Windows Analysis Report
HSBC Bank Swift Copy.pdf.exe

Overview

General Information

Sample Name: HSBC Bank Swift Copy.pdf.exe
Analysis ID: 562044
MD5: 76b0f4441930d3f2f480830681c426e7
SHA1: 0b28664196cd55adcc7b82647602db984dd49f61
SHA256: 3cc59342fdbb5aa332f7d99216ac3f1ede121e0752e5aaff260e16432c23908d
Tags: exeFormbookHSBC
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Sigma detected: Suspicious Double Extension
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Antivirus detection for URL or domain
Sigma detected: Suspect Svchost Activity
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Self deletion via cmd delete
.NET source code contains potential unpacker
Sigma detected: Suspicious Svchost Process
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses an obfuscated file name to hide its real file extension (double extension)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Found malware configuration
Source: 0000000C.00000002.378377402.0000000000E50000.00000040.10000000.00040000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.loj-kits.xyz/rexd/"], "decoy": ["xn--2es77o3w1bruk.mobi", "cotesaintetienne.com", "newlifefoursquaremcpherson.com", "solutions-consulting.biz", "chsico.com", "demeet.xyz", "eiruhguijire.store", "realestatemoda.com", "amr-fire.net", "99v.one", "altdaita.com", "showerbeast.com", "nsfone.com", "doanhnhanvietnam.info", "xn--transfpanou-39a.com", "invitiz.com", "chifaebio.xyz", "footprint-farm.com", "onlinenurseprograms.com", "tigeratlspa.com", "troublewatermelon.space", "juvesti.com", "hunnii.one", "collective4choice.com", "casino-mate1.com", "hairandspa-aimer-kadsume.com", "pointconstructionservices.com", "savagereviews.xyz", "zhuangmengmeng.com", "gicaredocs.com", "victori-jaya.com", "purifilt.net", "live9words.com", "x-teknoloji.com", "thelocalworkers.com", "nalainteriores.com", "dream-mart.tech", "maretta.info", "empowermindbodystudios.com", "creativenft.xyz", "remembertheabbeygate.com", "whistlergardencenter.com", "jbmfg.net", "tangerinecave.com", "60thstreetdesserts.com", "mxcpgj.com", "nguoidantocvungcao.xyz", "snowjamproductiosmedia.com", "schencklab.com", "sousouhenansheng.com", "quirkysoul39.com", "digitaleclipsegames.com", "hayesvalleycondo409.com", "ceremonydesigncompany.com", "essaispsoriasisenfants-ca.com", "borhanmarket.com", "aerbounce.com", "primebradescocadastro.com", "bupis44.info", "optmsg.com", "khukhuanphongkham.com", "bunnymoorellc.com", "tminus-10.com", "mytechmadesimple.com"]}
Multi AV Scanner detection for submitted file
Source: HSBC Bank Swift Copy.pdf.exe Virustotal: Detection: 31% Perma Link
Source: HSBC Bank Swift Copy.pdf.exe ReversingLabs: Detection: 48%
Yara detected FormBook
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HSBC Bank Swift Copy.pdf.exe.4355240.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HSBC Bank Swift Copy.pdf.exe.42fac20.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.378377402.0000000000E50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.378466176.00000000011A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.531069292.0000000000F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.304686882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.304254698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.377961712.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.528571201.00000000008F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.339842712.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.532271564.0000000000F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.356870466.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.308628609.00000000041A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://www.doanhnhanvietnam.info/rexd/ Avira URL Cloud: Label: malware
Source: http://www.hairandspa-aimer-kadsume.com/rexd/ Avira URL Cloud: Label: malware
Source: http://www.bupis44.info/rexd/www.solutions-consulting.biz Avira URL Cloud: Label: malware
Source: www.loj-kits.xyz/rexd/ Avira URL Cloud: Label: malware
Source: http://www.collective4choice.com/rexd/www.bupis44.info Avira URL Cloud: Label: malware
Source: http://www.collective4choice.com/rexd/ Avira URL Cloud: Label: malware
Source: http://www.loj-kits.xyz/rexd/www.chifaebio.xyz Avira URL Cloud: Label: malware
Source: http://www.doanhnhanvietnam.info/rexd/www.invitiz.com Avira URL Cloud: Label: malware
Source: http://www.bupis44.info/rexd/ Avira URL Cloud: Label: malware
Source: http://www.loj-kits.xyz/rexd/ Avira URL Cloud: Label: malware
Source: http://www.hairandspa-aimer-kadsume.com/rexd/www.tminus-10.com Avira URL Cloud: Label: malware
Source: http://www.bupis44.info Avira URL Cloud: Label: malware
Machine Learning detection for sample
Source: HSBC Bank Swift Copy.pdf.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance
barindex
Uses 32bit PE files
Source: HSBC Bank Swift Copy.pdf.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: HSBC Bank Swift Copy.pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdbeex.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: explorer.exe, 0000001D.00000002.544532140.00007FFF94751000.00000020.00000001.01000000.00000008.sdmp
Source: Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdb source: explorer.exe, 0000001D.00000002.544532140.00007FFF94751000.00000020.00000001.01000000.00000008.sdmp
Source: Binary string: wntdll.pdbUGP source: HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.378821180.00000000013AF000.00000040.00000800.00020000.00000000.sdmp, HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.378603886.0000000001290000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.379797360.0000000003300000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.378166081.0000000001000000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.534695085.000000000361F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.533914214.0000000003500000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.378821180.00000000013AF000.00000040.00000800.00020000.00000000.sdmp, HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.378603886.0000000001290000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000011.00000003.379797360.0000000003300000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.378166081.0000000001000000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.534695085.000000000361F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.533914214.0000000003500000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: eex.pdb source: explorer.exe, 0000001D.00000002.544532140.00007FFF94751000.00000020.00000001.01000000.00000008.sdmp
Source: Binary string: svchost.pdb source: HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.378549777.0000000001270000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: svchost.pdbUGP source: HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.378549777.0000000001270000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\SRnftbxSiX\src\obj\Debug\RuntimePropertyIn.pdb source: HSBC Bank Swift Copy.pdf.exe

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.loj-kits.xyz/rexd/
Source: HSBC Bank Swift Copy.pdf.exe String found in binary or memory: http://blog.iandreev.com
Source: HSBC Bank Swift Copy.pdf.exe String found in binary or memory: http://blog.iandreev.com/
Source: HSBC Bank Swift Copy.pdf.exe String found in binary or memory: http://blog.iandreev.com/AClick
Source: explorer.exe, 0000001D.00000002.545811581.00007FFF94839000.00000002.00000001.01000000.00000008.sdmp String found in binary or memory: http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov
Source: explorer.exe, 0000001D.00000002.545811581.00007FFF94839000.00000002.00000001.01000000.00000008.sdmp String found in binary or memory: http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro
Source: explorer.exe, 0000001D.00000002.537943170.0000000007442000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.503821116.00000000074A6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000003.502282504.00000000074A6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.513074181.0000000009817000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000002.539699054.0000000009817000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.512012339.00000000074A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 0000001D.00000000.506321945.0000000009A2B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000003.502118090.0000000009A06000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000003.502938145.0000000009A2A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000003.500906015.0000000009A06000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000003.505028040.0000000009A2A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000003.504397605.0000000009A2A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000003.503803391.0000000009A08000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.513670120.0000000009A2B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.verisign.6
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.amr-fire.net
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.amr-fire.net/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.amr-fire.net/rexd/www.collective4choice.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.amr-fire.netReferer:
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 0000000E.00000000.351270316.0000000006840000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.335111009.0000000006840000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.418985985.0000000006870000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.314141640.0000000006840000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.bupis44.info
