: RegSvcs.exe, 0000000B.00000002.359138151.0000000001920000.00000040.00000001.sdmp
Source: Binary string: rundll32.pdbGCTL source: RegSvcs.exe, 0000000B.00000002.359138151.0000000001920000.00000040.00000001.sdmp
Source: Binary string: RegSvcs.pdb source: rundll32.exe, 00000015.00000002.470769360.0000000004907000.00000004.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 0000000E.00000000.349194222.0000000006300000.00000002.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4x nop then pop edi 11_2_004162D8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4x nop then pop edi 21_2_029D62D8

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.bodymoisturizer.online/q4kr/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /q4kr/?h6=Vpi8s2sp00E&4h_4=CWCBar0ajh7IOPyGoiQ+OSxuK1fv7pOEcpev3lNBz5ExpQMJFIwPX0r3WtdZztc5D/uY HTTP/1.1Host: www.garagekuhn.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: GANDI-AS-2Domainnameregistrar-httpwwwgandinetFR GANDI-AS-2Domainnameregistrar-httpwwwgandinetFR
Source: global traffic HTTP traffic detected: GET /q4kr/?h6=Vpi8s2sp00E&4h_4=CWCBar0ajh7IOPyGoiQ+OSxuK1fv7pOEcpev3lNBz5ExpQMJFIwPX0r3WtdZztc5D/uY HTTP/1.1Host: www.garagekuhn.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.garagekuhn.com
Source: explorer.exe, 0000000E.00000000.324187386.00000000089EB000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: SWIFT_MT103.exe, 00000000.00000003.209514147.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com.TTF
Source: explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SWIFT_MT103.exe, 00000000.00000003.209480927.000000000594D000.00000004.00000001.sdmp, SWIFT_MT103.exe, 00000000.00000003.209448002.000000000594D000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: SWIFT_MT103.exe, 00000000.00000003.209514147.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comR.TTFr
Source: SWIFT_MT103.exe, 00000000.00000003.209514147.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comV
Source: SWIFT_MT103.exe, 00000000.00000003.209514147.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: SWIFT_MT103.exe, 00000000.00000003.209736302.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comals
Source: SWIFT_MT103.exe, 00000000.00000003.288558730.0000000005910000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comasv
Source: SWIFT_MT103.exe, 00000000.00000003.288558730.0000000005910000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comgrita
Source: SWIFT_MT103.exe, 00000000.00000003.209514147.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comi
Source: SWIFT_MT103.exe, 00000000.00000003.209736302.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comm
Source: SWIFT_MT103.exe, 00000000.00000003.288558730.0000000005910000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.como
Source: SWIFT_MT103.exe, 00000000.00000003.288558730.0000000005910000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comt
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: SWIFT_MT103.exe, 00000000.00000003.204967901.0000000005914000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: SWIFT_MT103.exe, 00000000.00000003.204932376.0000000005914000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SWIFT_MT103.exe, 00000000.00000003.204967901.0000000005914000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cno
Source: SWIFT_MT103.exe, 00000000.00000003.210711299.0000000005917000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: SWIFT_MT103.exe, 00000000.00000003.206953988.0000000005916000.00000004.00000001.sdmp, SWIFT_MT103.exe, 00000000.00000003.207158126.0000000005916000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SWIFT_MT103.exe, 00000000.00000003.206953988.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: SWIFT_MT103.exe, 00000000.00000003.206691885.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/3
Source: SWIFT_MT103.exe, 00000000.00000003.206953988.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/D
Source: SWIFT_MT103.exe, 00000000.00000003.207158126.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/M
Source: SWIFT_MT103.exe, 00000000.00000003.206953988.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: SWIFT_MT103.exe, 00000000.00000003.206691885.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/_
Source: SWIFT_MT103.exe, 00000000.00000003.206691885.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/h
Source: SWIFT_MT103.exe, 00000000.00000003.207158126.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/i
Source: SWIFT_MT103.exe, 00000000.00000003.206953988.0000000005916000.00000004.00000001.sdmp, SWIFT_MT103.exe, 00000000.00000003.207158126.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: SWIFT_MT103.exe, 00000000.00000003.207158126.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/D
Source: SWIFT_MT103.exe, 00000000.00000003.207158126.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/_
Source: SWIFT_MT103.exe, 00000000.00000003.206953988.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/r
Source: SWIFT_MT103.exe, 00000000.00000003.206953988.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/o4
Source: SWIFT_MT103.exe, 00000000.00000003.206691885.0000000005916000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/vnoi
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: SWIFT_MT103.exe, 00000000.00000002.307800157.0000000006C12000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.324311407.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: rundll32.exe, 00000015.00000002.470872978.0000000004A82000.00000004.00000001.sdmp String found in binary or memory: https://www.fayansistanbul.com/q4kr/?4h_4=eOXhpEoLIa7YYnf6/8HRqFDyW

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.357804367.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.301061394.0000000003A29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.358391118.0000000001100000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.465035906.0000000000250000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.467645501.0000000004190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.467412388.00000000029C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.358413416.0000000001130000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 11.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.357804367.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.357804367.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.301061394.0000000003A29000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.301061394.0000000003A29000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.358391118.0000000001100000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.358391118.0000000001100000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.465035906.0000000000250000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.465035906.0000000000250000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.467645501.0000000004190000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.467645501.0000000004190000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.467412388.00000000029C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.467412388.00000000029C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.358413416.0000000001130000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.358413416.0000000001130000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
.NET source code contains very large strings
Source: SWIFT_MT103.exe, System.Windows.Forms/TabStyleProvider.cs Long String: Length: 24686
Source: 0.0.SWIFT_MT103.exe.690000.0.unpack, System.Windows.Forms/TabStyleProvider.cs Long String: Length: 24686
Source: 0.2.SWIFT_MT103.exe.690000.0.unpack, System.Windows.Forms/TabStyleProvider.cs Long String: Length: 24686
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_004181D0 NtCreateFile, 11_2_004181D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_00418280 NtReadFile, 11_2_00418280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_00418300 NtClose, 11_2_00418300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_004183B0 NtAllocateVirtualMemory, 11_2_004183B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_004181CD NtCreateFile, 11_2_004181CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_004182FA NtClose, 11_2_004182FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_004183AA NtAllocateVirtualMemory, 11_2_004183AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659910 NtAdjustPrivilegesToken,LdrInitializeThunk, 11_2_01659910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016599A0 NtCreateSection,LdrInitializeThunk, 11_2_016599A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659860 NtQuerySystemInformation,LdrInitializeThunk, 11_2_01659860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659840 NtDelayExecution,LdrInitializeThunk, 11_2_01659840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016598F0 NtReadVirtualMemory,LdrInitializeThunk, 11_2_016598F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659A50 NtCreateFile,LdrInitializeThunk, 11_2_01659A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659A20 NtResumeThread,LdrInitializeThunk, 11_2_01659A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659A00 NtProtectVirtualMemory,LdrInitializeThunk, 11_2_01659A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659540 NtReadFile,LdrInitializeThunk, 11_2_01659540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016595D0 NtClose,LdrInitializeThunk, 11_2_016595D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659710 NtQueryInformationToken,LdrInitializeThunk, 11_2_01659710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659FE0 NtCreateMutant,LdrInitializeThunk, 11_2_01659FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016597A0 NtUnmapViewOfSection,LdrInitializeThunk, 11_2_016597A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659780 NtMapViewOfSection,LdrInitializeThunk, 11_2_01659780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659660 NtAllocateVirtualMemory,LdrInitializeThunk, 11_2_01659660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016596E0 NtFreeVirtualMemory,LdrInitializeThunk, 11_2_016596E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659950 NtQueueApcThread, 11_2_01659950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016599D0 NtCreateProcessEx, 11_2_016599D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0165B040 NtSuspendThread, 11_2_0165B040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659820 NtEnumerateKey, 11_2_01659820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016598A0 NtWriteVirtualMemory, 11_2_016598A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659B00 NtSetValueKey, 11_2_01659B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0165A3B0 NtGetContextThread, 11_2_0165A3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659A10 NtQuerySection, 11_2_01659A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659A80 NtOpenDirectoryObject, 11_2_01659A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659560 NtWriteFile, 11_2_01659560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659520 NtWaitForSingleObject, 11_2_01659520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0165AD30 NtSetContextThread, 11_2_0165AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016595F0 NtQueryInformationFile, 11_2_016595F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659760 NtOpenProcess, 11_2_01659760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659770 NtSetInformationFile, 11_2_01659770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0165A770 NtOpenThread, 11_2_0165A770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659730 NtQueryVirtualMemory, 11_2_01659730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0165A710 NtOpenProcessToken, 11_2_0165A710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659670 NtQueryInformationProcess, 11_2_01659670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659650 NtQueryValueKey, 11_2_01659650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01659610 NtEnumerateValueKey, 11_2_01659610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016596D0 NtCreateKey, 11_2_016596D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439840 NtDelayExecution,LdrInitializeThunk, 21_2_04439840