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.bupis44.info/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.bupis44.info/rexd/www.solutions-consulting.biz
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.bupis44.infoReferer:
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.chifaebio.xyz
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.chifaebio.xyz/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.chifaebio.xyz/rexd/www.mxcpgj.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.chifaebio.xyzReferer:
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.collective4choice.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.collective4choice.com/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.collective4choice.com/rexd/www.bupis44.info
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.collective4choice.comReferer:
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.doanhnhanvietnam.info
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.doanhnhanvietnam.info/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.doanhnhanvietnam.info/rexd/www.invitiz.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.doanhnhanvietnam.infoReferer:
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.essaispsoriasisenfants-ca.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.essaispsoriasisenfants-ca.com/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.essaispsoriasisenfants-ca.com/rexd/www.doanhnhanvietnam.info
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.essaispsoriasisenfants-ca.comReferer:
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.307291346.0000000001997000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comdiao
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.307291346.0000000001997000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comrsiva
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.hairandspa-aimer-kadsume.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.hairandspa-aimer-kadsume.com/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.hairandspa-aimer-kadsume.com/rexd/www.tminus-10.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.hairandspa-aimer-kadsume.comReferer:
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.invitiz.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.invitiz.com/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.invitiz.com/rexd/www.primebradescocadastro.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.invitiz.comReferer:
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.live9words.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.live9words.com/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.live9words.comReferer:
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.loj-kits.xyz
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.loj-kits.xyz/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.loj-kits.xyz/rexd/www.chifaebio.xyz
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.loj-kits.xyzReferer:
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mxcpgj.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mxcpgj.com/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mxcpgj.com/rexd/www.nalainteriores.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mxcpgj.comReferer:
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.nalainteriores.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.nalainteriores.com/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.nalainteriores.com/rexd/www.essaispsoriasisenfants-ca.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.nalainteriores.comReferer:
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pointconstructionservices.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pointconstructionservices.com/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pointconstructionservices.com/rexd/www.amr-fire.net
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pointconstructionservices.comReferer:
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.primebradescocadastro.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.primebradescocadastro.com/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.primebradescocadastro.com/rexd/www.live9words.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.primebradescocadastro.comReferer:
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.solutions-consulting.biz
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.solutions-consulting.biz/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.solutions-consulting.biz/rexd/www.hairandspa-aimer-kadsume.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.solutions-consulting.bizReferer:
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp, HSBC Bank Swift Copy.pdf.exe, 00000000.00000003.264704646.000000000199C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.tminus-10.com
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.tminus-10.com/rexd/
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.tminus-10.com/rexd/www.loj-kits.xyz
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.tminus-10.comReferer:
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.309728380.00000000072E2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: unknown DNS traffic detected: queries for: www.pointconstructionservices.com

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HSBC Bank Swift Copy.pdf.exe.4355240.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HSBC Bank Swift Copy.pdf.exe.42fac20.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.378377402.0000000000E50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.378466176.00000000011A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.531069292.0000000000F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.304686882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.304254698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.377961712.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.528571201.00000000008F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.339842712.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.532271564.0000000000F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.356870466.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.308628609.00000000041A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.HSBC Bank Swift Copy.pdf.exe.4355240.4.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.HSBC Bank Swift Copy.pdf.exe.4355240.4.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.HSBC Bank Swift Copy.pdf.exe.42fac20.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.HSBC Bank Swift Copy.pdf.exe.42fac20.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.378377402.0000000000E50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.378377402.0000000000E50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.378466176.00000000011A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.378466176.00000000011A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.531069292.0000000000F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.531069292.0000000000F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000000.304686882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000000.304686882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000000.304254698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000000.304254698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.377961712.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.377961712.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.528571201.00000000008F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.528571201.00000000008F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000000.339842712.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000000.339842712.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.532271564.0000000000F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.532271564.0000000000F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000000.356870466.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000000.356870466.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.308628609.00000000041A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.308628609.00000000041A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: HSBC Bank Swift Copy.pdf.exe
Uses 32bit PE files
Source: HSBC Bank Swift Copy.pdf.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.HSBC Bank Swift Copy.pdf.exe.4355240.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.HSBC Bank Swift Copy.pdf.exe.4355240.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.HSBC Bank Swift Copy.pdf.exe.42fac20.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.HSBC Bank Swift Copy.pdf.exe.42fac20.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.378377402.0000000000E50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.378377402.0000000000E50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.378466176.00000000011A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.378466176.00000000011A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.531069292.0000000000F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.531069292.0000000000F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000000.304686882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000000.304686882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000000.304254698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000000.304254698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.377961712.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.377961712.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.528571201.00000000008F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.528571201.00000000008F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000000.339842712.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000000.339842712.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.532271564.0000000000F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.532271564.0000000000F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000000.356870466.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000000.356870466.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.308628609.00000000041A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.308628609.00000000041A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 0_2_0303D3B4 0_2_0303D3B4
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_00401030 12_2_00401030
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_0041B903 12_2_0041B903
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_0041CC4E 12_2_0041CC4E
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_00408C70 12_2_00408C70
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_00402D87 12_2_00402D87
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_00402D90 12_2_00402D90
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_0041C6A8 12_2_0041C6A8
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_0041CFD2 12_2_0041CFD2
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_00402FB0 12_2_00402FB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355EBB0 17_2_0355EBB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03546E30 17_2_03546E30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F1D55 17_2_035F1D55
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352F900 17_2_0352F900
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03520D20 17_2_03520D20
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03544120 17_2_03544120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353D5E0 17_2_0353D5E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03552581 17_2_03552581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353841F 17_2_0353841F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1002 17_2_035E1002
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353B090 17_2_0353B090
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035520A0 17_2_035520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0090CC4E 17_2_0090CC4E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_008F8C70 17_2_008F8C70
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_008F2D87 17_2_008F2D87
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_008F2D90 17_2_008F2D90
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0090C6A8 17_2_0090C6A8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_008F2FB0 17_2_008F2FB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0090CFD2 17_2_0090CFD2
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\svchost.exe Code function: String function: 0352B150 appears 35 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_004185D0 NtCreateFile, 12_2_004185D0
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_00418680 NtReadFile, 12_2_00418680
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_00418700 NtClose, 12_2_00418700
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_004187B0 NtAllocateVirtualMemory, 12_2_004187B0
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_00418622 NtReadFile, 12_2_00418622
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569710 NtQueryInformationToken,LdrInitializeThunk, 17_2_03569710
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569FE0 NtCreateMutant,LdrInitializeThunk, 17_2_03569FE0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569780 NtMapViewOfSection,LdrInitializeThunk, 17_2_03569780
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569650 NtQueryValueKey,LdrInitializeThunk, 17_2_03569650
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569A50 NtCreateFile,LdrInitializeThunk, 17_2_03569A50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569660 NtAllocateVirtualMemory,LdrInitializeThunk, 17_2_03569660
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035696D0 NtCreateKey,LdrInitializeThunk, 17_2_035696D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035696E0 NtFreeVirtualMemory,LdrInitializeThunk, 17_2_035696E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569540 NtReadFile,LdrInitializeThunk, 17_2_03569540
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569910 NtAdjustPrivilegesToken,LdrInitializeThunk, 17_2_03569910
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035695D0 NtClose,LdrInitializeThunk, 17_2_035695D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035699A0 NtCreateSection,LdrInitializeThunk, 17_2_035699A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569840 NtDelayExecution,LdrInitializeThunk, 17_2_03569840
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569860 NtQuerySystemInformation,LdrInitializeThunk, 17_2_03569860
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569770 NtSetInformationFile, 17_2_03569770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0356A770 NtOpenThread, 17_2_0356A770
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569760 NtOpenProcess, 17_2_03569760
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0356A710 NtOpenProcessToken, 17_2_0356A710
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569B00 NtSetValueKey, 17_2_03569B00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569730 NtQueryVirtualMemory, 17_2_03569730
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0356A3B0 NtGetContextThread, 17_2_0356A3B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035697A0 NtUnmapViewOfSection, 17_2_035697A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569670 NtQueryInformationProcess, 17_2_03569670
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569610 NtEnumerateValueKey, 17_2_03569610
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569A10 NtQuerySection, 17_2_03569A10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569A00 NtProtectVirtualMemory, 17_2_03569A00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569A20 NtResumeThread, 17_2_03569A20
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569A80 NtOpenDirectoryObject, 17_2_03569A80
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569950 NtQueueApcThread, 17_2_03569950
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569560 NtWriteFile, 17_2_03569560
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0356AD30 NtSetContextThread, 17_2_0356AD30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569520 NtWaitForSingleObject, 17_2_03569520
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035699D0 NtCreateProcessEx, 17_2_035699D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035695F0 NtQueryInformationFile, 17_2_035695F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0356B040 NtSuspendThread, 17_2_0356B040
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03569820 NtEnumerateKey, 17_2_03569820
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035698F0 NtReadVirtualMemory, 17_2_035698F0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035698A0 NtWriteVirtualMemory, 17_2_035698A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_009085D0 NtCreateFile, 17_2_009085D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_00908680 NtReadFile, 17_2_00908680
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_009087B0 NtAllocateVirtualMemory, 17_2_009087B0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_00908700 NtClose, 17_2_00908700
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_00908622 NtReadFile, 17_2_00908622
Sample file is different than original file name gathered from version info
Source: HSBC Bank Swift Copy.pdf.exe Binary or memory string: OriginalFilename vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.308215845.0000000003258000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.308047232.00000000031FC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameRuntimePropertyIn.exe4 vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.308047232.00000000031FC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.308047232.00000000031FC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: m,\\StringFileInfo\\000004B0\\OriginalFilename vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.311397572.0000000008210000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.307751069.00000000031A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.307751069.00000000031A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.308628609.00000000041A9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.311069408.0000000007F80000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe Binary or memory string: OriginalFilename vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.378821180.00000000013AF000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.379431942.000000000153F000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.378583898.000000000127B000.00000040.10000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenamesvchost.exej% vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe Binary or memory string: OriginalFilenameRuntimePropertyIn.exe4 vs HSBC Bank Swift Copy.pdf.exe
Source: HSBC Bank Swift Copy.pdf.exe Virustotal: Detection: 31%
Source: HSBC Bank Swift Copy.pdf.exe ReversingLabs: Detection: 48%
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe File read: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe:Zone.Identifier Jump to behavior
Source: HSBC Bank Swift Copy.pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe "C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe"