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439860 NtQuerySystemInformation,LdrInitializeThunk, 21_2_04439860
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439540 NtReadFile,LdrInitializeThunk, 21_2_04439540
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439910 NtAdjustPrivilegesToken,LdrInitializeThunk, 21_2_04439910
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044395D0 NtClose,LdrInitializeThunk, 21_2_044395D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044399A0 NtCreateSection,LdrInitializeThunk, 21_2_044399A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439A50 NtCreateFile,LdrInitializeThunk, 21_2_04439A50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439650 NtQueryValueKey,LdrInitializeThunk, 21_2_04439650
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439660 NtAllocateVirtualMemory,LdrInitializeThunk, 21_2_04439660
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044396D0 NtCreateKey,LdrInitializeThunk, 21_2_044396D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044396E0 NtFreeVirtualMemory,LdrInitializeThunk, 21_2_044396E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439710 NtQueryInformationToken,LdrInitializeThunk, 21_2_04439710
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439FE0 NtCreateMutant,LdrInitializeThunk, 21_2_04439FE0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439780 NtMapViewOfSection,LdrInitializeThunk, 21_2_04439780
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0443B040 NtSuspendThread, 21_2_0443B040
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439820 NtEnumerateKey, 21_2_04439820
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044398F0 NtReadVirtualMemory, 21_2_044398F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044398A0 NtWriteVirtualMemory, 21_2_044398A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439950 NtQueueApcThread, 21_2_04439950
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439560 NtWriteFile, 21_2_04439560
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439520 NtWaitForSingleObject, 21_2_04439520
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0443AD30 NtSetContextThread, 21_2_0443AD30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044399D0 NtCreateProcessEx, 21_2_044399D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044395F0 NtQueryInformationFile, 21_2_044395F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439670 NtQueryInformationProcess, 21_2_04439670
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439A00 NtProtectVirtualMemory, 21_2_04439A00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439610 NtEnumerateValueKey, 21_2_04439610
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439A10 NtQuerySection, 21_2_04439A10
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439A20 NtResumeThread, 21_2_04439A20
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439A80 NtOpenDirectoryObject, 21_2_04439A80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439760 NtOpenProcess, 21_2_04439760
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439770 NtSetInformationFile, 21_2_04439770
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0443A770 NtOpenThread, 21_2_0443A770
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439B00 NtSetValueKey, 21_2_04439B00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0443A710 NtOpenProcessToken, 21_2_0443A710
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04439730 NtQueryVirtualMemory, 21_2_04439730
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044397A0 NtUnmapViewOfSection, 21_2_044397A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0443A3B0 NtGetContextThread, 21_2_0443A3B0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029D8280 NtReadFile, 21_2_029D8280
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029D83B0 NtAllocateVirtualMemory, 21_2_029D83B0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029D8300 NtClose, 21_2_029D8300
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029D81D0 NtCreateFile, 21_2_029D81D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029D82FA NtClose, 21_2_029D82FA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029D83AA NtAllocateVirtualMemory, 21_2_029D83AA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029D81CD NtCreateFile, 21_2_029D81CD
Detected potential crypto function
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_00692050 0_2_00692050
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_00FAC124 0_2_00FAC124
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_00FAE570 0_2_00FAE570
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_00FAE560 0_2_00FAE560
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B0040 0_2_087B0040
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B5A70 0_2_087B5A70
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B8DA8 0_2_087B8DA8
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B46B0 0_2_087B46B0
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B8778 0_2_087B8778
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B3730 0_2_087B3730
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B0F28 0_2_087B0F28
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B3060 0_2_087B3060
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B9058 0_2_087B9058
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B3050 0_2_087B3050
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B9048 0_2_087B9048
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B0012 0_2_087B0012
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B380B 0_2_087B380B
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B5168 0_2_087B5168
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B3268 0_2_087B3268
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B6A68 0_2_087B6A68
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B5A60 0_2_087B5A60
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B8A18 0_2_087B8A18
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B8A09 0_2_087B8A09
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087BB2B5 0_2_087BB2B5
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B4B60 0_2_087B4B60
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B4B50 0_2_087B4B50
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B63E8 0_2_087B63E8
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B6448 0_2_087B6448
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B2CC0 0_2_087B2CC0
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B2CB0 0_2_087B2CB0
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B3518 0_2_087B3518
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B3513 0_2_087B3513
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B3508 0_2_087B3508
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B8D98 0_2_087B8D98
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B1E48 0_2_087B1E48
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B1E38 0_2_087B1E38
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B0E37 0_2_087B0E37
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B1E00 0_2_087B1E00
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B46A0 0_2_087B46A0
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B8769 0_2_087B8769
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B5F58 0_2_087B5F58
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B3722 0_2_087B3722
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_00401030 11_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_00401174 11_2_00401174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_004012FB 11_2_004012FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0041A302 11_2_0041A302
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0041CBDF 11_2_0041CBDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0041CBF8 11_2_0041CBF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_00408C6B 11_2_00408C6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_00408C70 11_2_00408C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0041B4B6 11_2_0041B4B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_00402D87 11_2_00402D87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_00402D90 11_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0041B67D 11_2_0041B67D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0041CF41 11_2_0041CF41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0041B76D 11_2_0041B76D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_00402FB0 11_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01634120 11_2_01634120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161F900 11_2_0161F900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1002 11_2_016D1002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016420A0 11_2_016420A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162B090 11_2_0162B090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164EBB0 11_2_0164EBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E1D55 11_2_016E1D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01610D20 11_2_01610D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162D5E0 11_2_0162D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01642581 11_2_01642581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162841F 11_2_0162841F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01636E30 11_2_01636E30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1002 21_2_044B1002
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440841F 21_2_0440841F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C28EC 21_2_044C28EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440B090 21_2_0440B090
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044220A0 21_2_044220A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C20A8 21_2_044C20A8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C1D55 21_2_044C1D55
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F0D20 21_2_043F0D20
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FF900 21_2_043FF900
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C2D07 21_2_044C2D07
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04414120 21_2_04414120
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C25DD 21_2_044C25DD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440D5E0 21_2_0440D5E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04422581 21_2_04422581