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process created: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process created: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe" Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{660b90c8-73a9-4b58-8cae-355b7f55341b}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HSBC Bank Swift Copy.pdf.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@8/1@3/1
Source: C:\Windows\explorer.exe File read: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5464:120:WilError_01
Source: C:\Windows\SysWOW64\svchost.exe Process created: C:\Windows\explorer.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: HSBC Bank Swift Copy.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: HSBC Bank Swift Copy.pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: HSBC Bank Swift Copy.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdbeex.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: explorer.exe, 0000001D.00000002.544532140.00007FFF94751000.00000020.00000001.01000000.00000008.sdmp
Source: Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdb source: explorer.exe, 0000001D.00000002.544532140.00007FFF94751000.00000020.00000001.01000000.00000008.sdmp
Source: Binary string: wntdll.pdbUGP source: HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.378821180.00000000013AF000.00000040.00000800.00020000.00000000.sdmp, HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.378603886.0000000001290000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.379797360.0000000003300000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.378166081.0000000001000000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.534695085.000000000361F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.533914214.0000000003500000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.378821180.00000000013AF000.00000040.00000800.00020000.00000000.sdmp, HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.378603886.0000000001290000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000011.00000003.379797360.0000000003300000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.378166081.0000000001000000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.534695085.000000000361F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.533914214.0000000003500000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: eex.pdb source: explorer.exe, 0000001D.00000002.544532140.00007FFF94751000.00000020.00000001.01000000.00000008.sdmp
Source: Binary string: svchost.pdb source: HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.378549777.0000000001270000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: svchost.pdbUGP source: HSBC Bank Swift Copy.pdf.exe, 0000000C.00000002.378549777.0000000001270000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\SRnftbxSiX\src\obj\Debug\RuntimePropertyIn.pdb source: HSBC Bank Swift Copy.pdf.exe

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: HSBC Bank Swift Copy.pdf.exe, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.HSBC Bank Swift Copy.pdf.exe.e60000.0.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.HSBC Bank Swift Copy.pdf.exe.e60000.0.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.810000.9.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.810000.7.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.2.HSBC Bank Swift Copy.pdf.exe.810000.1.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.810000.3.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.810000.0.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.810000.2.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.810000.5.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.0.HSBC Bank Swift Copy.pdf.exe.810000.1.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 0_2_00E6667D push es; retf 0007h 0_2_00E667B4
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 0_2_00E66691 push es; retf 0007h 0_2_00E667B4
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_00415058 pushfd ; ret 12_2_00415059
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_0041B87C push eax; ret 12_2_0041B882
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_0041B812 push eax; ret 12_2_0041B818
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_0041B81B push eax; ret 12_2_0041B882
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_0041516A push esi; retf 12_2_00415185
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_0040C3AC push es; iretd 12_2_0040C3AD
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_00414DFF push ebx; retf 12_2_00414E00
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_0041B7C5 push eax; ret 12_2_0041B818
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_00816691 push es; retf 0007h 12_2_008167B4
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_0081667D push es; retf 0007h 12_2_008167B4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0357D0D1 push ecx; ret 17_2_0357D0E4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0090B812 push eax; ret 17_2_0090B818
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0090B81B push eax; ret 17_2_0090B882
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_00905058 pushfd ; ret 17_2_00905059
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0090B87C push eax; ret 17_2_0090B882
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0090516A push esi; retf 17_2_00905185
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_008FC3AC push es; iretd 17_2_008FC3AD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_00904DFF push ebx; retf 17_2_00904E00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0090BD6F push ecx; ret 17_2_0090BD74
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0090B7C5 push eax; ret 17_2_0090B818

Hooking and other Techniques for Hiding and Protection
barindex
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\svchost.exe Process created: /c del "C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe"
Source: C:\Windows\SysWOW64\svchost.exe Process created: /c del "C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe" Jump to behavior
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: pdf.exe Static PE information: HSBC Bank Swift Copy.pdf.exe
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\explorer.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.HSBC Bank Swift Copy.pdf.exe.31ed1ec.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HSBC Bank Swift Copy.pdf.exe.326c734.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.308215845.0000000003258000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.307751069.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: HSBC Bank Swift Copy.pdf.exe PID: 4712, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.308215845.0000000003258000.00000004.00000800.00020000.00000000.sdmp, HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.307751069.00000000031A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.308215845.0000000003258000.00000004.00000800.00020000.00000000.sdmp, HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.307751069.00000000031A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe RDTSC instruction interceptor: First address: 0000000000408604 second address: 000000000040860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\svchost.exe RDTSC instruction interceptor: First address: 00000000008F8604 second address: 00000000008F860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\svchost.exe RDTSC instruction interceptor: First address: 00000000008F898E second address: 00000000008F8994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe TID: 4000 Thread sleep time: -39813s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe TID: 5428 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_004088C0 rdtsc 12_2_004088C0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Windows\explorer.exe File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Thread delayed: delay time: 39813 Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.307751069.00000000031A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: explorer.exe, 0000000E.00000000.338683531.0000000008A32000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 0000000E.00000000.338683531.0000000008A32000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 0000001D.00000000.513716413.0000000009A43000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&
Source: explorer.exe, 0000001D.00000003.501324592.0000000009A81000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001D.00000003.507940526.00000000099F2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: NECVMWarVMware SATA CD001.00
Source: explorer.exe, 0000001D.00000003.505130040.0000000009A43000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ,h\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}O0M0K
Source: explorer.exe, 0000001D.00000000.477720516.00000000074BE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.307751069.00000000031A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 0000001D.00000003.501551888.0000000009936000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}f
Source: explorer.exe, 0000000E.00000000.355788907.0000000008C73000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}osoft S""
Source: explorer.exe, 0000000E.00000000.355307217.0000000008B88000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 0000001D.00000003.501717975.00000000099F2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: NECVMWarVMware SATA CD001.00$
Source: explorer.exe, 0000001D.00000003.501509475.0000000009913000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000:
Source: explorer.exe, 0000001D.00000000.506378037.0000000009A69000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}!
Source: explorer.exe, 0000001D.00000000.506378037.0000000009A69000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorer.exe, 0000001D.00000003.500774605.00000000099B2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: War&Prod_VMware_
Source: explorer.exe, 0000000E.00000000.355147226.0000000008ACF000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 0000001D.00000000.502730509.00000000073CC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: k\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001D.00000002.540010356.0000000009913000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00ta
Source: explorer.exe, 0000001D.00000000.460008601.00000000005A7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: AASCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000&09F6E&0&00A8AUTHORITY\SYSTEMP
Source: explorer.exe, 0000001D.00000000.511352280.00000000073CC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: k\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}K
Source: explorer.exe, 0000001D.00000002.540226124.00000000099F2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.307751069.00000000031A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 0000001D.00000003.500774605.00000000099B2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Prod_VMware_SATA(P
Source: explorer.exe, 0000001D.00000000.506076169.00000000098B5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00#
Source: explorer.exe, 0000001D.00000002.540333961.0000000009A43000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: om&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&
Source: explorer.exe, 0000001D.00000000.506378037.0000000009A69000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: HSBC Bank Swift Copy.pdf.exe, 00000000.00000002.307751069.00000000031A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: explorer.exe, 0000001D.00000000.506378037.0000000009A69000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001D.00000000.506076169.00000000098B5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 0000001D.00000000.460008601.00000000005A7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000E.00000000.355147226.0000000008ACF000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: explorer.exe, 0000000E.00000000.355307217.0000000008B88000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: explorer.exe, 0000001D.00000000.460008601.00000000005A7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000's
Source: explorer.exe, 0000001D.00000003.505130040.0000000009A43000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000f
Source: explorer.exe, 0000000E.00000000.351546776.00000000069DA000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD002
Source: explorer.exe, 0000001D.00000000.511352280.00000000073CC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: k\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}2
Source: explorer.exe, 0000001D.00000000.512012339.00000000074A4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}h
Source: explorer.exe, 0000001D.00000003.501509475.0000000009913000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Anti Debugging
barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_004088C0 rdtsc 12_2_004088C0
Enables debug privileges
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F8B58 mov eax, dword ptr fs:[00000030h] 17_2_035F8B58
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352F358 mov eax, dword ptr fs:[00000030h] 17_2_0352F358
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352DB40 mov eax, dword ptr fs:[00000030h] 17_2_0352DB40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353EF40 mov eax, dword ptr fs:[00000030h] 17_2_0353EF40
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03553B7A mov eax, dword ptr fs:[00000030h] 17_2_03553B7A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03553B7A mov eax, dword ptr fs:[00000030h] 17_2_03553B7A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352DB60 mov ecx, dword ptr fs:[00000030h] 17_2_0352DB60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353FF60 mov eax, dword ptr fs:[00000030h] 17_2_0353FF60
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F8F6A mov eax, dword ptr fs:[00000030h] 17_2_035F8F6A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0354F716 mov eax, dword ptr fs:[00000030h] 17_2_0354F716
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E131B mov eax, dword ptr fs:[00000030h] 17_2_035E131B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035BFF10 mov eax, dword ptr fs:[00000030h] 17_2_035BFF10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035BFF10 mov eax, dword ptr fs:[00000030h] 17_2_035BFF10
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F070D mov eax, dword ptr fs:[00000030h] 17_2_035F070D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F070D mov eax, dword ptr fs:[00000030h] 17_2_035F070D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355A70E mov eax, dword ptr fs:[00000030h] 17_2_0355A70E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355A70E mov eax, dword ptr fs:[00000030h] 17_2_0355A70E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355E730 mov eax, dword ptr fs:[00000030h] 17_2_0355E730
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03524F2E mov eax, dword ptr fs:[00000030h] 17_2_03524F2E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03524F2E mov eax, dword ptr fs:[00000030h] 17_2_03524F2E
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A53CA mov eax, dword ptr fs:[00000030h] 17_2_035A53CA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A53CA mov eax, dword ptr fs:[00000030h] 17_2_035A53CA
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035637F5 mov eax, dword ptr fs:[00000030h] 17_2_035637F5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035503E2 mov eax, dword ptr fs:[00000030h] 17_2_035503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035503E2 mov eax, dword ptr fs:[00000030h] 17_2_035503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035503E2 mov eax, dword ptr fs:[00000030h] 17_2_035503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035503E2 mov eax, dword ptr fs:[00000030h] 17_2_035503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035503E2 mov eax, dword ptr fs:[00000030h] 17_2_035503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035503E2 mov eax, dword ptr fs:[00000030h] 17_2_035503E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0354DBE9 mov eax, dword ptr fs:[00000030h] 17_2_0354DBE9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03552397 mov eax, dword ptr fs:[00000030h] 17_2_03552397
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355B390 mov eax, dword ptr fs:[00000030h] 17_2_0355B390
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03538794 mov eax, dword ptr fs:[00000030h] 17_2_03538794
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A7794 mov eax, dword ptr fs:[00000030h] 17_2_035A7794
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A7794 mov eax, dword ptr fs:[00000030h] 17_2_035A7794
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A7794 mov eax, dword ptr fs:[00000030h] 17_2_035A7794
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E138A mov eax, dword ptr fs:[00000030h] 17_2_035E138A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03531B8F mov eax, dword ptr fs:[00000030h] 17_2_03531B8F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03531B8F mov eax, dword ptr fs:[00000030h] 17_2_03531B8F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035DD380 mov ecx, dword ptr fs:[00000030h] 17_2_035DD380
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03554BAD mov eax, dword ptr fs:[00000030h] 17_2_03554BAD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03554BAD mov eax, dword ptr fs:[00000030h] 17_2_03554BAD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03554BAD mov eax, dword ptr fs:[00000030h] 17_2_03554BAD
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F5BA5 mov eax, dword ptr fs:[00000030h] 17_2_035F5BA5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035B4257 mov eax, dword ptr fs:[00000030h] 17_2_035B4257
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03529240 mov eax, dword ptr fs:[00000030h] 17_2_03529240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03529240 mov eax, dword ptr fs:[00000030h] 17_2_03529240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03529240 mov eax, dword ptr fs:[00000030h] 17_2_03529240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03529240 mov eax, dword ptr fs:[00000030h] 17_2_03529240
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03537E41 mov eax, dword ptr fs:[00000030h] 17_2_03537E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03537E41 mov eax, dword ptr fs:[00000030h] 17_2_03537E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03537E41 mov eax, dword ptr fs:[00000030h] 17_2_03537E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03537E41 mov eax, dword ptr fs:[00000030h] 17_2_03537E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03537E41 mov eax, dword ptr fs:[00000030h] 17_2_03537E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03537E41 mov eax, dword ptr fs:[00000030h] 17_2_03537E41
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0354AE73 mov eax, dword ptr fs:[00000030h] 17_2_0354AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0354AE73 mov eax, dword ptr fs:[00000030h] 17_2_0354AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0354AE73 mov eax, dword ptr fs:[00000030h] 17_2_0354AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0354AE73 mov eax, dword ptr fs:[00000030h] 17_2_0354AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0354AE73 mov eax, dword ptr fs:[00000030h] 17_2_0354AE73
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0356927A mov eax, dword ptr fs:[00000030h] 17_2_0356927A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035DB260 mov eax, dword ptr fs:[00000030h] 17_2_035DB260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035DB260 mov eax, dword ptr fs:[00000030h] 17_2_035DB260