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04416E30 21_2_04416E30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C2EF7 21_2_044C2EF7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C22AE 21_2_044C22AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C2B28 21_2_044C2B28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044BDBD2 21_2_044BDBD2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C1FF1 21_2_044C1FF1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442EBB0 21_2_0442EBB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029DCBDF 21_2_029DCBDF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029DCBF8 21_2_029DCBF8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029DA302 21_2_029DA302
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029DB67D 21_2_029DB67D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029C2FB0 21_2_029C2FB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029DCF41 21_2_029DCF41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029DB4B6 21_2_029DB4B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029C8C70 21_2_029C8C70
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029C8C6B 21_2_029C8C6B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029C2D90 21_2_029C2D90
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029C2D87 21_2_029C2D87
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 0161B150 appears 35 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 043FB150 appears 35 times
Sample file is different than original file name gathered from version info
Source: SWIFT_MT103.exe, 00000000.00000002.310124036.0000000008AF0000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs SWIFT_MT103.exe
Source: SWIFT_MT103.exe, 00000000.00000002.289155708.0000000000746000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamec5ryJ02.exeB vs SWIFT_MT103.exe
Source: SWIFT_MT103.exe, 00000000.00000002.309316141.0000000007470000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs SWIFT_MT103.exe
Source: SWIFT_MT103.exe Binary or memory string: OriginalFilenamec5ryJ02.exeB vs SWIFT_MT103.exe
Uses 32bit PE files
Source: SWIFT_MT103.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 11.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.357804367.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.357804367.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.301061394.0000000003A29000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.301061394.0000000003A29000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.358391118.0000000001100000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.358391118.0000000001100000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.465035906.0000000000250000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.465035906.0000000000250000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.467645501.0000000004190000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.467645501.0000000004190000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.467412388.00000000029C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.467412388.00000000029C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.358413416.0000000001130000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.358413416.0000000001130000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: SWIFT_MT103.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/1@4/1
Source: C:\Users\user\Desktop\SWIFT_MT103.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SWIFT_MT103.exe.log Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Mutant created: \Sessions\1\BaseNamedObjects\zrGjTcAomDDY
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5428:120:WilError_01
Source: SWIFT_MT103.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: SWIFT_MT103.exe Metadefender: Detection: 31%
Source: SWIFT_MT103.exe ReversingLabs: Detection: 78%
Source: unknown Process created: C:\Users\user\Desktop\SWIFT_MT103.exe 'C:\Users\user\Desktop\SWIFT_MT103.exe'
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path} Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe' Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SWIFT_MT103.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SWIFT_MT103.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: SWIFT_MT103.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wscui.pdbUGP source: explorer.exe, 0000000E.00000000.349194222.0000000006300000.00000002.00000001.sdmp
Source: Binary string: RegSvcs.pdb, source: rundll32.exe, 00000015.00000002.470769360.0000000004907000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 0000000B.00000002.358812103.000000000170F000.00000040.00000001.sdmp, rundll32.exe, 00000015.00000002.468350002.00000000044EF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, rundll32.exe
Source: Binary string: rundll32.pdb source: RegSvcs.exe, 0000000B.00000002.359138151.0000000001920000.00000040.00000001.sdmp
Source: Binary string: rundll32.pdbGCTL source: RegSvcs.exe, 0000000B.00000002.359138151.0000000001920000.00000040.00000001.sdmp
Source: Binary string: RegSvcs.pdb source: rundll32.exe, 00000015.00000002.470769360.0000000004907000.00000004.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 0000000E.00000000.349194222.0000000006300000.00000002.00000001.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: SWIFT_MT103.exe, CustomTabControl/Form1.cs .Net Code: X_123123454363 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.SWIFT_MT103.exe.690000.0.unpack, CustomTabControl/Form1.cs .Net Code: X_123123454363 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.SWIFT_MT103.exe.690000.0.unpack, CustomTabControl/Form1.cs .Net Code: X_123123454363 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Binary contains a suspicious time stamp
Source: SWIFT_MT103.exe Static PE information: 0x9CA2CF99 [Thu Apr 10 16:34:33 2053 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087B54A2 push esi; iretd 0_2_087B54A9
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Code function: 0_2_087BDF32 push dword ptr [ebx+ebp-75h]; iretd 0_2_087BDF3D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_004161E2 push ecx; iretd 11_2_004161E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0041C309 pushfd ; iretd 11_2_0041C30A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0041B3C5 push eax; ret 11_2_0041B418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0041B47C push eax; ret 11_2_0041B482
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0041B412 push eax; ret 11_2_0041B418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0041B41B push eax; ret 11_2_0041B482
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_00415F53 pushfd ; iretd 11_2_00415F86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_004157CE push edi; ret 11_2_004157D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_00415F93 pushfd ; iretd 11_2_00415F86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0166D0D1 push ecx; ret 11_2_0166D0E4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0444D0D1 push ecx; ret 21_2_0444D0E4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029DB3C5 push eax; ret 21_2_029DB418
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029DC309 pushfd ; iretd 21_2_029DC30A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029D61E2 push ecx; iretd 21_2_029D61E3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029D5F93 pushfd ; iretd 21_2_029D5F86
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029D57CE push edi; ret 21_2_029D57D4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029D5F53 pushfd ; iretd 21_2_029D5F86
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029DB41B push eax; ret 21_2_029DB482
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029DB412 push eax; ret 21_2_029DB418
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_029DB47C push eax; ret 21_2_029DB482
Source: initial sample Static PE information: section name: .text entropy: 7.83042762199
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: SWIFT_MT103.exe PID: 720, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SWIFT_MT103.exe, 00000000.00000002.292259160.0000000002A91000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SWIFT_MT103.exe, 00000000.00000002.292259160.0000000002A91000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe RDTSC instruction interceptor: First address: 00000000004085F4 second address: 00000000004085FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe RDTSC instruction interceptor: First address: 00000000029C85F4 second address: 00000000029C85FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe RDTSC instruction interceptor: First address: 00000000029C898E second address: 00000000029C8994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_004088C0 rdtsc 11_2_004088C0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SWIFT_MT103.exe TID: 4112 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 0000000E.00000000.323150474.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 0000000E.00000000.323150474.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: SWIFT_MT103.exe, 00000000.00000002.292259160.0000000002A91000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: explorer.exe, 0000000E.00000000.322094574.0000000008220000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 0000000E.00000000.322702703.0000000008640000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: SWIFT_MT103.exe, 00000000.00000002.292259160.0000000002A91000.00000004.00000001.sdmp Binary or memory string: vmware
Source: SWIFT_MT103.exe, 00000000.00000002.292259160.0000000002A91000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SWIFT_MT103.exe, 00000000.00000002.292259160.0000000002A91000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 0000000E.00000000.314193876.00000000055D0000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: SWIFT_MT103.exe, 00000000.00000002.292259160.0000000002A91000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: explorer.exe, 0000000E.00000000.323150474.000000000871F000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 0000000E.00000000.323150474.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 0000000E.00000000.323300831.00000000087D1000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 0000000E.00000000.314257234.0000000005603000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: SWIFT_MT103.exe, 00000000.00000002.292259160.0000000002A91000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 0000000E.00000000.323931222.0000000008907000.00000004.00000001.sdmp Binary or memory string: _VMware_SATA_CD00#5&q
Source: explorer.exe, 0000000E.00000000.322094574.0000000008220000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 0000000E.00000000.322094574.0000000008220000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: SWIFT_MT103.exe, 00000000.00000002.292259160.0000000002A91000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: SWIFT_MT103.exe, 00000000.00000002.292259160.0000000002A91000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: SWIFT_MT103.exe, 00000000.00000002.292259160.0000000002A91000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 0000000E.00000000.322094574.0000000008220000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_004088C0 rdtsc 11_2_004088C0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_00409B30 LdrLoadDll, 11_2_00409B30