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F8A62 mov eax, dword ptr fs:[00000030h] 17_2_035F8A62
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353766D mov eax, dword ptr fs:[00000030h] 17_2_0353766D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03525210 mov eax, dword ptr fs:[00000030h] 17_2_03525210
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03525210 mov ecx, dword ptr fs:[00000030h] 17_2_03525210
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03525210 mov eax, dword ptr fs:[00000030h] 17_2_03525210
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03525210 mov eax, dword ptr fs:[00000030h] 17_2_03525210
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352AA16 mov eax, dword ptr fs:[00000030h] 17_2_0352AA16
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352AA16 mov eax, dword ptr fs:[00000030h] 17_2_0352AA16
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03543A1C mov eax, dword ptr fs:[00000030h] 17_2_03543A1C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355A61C mov eax, dword ptr fs:[00000030h] 17_2_0355A61C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355A61C mov eax, dword ptr fs:[00000030h] 17_2_0355A61C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352C600 mov eax, dword ptr fs:[00000030h] 17_2_0352C600
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352C600 mov eax, dword ptr fs:[00000030h] 17_2_0352C600
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352C600 mov eax, dword ptr fs:[00000030h] 17_2_0352C600
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03558E00 mov eax, dword ptr fs:[00000030h] 17_2_03558E00
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03538A0A mov eax, dword ptr fs:[00000030h] 17_2_03538A0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035DFE3F mov eax, dword ptr fs:[00000030h] 17_2_035DFE3F
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352E620 mov eax, dword ptr fs:[00000030h] 17_2_0352E620
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03564A2C mov eax, dword ptr fs:[00000030h] 17_2_03564A2C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03564A2C mov eax, dword ptr fs:[00000030h] 17_2_03564A2C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F8ED6 mov eax, dword ptr fs:[00000030h] 17_2_035F8ED6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03568EC7 mov eax, dword ptr fs:[00000030h] 17_2_03568EC7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035536CC mov eax, dword ptr fs:[00000030h] 17_2_035536CC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035DFEC0 mov eax, dword ptr fs:[00000030h] 17_2_035DFEC0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03552ACB mov eax, dword ptr fs:[00000030h] 17_2_03552ACB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035376E2 mov eax, dword ptr fs:[00000030h] 17_2_035376E2
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03552AE4 mov eax, dword ptr fs:[00000030h] 17_2_03552AE4
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035516E0 mov ecx, dword ptr fs:[00000030h] 17_2_035516E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355D294 mov eax, dword ptr fs:[00000030h] 17_2_0355D294
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355D294 mov eax, dword ptr fs:[00000030h] 17_2_0355D294
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035BFE87 mov eax, dword ptr fs:[00000030h] 17_2_035BFE87
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353AAB0 mov eax, dword ptr fs:[00000030h] 17_2_0353AAB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353AAB0 mov eax, dword ptr fs:[00000030h] 17_2_0353AAB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355FAB0 mov eax, dword ptr fs:[00000030h] 17_2_0355FAB0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035252A5 mov eax, dword ptr fs:[00000030h] 17_2_035252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035252A5 mov eax, dword ptr fs:[00000030h] 17_2_035252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035252A5 mov eax, dword ptr fs:[00000030h] 17_2_035252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035252A5 mov eax, dword ptr fs:[00000030h] 17_2_035252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035252A5 mov eax, dword ptr fs:[00000030h] 17_2_035252A5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F0EA5 mov eax, dword ptr fs:[00000030h] 17_2_035F0EA5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F0EA5 mov eax, dword ptr fs:[00000030h] 17_2_035F0EA5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F0EA5 mov eax, dword ptr fs:[00000030h] 17_2_035F0EA5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A46A7 mov eax, dword ptr fs:[00000030h] 17_2_035A46A7
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03547D50 mov eax, dword ptr fs:[00000030h] 17_2_03547D50
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0354B944 mov eax, dword ptr fs:[00000030h] 17_2_0354B944
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0354B944 mov eax, dword ptr fs:[00000030h] 17_2_0354B944
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03563D43 mov eax, dword ptr fs:[00000030h] 17_2_03563D43
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A3540 mov eax, dword ptr fs:[00000030h] 17_2_035A3540
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352B171 mov eax, dword ptr fs:[00000030h] 17_2_0352B171
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352B171 mov eax, dword ptr fs:[00000030h] 17_2_0352B171
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0354C577 mov eax, dword ptr fs:[00000030h] 17_2_0354C577
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0354C577 mov eax, dword ptr fs:[00000030h] 17_2_0354C577
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352C962 mov eax, dword ptr fs:[00000030h] 17_2_0352C962
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03529100 mov eax, dword ptr fs:[00000030h] 17_2_03529100
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03529100 mov eax, dword ptr fs:[00000030h] 17_2_03529100
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03529100 mov eax, dword ptr fs:[00000030h] 17_2_03529100
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352AD30 mov eax, dword ptr fs:[00000030h] 17_2_0352AD30
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03533D34 mov eax, dword ptr fs:[00000030h] 17_2_03533D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03533D34 mov eax, dword ptr fs:[00000030h] 17_2_03533D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03533D34 mov eax, dword ptr fs:[00000030h] 17_2_03533D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03533D34 mov eax, dword ptr fs:[00000030h] 17_2_03533D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03533D34 mov eax, dword ptr fs:[00000030h] 17_2_03533D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03533D34 mov eax, dword ptr fs:[00000030h] 17_2_03533D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03533D34 mov eax, dword ptr fs:[00000030h] 17_2_03533D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03533D34 mov eax, dword ptr fs:[00000030h] 17_2_03533D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03533D34 mov eax, dword ptr fs:[00000030h] 17_2_03533D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03533D34 mov eax, dword ptr fs:[00000030h] 17_2_03533D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03533D34 mov eax, dword ptr fs:[00000030h] 17_2_03533D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03533D34 mov eax, dword ptr fs:[00000030h] 17_2_03533D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03533D34 mov eax, dword ptr fs:[00000030h] 17_2_03533D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F8D34 mov eax, dword ptr fs:[00000030h] 17_2_035F8D34
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035AA537 mov eax, dword ptr fs:[00000030h] 17_2_035AA537
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03554D3B mov eax, dword ptr fs:[00000030h] 17_2_03554D3B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03554D3B mov eax, dword ptr fs:[00000030h] 17_2_03554D3B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03554D3B mov eax, dword ptr fs:[00000030h] 17_2_03554D3B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355513A mov eax, dword ptr fs:[00000030h] 17_2_0355513A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355513A mov eax, dword ptr fs:[00000030h] 17_2_0355513A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03544120 mov eax, dword ptr fs:[00000030h] 17_2_03544120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03544120 mov eax, dword ptr fs:[00000030h] 17_2_03544120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03544120 mov eax, dword ptr fs:[00000030h] 17_2_03544120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03544120 mov eax, dword ptr fs:[00000030h] 17_2_03544120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03544120 mov ecx, dword ptr fs:[00000030h] 17_2_03544120
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A6DC9 mov eax, dword ptr fs:[00000030h] 17_2_035A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A6DC9 mov eax, dword ptr fs:[00000030h] 17_2_035A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A6DC9 mov eax, dword ptr fs:[00000030h] 17_2_035A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A6DC9 mov ecx, dword ptr fs:[00000030h] 17_2_035A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A6DC9 mov eax, dword ptr fs:[00000030h] 17_2_035A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A6DC9 mov eax, dword ptr fs:[00000030h] 17_2_035A6DC9
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035D8DF1 mov eax, dword ptr fs:[00000030h] 17_2_035D8DF1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352B1E1 mov eax, dword ptr fs:[00000030h] 17_2_0352B1E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352B1E1 mov eax, dword ptr fs:[00000030h] 17_2_0352B1E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0352B1E1 mov eax, dword ptr fs:[00000030h] 17_2_0352B1E1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035B41E8 mov eax, dword ptr fs:[00000030h] 17_2_035B41E8
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353D5E0 mov eax, dword ptr fs:[00000030h] 17_2_0353D5E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353D5E0 mov eax, dword ptr fs:[00000030h] 17_2_0353D5E0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03552990 mov eax, dword ptr fs:[00000030h] 17_2_03552990
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355FD9B mov eax, dword ptr fs:[00000030h] 17_2_0355FD9B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355FD9B mov eax, dword ptr fs:[00000030h] 17_2_0355FD9B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355A185 mov eax, dword ptr fs:[00000030h] 17_2_0355A185
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03552581 mov eax, dword ptr fs:[00000030h] 17_2_03552581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03552581 mov eax, dword ptr fs:[00000030h] 17_2_03552581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03552581 mov eax, dword ptr fs:[00000030h] 17_2_03552581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03552581 mov eax, dword ptr fs:[00000030h] 17_2_03552581
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0354C182 mov eax, dword ptr fs:[00000030h] 17_2_0354C182
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03522D8A mov eax, dword ptr fs:[00000030h] 17_2_03522D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03522D8A mov eax, dword ptr fs:[00000030h] 17_2_03522D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03522D8A mov eax, dword ptr fs:[00000030h] 17_2_03522D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03522D8A mov eax, dword ptr fs:[00000030h] 17_2_03522D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03522D8A mov eax, dword ptr fs:[00000030h] 17_2_03522D8A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03551DB5 mov eax, dword ptr fs:[00000030h] 17_2_03551DB5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03551DB5 mov eax, dword ptr fs:[00000030h] 17_2_03551DB5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03551DB5 mov eax, dword ptr fs:[00000030h] 17_2_03551DB5
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A51BE mov eax, dword ptr fs:[00000030h] 17_2_035A51BE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A51BE mov eax, dword ptr fs:[00000030h] 17_2_035A51BE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A51BE mov eax, dword ptr fs:[00000030h] 17_2_035A51BE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A51BE mov eax, dword ptr fs:[00000030h] 17_2_035A51BE
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035535A1 mov eax, dword ptr fs:[00000030h] 17_2_035535A1
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035561A0 mov eax, dword ptr fs:[00000030h] 17_2_035561A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035561A0 mov eax, dword ptr fs:[00000030h] 17_2_035561A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A69A6 mov eax, dword ptr fs:[00000030h] 17_2_035A69A6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03540050 mov eax, dword ptr fs:[00000030h] 17_2_03540050
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03540050 mov eax, dword ptr fs:[00000030h] 17_2_03540050
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035BC450 mov eax, dword ptr fs:[00000030h] 17_2_035BC450
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035BC450 mov eax, dword ptr fs:[00000030h] 17_2_035BC450
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355A44B mov eax, dword ptr fs:[00000030h] 17_2_0355A44B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F1074 mov eax, dword ptr fs:[00000030h] 17_2_035F1074
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E2073 mov eax, dword ptr fs:[00000030h] 17_2_035E2073
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0354746D mov eax, dword ptr fs:[00000030h] 17_2_0354746D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F4015 mov eax, dword ptr fs:[00000030h] 17_2_035F4015
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F4015 mov eax, dword ptr fs:[00000030h] 17_2_035F4015
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A7016 mov eax, dword ptr fs:[00000030h] 17_2_035A7016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A7016 mov eax, dword ptr fs:[00000030h] 17_2_035A7016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A7016 mov eax, dword ptr fs:[00000030h] 17_2_035A7016
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A6C0A mov eax, dword ptr fs:[00000030h] 17_2_035A6C0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A6C0A mov eax, dword ptr fs:[00000030h] 17_2_035A6C0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A6C0A mov eax, dword ptr fs:[00000030h] 17_2_035A6C0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A6C0A mov eax, dword ptr fs:[00000030h] 17_2_035A6C0A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F740D mov eax, dword ptr fs:[00000030h] 17_2_035F740D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F740D mov eax, dword ptr fs:[00000030h] 17_2_035F740D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F740D mov eax, dword ptr fs:[00000030h] 17_2_035F740D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1C06 mov eax, dword ptr fs:[00000030h] 17_2_035E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1C06 mov eax, dword ptr fs:[00000030h] 17_2_035E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1C06 mov eax, dword ptr fs:[00000030h] 17_2_035E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1C06 mov eax, dword ptr fs:[00000030h] 17_2_035E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1C06 mov eax, dword ptr fs:[00000030h] 17_2_035E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1C06 mov eax, dword ptr fs:[00000030h] 17_2_035E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1C06 mov eax, dword ptr fs:[00000030h] 17_2_035E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1C06 mov eax, dword ptr fs:[00000030h] 17_2_035E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1C06 mov eax, dword ptr fs:[00000030h] 17_2_035E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1C06 mov eax, dword ptr fs:[00000030h] 17_2_035E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1C06 mov eax, dword ptr fs:[00000030h] 17_2_035E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1C06 mov eax, dword ptr fs:[00000030h] 17_2_035E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1C06 mov eax, dword ptr fs:[00000030h] 17_2_035E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E1C06 mov eax, dword ptr fs:[00000030h] 17_2_035E1C06
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355002D mov eax, dword ptr fs:[00000030h] 17_2_0355002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355002D mov eax, dword ptr fs:[00000030h] 17_2_0355002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355002D mov eax, dword ptr fs:[00000030h] 17_2_0355002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355002D mov eax, dword ptr fs:[00000030h] 17_2_0355002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355002D mov eax, dword ptr fs:[00000030h] 17_2_0355002D
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353B02A mov eax, dword ptr fs:[00000030h] 17_2_0353B02A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353B02A mov eax, dword ptr fs:[00000030h] 17_2_0353B02A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353B02A mov eax, dword ptr fs:[00000030h] 17_2_0353B02A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353B02A mov eax, dword ptr fs:[00000030h] 17_2_0353B02A
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355BC2C mov eax, dword ptr fs:[00000030h] 17_2_0355BC2C
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035F8CD6 mov eax, dword ptr fs:[00000030h] 17_2_035F8CD6
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035BB8D0 mov eax, dword ptr fs:[00000030h] 17_2_035BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035BB8D0 mov ecx, dword ptr fs:[00000030h] 17_2_035BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035BB8D0 mov eax, dword ptr fs:[00000030h] 17_2_035BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035BB8D0 mov eax, dword ptr fs:[00000030h] 17_2_035BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035BB8D0 mov eax, dword ptr fs:[00000030h] 17_2_035BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035BB8D0 mov eax, dword ptr fs:[00000030h] 17_2_035BB8D0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035E14FB mov eax, dword ptr fs:[00000030h] 17_2_035E14FB
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A6CF0 mov eax, dword ptr fs:[00000030h] 17_2_035A6CF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A6CF0 mov eax, dword ptr fs:[00000030h] 17_2_035A6CF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A6CF0 mov eax, dword ptr fs:[00000030h] 17_2_035A6CF0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035258EC mov eax, dword ptr fs:[00000030h] 17_2_035258EC
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0353849B mov eax, dword ptr fs:[00000030h] 17_2_0353849B
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_03529080 mov eax, dword ptr fs:[00000030h] 17_2_03529080
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A3884 mov eax, dword ptr fs:[00000030h] 17_2_035A3884
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035A3884 mov eax, dword ptr fs:[00000030h] 17_2_035A3884