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161C962 mov eax, dword ptr fs:[00000030h] 11_2_0161C962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161B171 mov eax, dword ptr fs:[00000030h] 11_2_0161B171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161B171 mov eax, dword ptr fs:[00000030h] 11_2_0161B171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0163B944 mov eax, dword ptr fs:[00000030h] 11_2_0163B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0163B944 mov eax, dword ptr fs:[00000030h] 11_2_0163B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01634120 mov eax, dword ptr fs:[00000030h] 11_2_01634120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01634120 mov eax, dword ptr fs:[00000030h] 11_2_01634120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01634120 mov eax, dword ptr fs:[00000030h] 11_2_01634120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01634120 mov eax, dword ptr fs:[00000030h] 11_2_01634120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01634120 mov ecx, dword ptr fs:[00000030h] 11_2_01634120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164513A mov eax, dword ptr fs:[00000030h] 11_2_0164513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164513A mov eax, dword ptr fs:[00000030h] 11_2_0164513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01619100 mov eax, dword ptr fs:[00000030h] 11_2_01619100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01619100 mov eax, dword ptr fs:[00000030h] 11_2_01619100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01619100 mov eax, dword ptr fs:[00000030h] 11_2_01619100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161B1E1 mov eax, dword ptr fs:[00000030h] 11_2_0161B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161B1E1 mov eax, dword ptr fs:[00000030h] 11_2_0161B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161B1E1 mov eax, dword ptr fs:[00000030h] 11_2_0161B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016A41E8 mov eax, dword ptr fs:[00000030h] 11_2_016A41E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016461A0 mov eax, dword ptr fs:[00000030h] 11_2_016461A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016461A0 mov eax, dword ptr fs:[00000030h] 11_2_016461A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016969A6 mov eax, dword ptr fs:[00000030h] 11_2_016969A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016951BE mov eax, dword ptr fs:[00000030h] 11_2_016951BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016951BE mov eax, dword ptr fs:[00000030h] 11_2_016951BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016951BE mov eax, dword ptr fs:[00000030h] 11_2_016951BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016951BE mov eax, dword ptr fs:[00000030h] 11_2_016951BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164A185 mov eax, dword ptr fs:[00000030h] 11_2_0164A185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0163C182 mov eax, dword ptr fs:[00000030h] 11_2_0163C182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01642990 mov eax, dword ptr fs:[00000030h] 11_2_01642990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E1074 mov eax, dword ptr fs:[00000030h] 11_2_016E1074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D2073 mov eax, dword ptr fs:[00000030h] 11_2_016D2073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01630050 mov eax, dword ptr fs:[00000030h] 11_2_01630050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01630050 mov eax, dword ptr fs:[00000030h] 11_2_01630050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162B02A mov eax, dword ptr fs:[00000030h] 11_2_0162B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162B02A mov eax, dword ptr fs:[00000030h] 11_2_0162B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162B02A mov eax, dword ptr fs:[00000030h] 11_2_0162B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162B02A mov eax, dword ptr fs:[00000030h] 11_2_0162B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164002D mov eax, dword ptr fs:[00000030h] 11_2_0164002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164002D mov eax, dword ptr fs:[00000030h] 11_2_0164002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164002D mov eax, dword ptr fs:[00000030h] 11_2_0164002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164002D mov eax, dword ptr fs:[00000030h] 11_2_0164002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164002D mov eax, dword ptr fs:[00000030h] 11_2_0164002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E4015 mov eax, dword ptr fs:[00000030h] 11_2_016E4015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E4015 mov eax, dword ptr fs:[00000030h] 11_2_016E4015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01697016 mov eax, dword ptr fs:[00000030h] 11_2_01697016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01697016 mov eax, dword ptr fs:[00000030h] 11_2_01697016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01697016 mov eax, dword ptr fs:[00000030h] 11_2_01697016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016158EC mov eax, dword ptr fs:[00000030h] 11_2_016158EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016AB8D0 mov eax, dword ptr fs:[00000030h] 11_2_016AB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016AB8D0 mov ecx, dword ptr fs:[00000030h] 11_2_016AB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016AB8D0 mov eax, dword ptr fs:[00000030h] 11_2_016AB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016AB8D0 mov eax, dword ptr fs:[00000030h] 11_2_016AB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016AB8D0 mov eax, dword ptr fs:[00000030h] 11_2_016AB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016AB8D0 mov eax, dword ptr fs:[00000030h] 11_2_016AB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016420A0 mov eax, dword ptr fs:[00000030h] 11_2_016420A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016420A0 mov eax, dword ptr fs:[00000030h] 11_2_016420A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016420A0 mov eax, dword ptr fs:[00000030h] 11_2_016420A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016420A0 mov eax, dword ptr fs:[00000030h] 11_2_016420A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016420A0 mov eax, dword ptr fs:[00000030h] 11_2_016420A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016420A0 mov eax, dword ptr fs:[00000030h] 11_2_016420A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016590AF mov eax, dword ptr fs:[00000030h] 11_2_016590AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164F0BF mov ecx, dword ptr fs:[00000030h] 11_2_0164F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164F0BF mov eax, dword ptr fs:[00000030h] 11_2_0164F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164F0BF mov eax, dword ptr fs:[00000030h] 11_2_0164F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01619080 mov eax, dword ptr fs:[00000030h] 11_2_01619080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01693884 mov eax, dword ptr fs:[00000030h] 11_2_01693884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01693884 mov eax, dword ptr fs:[00000030h] 11_2_01693884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161DB60 mov ecx, dword ptr fs:[00000030h] 11_2_0161DB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01643B7A mov eax, dword ptr fs:[00000030h] 11_2_01643B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01643B7A mov eax, dword ptr fs:[00000030h] 11_2_01643B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161DB40 mov eax, dword ptr fs:[00000030h] 11_2_0161DB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E8B58 mov eax, dword ptr fs:[00000030h] 11_2_016E8B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161F358 mov eax, dword ptr fs:[00000030h] 11_2_0161F358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D131B mov eax, dword ptr fs:[00000030h] 11_2_016D131B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016403E2 mov eax, dword ptr fs:[00000030h] 11_2_016403E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016403E2 mov eax, dword ptr fs:[00000030h] 11_2_016403E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016403E2 mov eax, dword ptr fs:[00000030h] 11_2_016403E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016403E2 mov eax, dword ptr fs:[00000030h] 11_2_016403E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016403E2 mov eax, dword ptr fs:[00000030h] 11_2_016403E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016403E2 mov eax, dword ptr fs:[00000030h] 11_2_016403E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0163DBE9 mov eax, dword ptr fs:[00000030h] 11_2_0163DBE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016953CA mov eax, dword ptr fs:[00000030h] 11_2_016953CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016953CA mov eax, dword ptr fs:[00000030h] 11_2_016953CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01644BAD mov eax, dword ptr fs:[00000030h] 11_2_01644BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01644BAD mov eax, dword ptr fs:[00000030h] 11_2_01644BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01644BAD mov eax, dword ptr fs:[00000030h] 11_2_01644BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E5BA5 mov eax, dword ptr fs:[00000030h] 11_2_016E5BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D138A mov eax, dword ptr fs:[00000030h] 11_2_016D138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016CD380 mov ecx, dword ptr fs:[00000030h] 11_2_016CD380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01621B8F mov eax, dword ptr fs:[00000030h] 11_2_01621B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01621B8F mov eax, dword ptr fs:[00000030h] 11_2_01621B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01642397 mov eax, dword ptr fs:[00000030h] 11_2_01642397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164B390 mov eax, dword ptr fs:[00000030h] 11_2_0164B390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016CB260 mov eax, dword ptr fs:[00000030h] 11_2_016CB260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016CB260 mov eax, dword ptr fs:[00000030h] 11_2_016CB260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E8A62 mov eax, dword ptr fs:[00000030h] 11_2_016E8A62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0165927A mov eax, dword ptr fs:[00000030h] 11_2_0165927A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01619240 mov eax, dword ptr fs:[00000030h] 11_2_01619240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01619240 mov eax, dword ptr fs:[00000030h] 11_2_01619240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01619240 mov eax, dword ptr fs:[00000030h] 11_2_01619240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01619240 mov eax, dword ptr fs:[00000030h] 11_2_01619240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016A4257 mov eax, dword ptr fs:[00000030h] 11_2_016A4257