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355F0BF mov ecx, dword ptr fs:[00000030h] 17_2_0355F0BF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355F0BF mov eax, dword ptr fs:[00000030h] 17_2_0355F0BF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_0355F0BF mov eax, dword ptr fs:[00000030h] 17_2_0355F0BF
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035520A0 mov eax, dword ptr fs:[00000030h] 17_2_035520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035520A0 mov eax, dword ptr fs:[00000030h] 17_2_035520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035520A0 mov eax, dword ptr fs:[00000030h] 17_2_035520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035520A0 mov eax, dword ptr fs:[00000030h] 17_2_035520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035520A0 mov eax, dword ptr fs:[00000030h] 17_2_035520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035520A0 mov eax, dword ptr fs:[00000030h] 17_2_035520A0
Source: C:\Windows\SysWOW64\svchost.exe Code function: 17_2_035690AF mov eax, dword ptr fs:[00000030h] 17_2_035690AF
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Code function: 12_2_00409B30 LdrLoadDll, 12_2_00409B30
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 1210000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Section loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Section loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Thread register set: target process: 3292 Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Thread register set: target process: 3292 Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Thread register set: target process: 4524 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Process created: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe" Jump to behavior
Source: explorer.exe, 0000000E.00000000.330983528.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.309774426.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.413808591.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.346663673.0000000001400000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: uProgram Manager
Source: explorer.exe, 0000000E.00000000.314124995.0000000005F40000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.330983528.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.309774426.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.413808591.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.346663673.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001D.00000000.476334037.00000000060F1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.477072596.00000000061A0000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001D.00000003.468133229.00000000060F1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000002.535978081.00000000061A0000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001D.00000002.535583862.00000000060F1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.510518709.00000000060F1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.510678631.00000000061A0000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.501563088.00000000060F1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.461471102.00000000044E8000.00000004.00000010.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.502198515.00000000061A0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000E.00000000.330983528.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.309774426.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.413808591.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.346663673.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001D.00000000.485552747.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.473223264.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.460008601.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.501476505.00000000060B7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.476195476.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000002.535454990.00000000060B7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000003.468100591.00000000060B8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.477072596.00000000061A0000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001D.00000002.535978081.00000000061A0000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.510678631.00000000061A0000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.507621751.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.510357758.00000000060B7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000002.529597108.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000000.502198515.00000000061A0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000E.00000000.346283837.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.330693683.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.413334676.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.309431737.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ProgmanX
Source: explorer.exe, 0000000E.00000000.330983528.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.309774426.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.413808591.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.346663673.0000000001400000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 0000000E.00000000.321946931.0000000008ACF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.338770667.0000000008ACF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.355147226.0000000008ACF000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWndAj

Language, Device and Operating System Detection
barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HSBC Bank Swift Copy.pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
AV process strings found (often used to terminate AV products)
Source: explorer.exe, 0000001D.00000000.500099390.00000000042BF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Program Files\Windows Defender\MSASCui.exe

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HSBC Bank Swift Copy.pdf.exe.4355240.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HSBC Bank Swift Copy.pdf.exe.42fac20.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.378377402.0000000000E50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.378466176.00000000011A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.531069292.0000000000F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.304686882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.304254698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.377961712.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.528571201.00000000008F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.339842712.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.532271564.0000000000F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.356870466.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.308628609.00000000041A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.HSBC Bank Swift Copy.pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.HSBC Bank Swift Copy.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HSBC Bank Swift Copy.pdf.exe.4355240.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HSBC Bank Swift Copy.pdf.exe.42fac20.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.378377402.0000000000E50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.378466176.00000000011A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.531069292.0000000000F50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.304686882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.304254698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.377961712.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.528571201.00000000008F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.339842712.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.532271564.0000000000F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.356870466.000000000B7CD000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.308628609.00000000041A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 562044 Sample: HSBC Bank Swift Copy.pdf.exe Startdate: 28/01/2022 Architecture: WINDOWS Score: 100 31 www.pointconstructionservices.com 2->31 33 www.collective4choice.com 2->33 35 3 other IPs or domains 2->35 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for URL or domain 2->43 45 13 other signatures 2->45 11 HSBC Bank Swift Copy.pdf.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\...\HSBC Bank Swift Copy.pdf.exe.log, ASCII 11->29 dropped 14 HSBC Bank Swift Copy.pdf.exe 11->14         started        process6 signatures7 55 Modifies the context of a thread in another process (thread injection) 14->55 57 Maps a DLL or memory area into another process 14->57 59 Sample uses process hollowing technique 14->59 61 Queues an APC in another process (thread injection) 14->61 17 explorer.exe 14->17 injected process8 process9 19 svchost.exe 17->19         started        signatures10 47 Self deletion via cmd delete 19->47 49 Modifies the context of a thread in another process (thread injection) 19->49 51 Maps a DLL or memory area into another process 19->51 53 Tries to detect virtualization through RDTSC time measurements 19->53 22 explorer.exe 1 122 19->22         started        25 cmd.exe 1 19->25         started        process11 dnsIp12 37 192.168.2.1 unknown unknown 22->37 27 conhost.exe 25->27         started        process13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private

IP
192.168.2.1

Contacted Domains

Name IP Active
pointconstructionservices.com 34.102.136.180 true
d1g9pg5cncourf.cloudfront.net 13.225.39.103 true
www.amr-fire.net unknown unknown
www.pointconstructionservices.com unknown unknown
www.collective4choice.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.loj-kits.xyz/rexd/ true
  • Avira URL Cloud: malware
 low