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01654A2C mov eax, dword ptr fs:[00000030h] 11_2_01654A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01654A2C mov eax, dword ptr fs:[00000030h] 11_2_01654A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01628A0A mov eax, dword ptr fs:[00000030h] 11_2_01628A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01615210 mov eax, dword ptr fs:[00000030h] 11_2_01615210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01615210 mov ecx, dword ptr fs:[00000030h] 11_2_01615210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01615210 mov eax, dword ptr fs:[00000030h] 11_2_01615210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01615210 mov eax, dword ptr fs:[00000030h] 11_2_01615210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161AA16 mov eax, dword ptr fs:[00000030h] 11_2_0161AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161AA16 mov eax, dword ptr fs:[00000030h] 11_2_0161AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01633A1C mov eax, dword ptr fs:[00000030h] 11_2_01633A1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01642AE4 mov eax, dword ptr fs:[00000030h] 11_2_01642AE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01642ACB mov eax, dword ptr fs:[00000030h] 11_2_01642ACB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016152A5 mov eax, dword ptr fs:[00000030h] 11_2_016152A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016152A5 mov eax, dword ptr fs:[00000030h] 11_2_016152A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016152A5 mov eax, dword ptr fs:[00000030h] 11_2_016152A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016152A5 mov eax, dword ptr fs:[00000030h] 11_2_016152A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016152A5 mov eax, dword ptr fs:[00000030h] 11_2_016152A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162AAB0 mov eax, dword ptr fs:[00000030h] 11_2_0162AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162AAB0 mov eax, dword ptr fs:[00000030h] 11_2_0162AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164FAB0 mov eax, dword ptr fs:[00000030h] 11_2_0164FAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164D294 mov eax, dword ptr fs:[00000030h] 11_2_0164D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164D294 mov eax, dword ptr fs:[00000030h] 11_2_0164D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0163C577 mov eax, dword ptr fs:[00000030h] 11_2_0163C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0163C577 mov eax, dword ptr fs:[00000030h] 11_2_0163C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01653D43 mov eax, dword ptr fs:[00000030h] 11_2_01653D43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01693540 mov eax, dword ptr fs:[00000030h] 11_2_01693540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01637D50 mov eax, dword ptr fs:[00000030h] 11_2_01637D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161AD30 mov eax, dword ptr fs:[00000030h] 11_2_0161AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01623D34 mov eax, dword ptr fs:[00000030h] 11_2_01623D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01623D34 mov eax, dword ptr fs:[00000030h] 11_2_01623D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01623D34 mov eax, dword ptr fs:[00000030h] 11_2_01623D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01623D34 mov eax, dword ptr fs:[00000030h] 11_2_01623D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01623D34 mov eax, dword ptr fs:[00000030h] 11_2_01623D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01623D34 mov eax, dword ptr fs:[00000030h] 11_2_01623D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01623D34 mov eax, dword ptr fs:[00000030h] 11_2_01623D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01623D34 mov eax, dword ptr fs:[00000030h] 11_2_01623D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01623D34 mov eax, dword ptr fs:[00000030h] 11_2_01623D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01623D34 mov eax, dword ptr fs:[00000030h] 11_2_01623D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01623D34 mov eax, dword ptr fs:[00000030h] 11_2_01623D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01623D34 mov eax, dword ptr fs:[00000030h] 11_2_01623D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01623D34 mov eax, dword ptr fs:[00000030h] 11_2_01623D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E8D34 mov eax, dword ptr fs:[00000030h] 11_2_016E8D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0169A537 mov eax, dword ptr fs:[00000030h] 11_2_0169A537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01644D3B mov eax, dword ptr fs:[00000030h] 11_2_01644D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01644D3B mov eax, dword ptr fs:[00000030h] 11_2_01644D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01644D3B mov eax, dword ptr fs:[00000030h] 11_2_01644D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162D5E0 mov eax, dword ptr fs:[00000030h] 11_2_0162D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162D5E0 mov eax, dword ptr fs:[00000030h] 11_2_0162D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016C8DF1 mov eax, dword ptr fs:[00000030h] 11_2_016C8DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01696DC9 mov eax, dword ptr fs:[00000030h] 11_2_01696DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01696DC9 mov eax, dword ptr fs:[00000030h] 11_2_01696DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01696DC9 mov eax, dword ptr fs:[00000030h] 11_2_01696DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01696DC9 mov ecx, dword ptr fs:[00000030h] 11_2_01696DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01696DC9 mov eax, dword ptr fs:[00000030h] 11_2_01696DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01696DC9 mov eax, dword ptr fs:[00000030h] 11_2_01696DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E05AC mov eax, dword ptr fs:[00000030h] 11_2_016E05AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E05AC mov eax, dword ptr fs:[00000030h] 11_2_016E05AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016435A1 mov eax, dword ptr fs:[00000030h] 11_2_016435A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01641DB5 mov eax, dword ptr fs:[00000030h] 11_2_01641DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01641DB5 mov eax, dword ptr fs:[00000030h] 11_2_01641DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01641DB5 mov eax, dword ptr fs:[00000030h] 11_2_01641DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01642581 mov eax, dword ptr fs:[00000030h] 11_2_01642581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01642581 mov eax, dword ptr fs:[00000030h] 11_2_01642581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01642581 mov eax, dword ptr fs:[00000030h] 11_2_01642581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01642581 mov eax, dword ptr fs:[00000030h] 11_2_01642581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01612D8A mov eax, dword ptr fs:[00000030h] 11_2_01612D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01612D8A mov eax, dword ptr fs:[00000030h] 11_2_01612D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01612D8A mov eax, dword ptr fs:[00000030h] 11_2_01612D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01612D8A mov eax, dword ptr fs:[00000030h] 11_2_01612D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01612D8A mov eax, dword ptr fs:[00000030h] 11_2_01612D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164FD9B mov eax, dword ptr fs:[00000030h] 11_2_0164FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164FD9B mov eax, dword ptr fs:[00000030h] 11_2_0164FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0163746D mov eax, dword ptr fs:[00000030h] 11_2_0163746D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164A44B mov eax, dword ptr fs:[00000030h] 11_2_0164A44B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016AC450 mov eax, dword ptr fs:[00000030h] 11_2_016AC450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016AC450 mov eax, dword ptr fs:[00000030h] 11_2_016AC450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164BC2C mov eax, dword ptr fs:[00000030h] 11_2_0164BC2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E740D mov eax, dword ptr fs:[00000030h] 11_2_016E740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E740D mov eax, dword ptr fs:[00000030h] 11_2_016E740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E740D mov eax, dword ptr fs:[00000030h] 11_2_016E740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01696C0A mov eax, dword ptr fs:[00000030h] 11_2_01696C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01696C0A mov eax, dword ptr fs:[00000030h] 11_2_01696C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01696C0A mov eax, dword ptr fs:[00000030h] 11_2_01696C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01696C0A mov eax, dword ptr fs:[00000030h] 11_2_01696C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1C06 mov eax, dword ptr fs:[00000030h] 11_2_016D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1C06 mov eax, dword ptr fs:[00000030h] 11_2_016D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1C06 mov eax, dword ptr fs:[00000030h] 11_2_016D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1C06 mov eax, dword ptr fs:[00000030h] 11_2_016D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1C06 mov eax, dword ptr fs:[00000030h] 11_2_016D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1C06 mov eax, dword ptr fs:[00000030h] 11_2_016D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1C06 mov eax, dword ptr fs:[00000030h] 11_2_016D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1C06 mov eax, dword ptr fs:[00000030h] 11_2_016D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1C06 mov eax, dword ptr fs:[00000030h] 11_2_016D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1C06 mov eax, dword ptr fs:[00000030h] 11_2_016D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1C06 mov eax, dword ptr fs:[00000030h] 11_2_016D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1C06 mov eax, dword ptr fs:[00000030h] 11_2_016D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1C06 mov eax, dword ptr fs:[00000030h] 11_2_016D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D1C06 mov eax, dword ptr fs:[00000030h] 11_2_016D1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016D14FB mov eax, dword ptr fs:[00000030h] 11_2_016D14FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01696CF0 mov eax, dword ptr fs:[00000030h] 11_2_01696CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01696CF0 mov eax, dword ptr fs:[00000030h] 11_2_01696CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01696CF0 mov eax, dword ptr fs:[00000030h] 11_2_01696CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E8CD6 mov eax, dword ptr fs:[00000030h] 11_2_016E8CD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162849B mov eax, dword ptr fs:[00000030h] 11_2_0162849B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162FF60 mov eax, dword ptr fs:[00000030h] 11_2_0162FF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E8F6A mov eax, dword ptr fs:[00000030h] 11_2_016E8F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162EF40 mov eax, dword ptr fs:[00000030h] 11_2_0162EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01614F2E mov eax, dword ptr fs:[00000030h] 11_2_01614F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01614F2E mov eax, dword ptr fs:[00000030h] 11_2_01614F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164E730 mov eax, dword ptr fs:[00000030h] 11_2_0164E730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E070D mov eax, dword ptr fs:[00000030h] 11_2_016E070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E070D mov eax, dword ptr fs:[00000030h] 11_2_016E070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164A70E mov eax, dword ptr fs:[00000030h] 11_2_0164A70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164A70E mov eax, dword ptr fs:[00000030h] 11_2_0164A70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0163F716 mov eax, dword ptr fs:[00000030h] 11_2_0163F716
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016AFF10 mov eax, dword ptr fs:[00000030h] 11_2_016AFF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016AFF10 mov eax, dword ptr fs:[00000030h] 11_2_016AFF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016537F5 mov eax, dword ptr fs:[00000030h] 11_2_016537F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01628794 mov eax, dword ptr fs:[00000030h] 11_2_01628794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01697794 mov eax, dword ptr fs:[00000030h] 11_2_01697794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01697794 mov eax, dword ptr fs:[00000030h] 11_2_01697794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01697794 mov eax, dword ptr fs:[00000030h] 11_2_01697794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0162766D mov eax, dword ptr fs:[00000030h] 11_2_0162766D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0163AE73 mov eax, dword ptr fs:[00000030h] 11_2_0163AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0163AE73 mov eax, dword ptr fs:[00000030h] 11_2_0163AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0163AE73 mov eax, dword ptr fs:[00000030h] 11_2_0163AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0163AE73 mov eax, dword ptr fs:[00000030h] 11_2_0163AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0163AE73 mov eax, dword ptr fs:[00000030h] 11_2_0163AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01627E41 mov eax, dword ptr fs:[00000030h] 11_2_01627E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01627E41 mov eax, dword ptr fs:[00000030h] 11_2_01627E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01627E41 mov eax, dword ptr fs:[00000030h] 11_2_01627E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01627E41 mov eax, dword ptr fs:[00000030h] 11_2_01627E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01627E41 mov eax, dword ptr fs:[00000030h] 11_2_01627E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01627E41 mov eax, dword ptr fs:[00000030h] 11_2_01627E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161E620 mov eax, dword ptr fs:[00000030h] 11_2_0161E620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016CFE3F mov eax, dword ptr fs:[00000030h] 11_2_016CFE3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161C600 mov eax, dword ptr fs:[00000030h] 11_2_0161C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161C600 mov eax, dword ptr fs:[00000030h] 11_2_0161C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0161C600 mov eax, dword ptr fs:[00000030h] 11_2_0161C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01648E00 mov eax, dword ptr fs:[00000030h] 11_2_01648E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164A61C mov eax, dword ptr fs:[00000030h] 11_2_0164A61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_0164A61C mov eax, dword ptr fs:[00000030h] 11_2_0164A61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016276E2 mov eax, dword ptr fs:[00000030h] 11_2_016276E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016416E0 mov ecx, dword ptr fs:[00000030h] 11_2_016416E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_01658EC7 mov eax, dword ptr fs:[00000030h] 11_2_01658EC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016436CC mov eax, dword ptr fs:[00000030h] 11_2_016436CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016CFEC0 mov eax, dword ptr fs:[00000030h] 11_2_016CFEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E8ED6 mov eax, dword ptr fs:[00000030h] 11_2_016E8ED6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E0EA5 mov eax, dword ptr fs:[00000030h] 11_2_016E0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E0EA5 mov eax, dword ptr fs:[00000030h] 11_2_016E0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016E0EA5 mov eax, dword ptr fs:[00000030h] 11_2_016E0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016946A7 mov eax, dword ptr fs:[00000030h] 11_2_016946A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 11_2_016AFE87 mov eax, dword ptr fs:[00000030h] 11_2_016AFE87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442A44B mov eax, dword ptr fs:[00000030h] 21_2_0442A44B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04410050 mov eax, dword ptr fs:[00000030h] 21_2_04410050
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04410050 mov eax, dword ptr fs:[00000030h] 21_2_04410050
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0448C450 mov eax, dword ptr fs:[00000030h] 21_2_0448C450
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0448C450 mov eax, dword ptr fs:[00000030h] 21_2_0448C450
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0441746D mov eax, dword ptr fs:[00000030h] 21_2_0441746D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B2073 mov eax, dword ptr fs:[00000030h] 21_2_044B2073
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C1074 mov eax, dword ptr fs:[00000030h] 21_2_044C1074
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C740D mov eax, dword ptr fs:[00000030h] 21_2_044C740D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C740D mov eax, dword ptr fs:[00000030h] 21_2_044C740D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C740D mov eax, dword ptr fs:[00000030h] 21_2_044C740D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1C06 mov eax, dword ptr fs:[00000030h] 21_2_044B1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1C06 mov eax, dword ptr fs:[00000030h] 21_2_044B1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1C06 mov eax, dword ptr fs:[00000030h] 21_2_044B1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1C06 mov eax, dword ptr fs:[00000030h] 21_2_044B1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1C06 mov eax, dword ptr fs:[00000030h] 21_2_044B1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1C06 mov eax, dword ptr fs:[00000030h] 21_2_044B1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1C06 mov eax, dword ptr fs:[00000030h] 21_2_044B1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1C06 mov eax, dword ptr fs:[00000030h] 21_2_044B1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1C06 mov eax, dword ptr fs:[00000030h] 21_2_044B1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1C06 mov eax, dword ptr fs:[00000030h] 21_2_044B1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1C06 mov eax, dword ptr fs:[00000030h] 21_2_044B1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1C06 mov eax, dword ptr fs:[00000030h] 21_2_044B1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1C06 mov eax, dword ptr fs:[00000030h] 21_2_044B1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1C06 mov eax, dword ptr fs:[00000030h] 21_2_044B1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04476C0A mov eax, dword ptr fs:[00000030h] 21_2_04476C0A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04476C0A mov eax, dword ptr fs:[00000030h] 21_2_04476C0A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04476C0A mov eax, dword ptr fs:[00000030h] 21_2_04476C0A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04476C0A mov eax, dword ptr fs:[00000030h] 21_2_04476C0A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04477016 mov eax, dword ptr fs:[00000030h] 21_2_04477016
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04477016 mov eax, dword ptr fs:[00000030h] 21_2_04477016
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04477016 mov eax, dword ptr fs:[00000030h] 21_2_04477016
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C4015 mov eax, dword ptr fs:[00000030h] 21_2_044C4015
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C4015 mov eax, dword ptr fs:[00000030h] 21_2_044C4015
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440B02A mov eax, dword ptr fs:[00000030h] 21_2_0440B02A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440B02A mov eax, dword ptr fs:[00000030h] 21_2_0440B02A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440B02A mov eax, dword ptr fs:[00000030h] 21_2_0440B02A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440B02A mov eax, dword ptr fs:[00000030h] 21_2_0440B02A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442BC2C mov eax, dword ptr fs:[00000030h] 21_2_0442BC2C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442002D mov eax, dword ptr fs:[00000030h] 21_2_0442002D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442002D mov eax, dword ptr fs:[00000030h] 21_2_0442002D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442002D mov eax, dword ptr fs:[00000030h] 21_2_0442002D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442002D mov eax, dword ptr fs:[00000030h] 21_2_0442002D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442002D mov eax, dword ptr fs:[00000030h] 21_2_0442002D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0448B8D0 mov eax, dword ptr fs:[00000030h] 21_2_0448B8D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0448B8D0 mov ecx, dword ptr fs:[00000030h] 21_2_0448B8D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0448B8D0 mov eax, dword ptr fs:[00000030h] 21_2_0448B8D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0448B8D0 mov eax, dword ptr fs:[00000030h] 21_2_0448B8D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0448B8D0 mov eax, dword ptr fs:[00000030h] 21_2_0448B8D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0448B8D0 mov eax, dword ptr fs:[00000030h] 21_2_0448B8D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C8CD6 mov eax, dword ptr fs:[00000030h] 21_2_044C8CD6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B14FB mov eax, dword ptr fs:[00000030h] 21_2_044B14FB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04476CF0 mov eax, dword ptr fs:[00000030h] 21_2_04476CF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04476CF0 mov eax, dword ptr fs:[00000030h] 21_2_04476CF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04476CF0 mov eax, dword ptr fs:[00000030h] 21_2_04476CF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F9080 mov eax, dword ptr fs:[00000030h] 21_2_043F9080
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04473884 mov eax, dword ptr fs:[00000030h] 21_2_04473884
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04473884 mov eax, dword ptr fs:[00000030h] 21_2_04473884
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F58EC mov eax, dword ptr fs:[00000030h] 21_2_043F58EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440849B mov eax, dword ptr fs:[00000030h] 21_2_0440849B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044220A0 mov eax, dword ptr fs:[00000030h] 21_2_044220A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044220A0 mov eax, dword ptr fs:[00000030h] 21_2_044220A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044220A0 mov eax, dword ptr fs:[00000030h] 21_2_044220A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044220A0 mov eax, dword ptr fs:[00000030h] 21_2_044220A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044220A0 mov eax, dword ptr fs:[00000030h] 21_2_044220A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044220A0 mov eax, dword ptr fs:[00000030h] 21_2_044220A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044390AF mov eax, dword ptr fs:[00000030h] 21_2_044390AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442F0BF mov ecx, dword ptr fs:[00000030h] 21_2_0442F0BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442F0BF mov eax, dword ptr fs:[00000030h] 21_2_0442F0BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442F0BF mov eax, dword ptr fs:[00000030h] 21_2_0442F0BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04433D43 mov eax, dword ptr fs:[00000030h] 21_2_04433D43
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0441B944 mov eax, dword ptr fs:[00000030h] 21_2_0441B944
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0441B944 mov eax, dword ptr fs:[00000030h] 21_2_0441B944
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04473540 mov eax, dword ptr fs:[00000030h] 21_2_04473540
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FAD30 mov eax, dword ptr fs:[00000030h] 21_2_043FAD30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04417D50 mov eax, dword ptr fs:[00000030h] 21_2_04417D50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0441C577 mov eax, dword ptr fs:[00000030h] 21_2_0441C577
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0441C577 mov eax, dword ptr fs:[00000030h] 21_2_0441C577
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F9100 mov eax, dword ptr fs:[00000030h] 21_2_043F9100
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F9100 mov eax, dword ptr fs:[00000030h] 21_2_043F9100
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F9100 mov eax, dword ptr fs:[00000030h] 21_2_043F9100
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FB171 mov eax, dword ptr fs:[00000030h] 21_2_043FB171
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FB171 mov eax, dword ptr fs:[00000030h] 21_2_043FB171
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FC962 mov eax, dword ptr fs:[00000030h] 21_2_043FC962
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04414120 mov eax, dword ptr fs:[00000030h] 21_2_04414120
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04414120 mov eax, dword ptr fs:[00000030h] 21_2_04414120
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04414120 mov eax, dword ptr fs:[00000030h] 21_2_04414120
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04414120 mov eax, dword ptr fs:[00000030h] 21_2_04414120
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04414120 mov ecx, dword ptr fs:[00000030h] 21_2_04414120
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0447A537 mov eax, dword ptr fs:[00000030h] 21_2_0447A537
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044BE539 mov eax, dword ptr fs:[00000030h] 21_2_044BE539
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04403D34 mov eax, dword ptr fs:[00000030h] 21_2_04403D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04403D34 mov eax, dword ptr fs:[00000030h] 21_2_04403D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04403D34 mov eax, dword ptr fs:[00000030h] 21_2_04403D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04403D34 mov eax, dword ptr fs:[00000030h] 21_2_04403D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04403D34 mov eax, dword ptr fs:[00000030h] 21_2_04403D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04403D34 mov eax, dword ptr fs:[00000030h] 21_2_04403D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04403D34 mov eax, dword ptr fs:[00000030h] 21_2_04403D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04403D34 mov eax, dword ptr fs:[00000030h] 21_2_04403D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04403D34 mov eax, dword ptr fs:[00000030h] 21_2_04403D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04403D34 mov eax, dword ptr fs:[00000030h] 21_2_04403D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04403D34 mov eax, dword ptr fs:[00000030h] 21_2_04403D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04403D34 mov eax, dword ptr fs:[00000030h] 21_2_04403D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04403D34 mov eax, dword ptr fs:[00000030h] 21_2_04403D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C8D34 mov eax, dword ptr fs:[00000030h] 21_2_044C8D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442513A mov eax, dword ptr fs:[00000030h] 21_2_0442513A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442513A mov eax, dword ptr fs:[00000030h] 21_2_0442513A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04424D3B mov eax, dword ptr fs:[00000030h] 21_2_04424D3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04424D3B mov eax, dword ptr fs:[00000030h] 21_2_04424D3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04424D3B mov eax, dword ptr fs:[00000030h] 21_2_04424D3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04476DC9 mov eax, dword ptr fs:[00000030h] 21_2_04476DC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04476DC9 mov eax, dword ptr fs:[00000030h] 21_2_04476DC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04476DC9 mov eax, dword ptr fs:[00000030h] 21_2_04476DC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04476DC9 mov ecx, dword ptr fs:[00000030h] 21_2_04476DC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04476DC9 mov eax, dword ptr fs:[00000030h] 21_2_04476DC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04476DC9 mov eax, dword ptr fs:[00000030h] 21_2_04476DC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044841E8 mov eax, dword ptr fs:[00000030h] 21_2_044841E8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440D5E0 mov eax, dword ptr fs:[00000030h] 21_2_0440D5E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440D5E0 mov eax, dword ptr fs:[00000030h] 21_2_0440D5E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044BFDE2 mov eax, dword ptr fs:[00000030h] 21_2_044BFDE2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044BFDE2 mov eax, dword ptr fs:[00000030h] 21_2_044BFDE2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044BFDE2 mov eax, dword ptr fs:[00000030h] 21_2_044BFDE2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044BFDE2 mov eax, dword ptr fs:[00000030h] 21_2_044BFDE2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F2D8A mov eax, dword ptr fs:[00000030h] 21_2_043F2D8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F2D8A mov eax, dword ptr fs:[00000030h] 21_2_043F2D8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F2D8A mov eax, dword ptr fs:[00000030h] 21_2_043F2D8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F2D8A mov eax, dword ptr fs:[00000030h] 21_2_043F2D8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F2D8A mov eax, dword ptr fs:[00000030h] 21_2_043F2D8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044A8DF1 mov eax, dword ptr fs:[00000030h] 21_2_044A8DF1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0441C182 mov eax, dword ptr fs:[00000030h] 21_2_0441C182
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04422581 mov eax, dword ptr fs:[00000030h] 21_2_04422581
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04422581 mov eax, dword ptr fs:[00000030h] 21_2_04422581
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04422581 mov eax, dword ptr fs:[00000030h] 21_2_04422581
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04422581 mov eax, dword ptr fs:[00000030h] 21_2_04422581
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442A185 mov eax, dword ptr fs:[00000030h] 21_2_0442A185
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04422990 mov eax, dword ptr fs:[00000030h] 21_2_04422990
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442FD9B mov eax, dword ptr fs:[00000030h] 21_2_0442FD9B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442FD9B mov eax, dword ptr fs:[00000030h] 21_2_0442FD9B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FB1E1 mov eax, dword ptr fs:[00000030h] 21_2_043FB1E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FB1E1 mov eax, dword ptr fs:[00000030h] 21_2_043FB1E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FB1E1 mov eax, dword ptr fs:[00000030h] 21_2_043FB1E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C05AC mov eax, dword ptr fs:[00000030h] 21_2_044C05AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C05AC mov eax, dword ptr fs:[00000030h] 21_2_044C05AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044769A6 mov eax, dword ptr fs:[00000030h] 21_2_044769A6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044261A0 mov eax, dword ptr fs:[00000030h] 21_2_044261A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044261A0 mov eax, dword ptr fs:[00000030h] 21_2_044261A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044235A1 mov eax, dword ptr fs:[00000030h] 21_2_044235A1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04421DB5 mov eax, dword ptr fs:[00000030h] 21_2_04421DB5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04421DB5 mov eax, dword ptr fs:[00000030h] 21_2_04421DB5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04421DB5 mov eax, dword ptr fs:[00000030h] 21_2_04421DB5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044751BE mov eax, dword ptr fs:[00000030h] 21_2_044751BE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044751BE mov eax, dword ptr fs:[00000030h] 21_2_044751BE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044751BE mov eax, dword ptr fs:[00000030h] 21_2_044751BE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044751BE mov eax, dword ptr fs:[00000030h] 21_2_044751BE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04407E41 mov eax, dword ptr fs:[00000030h] 21_2_04407E41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04407E41 mov eax, dword ptr fs:[00000030h] 21_2_04407E41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04407E41 mov eax, dword ptr fs:[00000030h] 21_2_04407E41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04407E41 mov eax, dword ptr fs:[00000030h] 21_2_04407E41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04407E41 mov eax, dword ptr fs:[00000030h] 21_2_04407E41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04407E41 mov eax, dword ptr fs:[00000030h] 21_2_04407E41
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044BAE44 mov eax, dword ptr fs:[00000030h] 21_2_044BAE44
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044BAE44 mov eax, dword ptr fs:[00000030h] 21_2_044BAE44
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044BEA55 mov eax, dword ptr fs:[00000030h] 21_2_044BEA55
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FE620 mov eax, dword ptr fs:[00000030h] 21_2_043FE620
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04484257 mov eax, dword ptr fs:[00000030h] 21_2_04484257
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FAA16 mov eax, dword ptr fs:[00000030h] 21_2_043FAA16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FAA16 mov eax, dword ptr fs:[00000030h] 21_2_043FAA16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044AB260 mov eax, dword ptr fs:[00000030h] 21_2_044AB260
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044AB260 mov eax, dword ptr fs:[00000030h] 21_2_044AB260
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440766D mov eax, dword ptr fs:[00000030h] 21_2_0440766D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C8A62 mov eax, dword ptr fs:[00000030h] 21_2_044C8A62
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F5210 mov eax, dword ptr fs:[00000030h] 21_2_043F5210
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F5210 mov ecx, dword ptr fs:[00000030h] 21_2_043F5210
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F5210 mov eax, dword ptr fs:[00000030h] 21_2_043F5210
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F5210 mov eax, dword ptr fs:[00000030h] 21_2_043F5210
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0441AE73 mov eax, dword ptr fs:[00000030h] 21_2_0441AE73
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0441AE73 mov eax, dword ptr fs:[00000030h] 21_2_0441AE73
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0441AE73 mov eax, dword ptr fs:[00000030h] 21_2_0441AE73
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0441AE73 mov eax, dword ptr fs:[00000030h] 21_2_0441AE73
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0441AE73 mov eax, dword ptr fs:[00000030h] 21_2_0441AE73
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0443927A mov eax, dword ptr fs:[00000030h] 21_2_0443927A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FC600 mov eax, dword ptr fs:[00000030h] 21_2_043FC600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FC600 mov eax, dword ptr fs:[00000030h] 21_2_043FC600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FC600 mov eax, dword ptr fs:[00000030h] 21_2_043FC600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04428E00 mov eax, dword ptr fs:[00000030h] 21_2_04428E00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B1608 mov eax, dword ptr fs:[00000030h] 21_2_044B1608
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04408A0A mov eax, dword ptr fs:[00000030h] 21_2_04408A0A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04413A1C mov eax, dword ptr fs:[00000030h] 21_2_04413A1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442A61C mov eax, dword ptr fs:[00000030h] 21_2_0442A61C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442A61C mov eax, dword ptr fs:[00000030h] 21_2_0442A61C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04434A2C mov eax, dword ptr fs:[00000030h] 21_2_04434A2C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04434A2C mov eax, dword ptr fs:[00000030h] 21_2_04434A2C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044AFE3F mov eax, dword ptr fs:[00000030h] 21_2_044AFE3F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F9240 mov eax, dword ptr fs:[00000030h] 21_2_043F9240
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F9240 mov eax, dword ptr fs:[00000030h] 21_2_043F9240
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F9240 mov eax, dword ptr fs:[00000030h] 21_2_043F9240
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F9240 mov eax, dword ptr fs:[00000030h] 21_2_043F9240
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04438EC7 mov eax, dword ptr fs:[00000030h] 21_2_04438EC7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04422ACB mov eax, dword ptr fs:[00000030h] 21_2_04422ACB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044AFEC0 mov eax, dword ptr fs:[00000030h] 21_2_044AFEC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044236CC mov eax, dword ptr fs:[00000030h] 21_2_044236CC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C8ED6 mov eax, dword ptr fs:[00000030h] 21_2_044C8ED6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F52A5 mov eax, dword ptr fs:[00000030h] 21_2_043F52A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F52A5 mov eax, dword ptr fs:[00000030h] 21_2_043F52A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F52A5 mov eax, dword ptr fs:[00000030h] 21_2_043F52A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F52A5 mov eax, dword ptr fs:[00000030h] 21_2_043F52A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F52A5 mov eax, dword ptr fs:[00000030h] 21_2_043F52A5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044216E0 mov ecx, dword ptr fs:[00000030h] 21_2_044216E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044076E2 mov eax, dword ptr fs:[00000030h] 21_2_044076E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04422AE4 mov eax, dword ptr fs:[00000030h] 21_2_04422AE4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0448FE87 mov eax, dword ptr fs:[00000030h] 21_2_0448FE87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442D294 mov eax, dword ptr fs:[00000030h] 21_2_0442D294
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442D294 mov eax, dword ptr fs:[00000030h] 21_2_0442D294
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044746A7 mov eax, dword ptr fs:[00000030h] 21_2_044746A7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C0EA5 mov eax, dword ptr fs:[00000030h] 21_2_044C0EA5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C0EA5 mov eax, dword ptr fs:[00000030h] 21_2_044C0EA5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C0EA5 mov eax, dword ptr fs:[00000030h] 21_2_044C0EA5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440AAB0 mov eax, dword ptr fs:[00000030h] 21_2_0440AAB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440AAB0 mov eax, dword ptr fs:[00000030h] 21_2_0440AAB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442FAB0 mov eax, dword ptr fs:[00000030h] 21_2_0442FAB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440EF40 mov eax, dword ptr fs:[00000030h] 21_2_0440EF40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F4F2E mov eax, dword ptr fs:[00000030h] 21_2_043F4F2E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043F4F2E mov eax, dword ptr fs:[00000030h] 21_2_043F4F2E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C8B58 mov eax, dword ptr fs:[00000030h] 21_2_044C8B58
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0440FF60 mov eax, dword ptr fs:[00000030h] 21_2_0440FF60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C8F6A mov eax, dword ptr fs:[00000030h] 21_2_044C8F6A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04423B7A mov eax, dword ptr fs:[00000030h] 21_2_04423B7A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_04423B7A mov eax, dword ptr fs:[00000030h] 21_2_04423B7A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C070D mov eax, dword ptr fs:[00000030h] 21_2_044C070D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044C070D mov eax, dword ptr fs:[00000030h] 21_2_044C070D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442A70E mov eax, dword ptr fs:[00000030h] 21_2_0442A70E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442A70E mov eax, dword ptr fs:[00000030h] 21_2_0442A70E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044B131B mov eax, dword ptr fs:[00000030h] 21_2_044B131B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0441F716 mov eax, dword ptr fs:[00000030h] 21_2_0441F716
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0448FF10 mov eax, dword ptr fs:[00000030h] 21_2_0448FF10
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0448FF10 mov eax, dword ptr fs:[00000030h] 21_2_0448FF10
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FDB60 mov ecx, dword ptr fs:[00000030h] 21_2_043FDB60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FF358 mov eax, dword ptr fs:[00000030h] 21_2_043FF358
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_0442E730 mov eax, dword ptr fs:[00000030h] 21_2_0442E730
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_043FDB40 mov eax, dword ptr fs:[00000030h] 21_2_043FDB40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044753CA mov eax, dword ptr fs:[00000030h] 21_2_044753CA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044753CA mov eax, dword ptr fs:[00000030h] 21_2_044753CA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044203E2 mov eax, dword ptr fs:[00000030h] 21_2_044203E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044203E2 mov eax, dword ptr fs:[00000030h] 21_2_044203E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 21_2_044203E2 mov eax, dword ptr fs:[00000030h] 21_2_044203E2
Enables debug privileges
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.garagekuhn.com
Source: C:\Windows\explorer.exe Domain query: www.bodymoisturizer.online
Source: C:\Windows\explorer.exe Network Connect: 155.133.142.5 80 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread register set: target process: 3388 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread register set: target process: 3388 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section unmapped: C:\Windows\SysWOW64\rundll32.exe base address: 180000 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: D45008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path} Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe' Jump to behavior
Source: explorer.exe, 0000000E.00000000.334414262.0000000001398000.00000004.00000020.sdmp Binary or memory string: ProgmanamF
Source: explorer.exe, 0000000E.00000000.335285067.0000000001980000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 0000000E.00000000.318408129.0000000006860000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000E.00000000.335285067.0000000001980000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000E.00000000.335285067.0000000001980000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Users\user\Desktop\SWIFT_MT103.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_MT103.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.357804367.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.301061394.0000000003A29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.358391118.0000000001100000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.465035906.0000000000250000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.467645501.0000000004190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.467412388.00000000029C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.358413416.0000000001130000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.357804367.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.301061394.0000000003A29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.358391118.0000000001100000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.465035906.0000000000250000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.467645501.0000000004190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.467412388.00000000029C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.358413416.0000000001130000.00000040.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 458843 Sample: SWIFT_MT103.exe Startdate: 03/08/2021 Architecture: WINDOWS Score: 100 31 www.josiemaxwrites.com 2->31 33 www.fayansistanbul.com 2->33 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 10 other signatures 2->47 11 SWIFT_MT103.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\SWIFT_MT103.exe.log, ASCII 11->29 dropped 57 Writes to foreign memory regions 11->57 59 Injects a PE file into a foreign processes 11->59 15 RegSvcs.exe 11->15         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 2 other signatures 15->67 18 explorer.exe 15->18 injected process9 dnsIp10 35 webacc3.sd6.ghst.net 155.133.142.5, 49744, 80 GANDI-AS-2Domainnameregistrar-httpwwwgandinetFR France 18->35 37 www.garagekuhn.com 18->37 39 www.bodymoisturizer.online 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 22 rundll32.exe 18->22         started        signatures11 process12 signatures13 51 Modifies the context of a thread in another process (thread injection) 22->51 53 Maps a DLL or memory area into another process 22->53 55 Tries to detect virtualization through RDTSC time measurements 22->55 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
155.133.142.5
 webacc3.sd6.ghst.net France
203476 GANDI-AS-2Domainnameregistrar-httpwwwgandinetFR true

Contacted Domains

Name IP Active
www.josiemaxwrites.com 199.34.228.67 true
webacc3.sd6.ghst.net 155.133.142.5 true
www.fayansistanbul.com 172.67.130.233 true
www.bodymoisturizer.online unknown unknown
www.garagekuhn.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.bodymoisturizer.online/q4kr/ true
  • Avira URL Cloud: safe
 low