Windows Analysis Report
SwiftMessage_Unlocked_Transaction ProofMessage.exe

Overview

General Information

Sample Name: SwiftMessage_Unlocked_Transaction ProofMessage.exe
Analysis ID: 680488
MD5: ed3e368480ce9fdd917565b149d52e14
SHA1: d8f888cfee5175c6d4f8da8007bf9e92cc5f0d87
SHA256: 3d547c5731a7c08b7d25c4724cb9ae8a75ce246dc2715ee0e58edbb5ec2221f8
Tags: exeFormbook
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Queues an APC in another process (thread injection)
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Adds a directory exclusion to Windows Defender
Uses schtasks.exe or at.exe to add and modify task schedules
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe Virustotal: Detection: 38% Perma Link
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe ReversingLabs: Detection: 29%
Yara detected FormBook
Source: Yara match File source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: www.familism.net/qaom/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\wKwiksScXFp.exe ReversingLabs: Detection: 29%
Machine Learning detection for sample
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\wKwiksScXFp.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.familism.net/qaom/"], "decoy": ["WK4227sGKNxdtoj/0el0mSq6", "6xaJ/eBRc1Is34jYrt3HpbWWpL8=", "Q7+YyiJbcxwKABQO", "atnlwk5WXUDP", "O6yJJQ1+qofZlXOe9Tg=", "dunCiWrF4HybTdg=", "DMu9XSig1sDHpEurphKPD5I=", "0BiFGyxxBqHK9SoX", "I1T3Eo/xM+g+G8E=", "YNCVL0Gu1nybTdg=", "LK5/JglqrJNlLXsB/y8=", "GVT1r5DUEwmfRB49hQ==", "3FgVMp31AavK9SoX", "/Go/U5XV/73NRGaYz9Hj", "X5wxX+xch3fK9SoX", "7zegS4KNMpAEV88=", "6h6gMwpSYEpXCpjLqhKPD5I=", "gvSwORhos596Mc0rToo1E8p73E0xBu0BkA==", "siwQw91WgGlzSOpKMzztMvABuFg1", "Z6dAwcEocHDK9SoX", "h7Mox9lUflw78oXFrhKPD5I=", "xRSnRy6SEr9VuQ==", "d/zWB58BGMsb4xZo2gP6", "vyfkgl2Xv6k2o+IXStjUFiSiAg==", "crBR7fNVZk/nYJClIoVlzw==", "HGIDmKrWFPo=", "DI1Q7AExpQRXONI=", "/388PtNIZxpxZ/cdmFFAxw==", "5VYiHn7Y8eF43fj8L9rVFiSiAg==", "9UO3sVqQsmLF", "sXNmwsknc2xVO/RcUdHKE6fQJZm3zw==", "X9SLfeVhiWxQRB49hQ==", "j7wwN4PJAqBNr8tn+a4Aeuyt", "DE/Zg2Sr23ybTdg=", "WsyC+M8HJtukVniYIoVlzw==", "/jzqGSaiEr9VuQ==", "xSwSx8sWcl+0RB49hQ==", "qrSdt0jBEwgbg3sB/y8=", "zhiQnTF+5INt3woO", "+CK93DWQm0fDrPkh1xKPD5I=", "pOBXfOMlTw0Pd7LVml1ibSiz", "GItvoylqfzY/K4CiIoVlzw==", "/Ww8XPNtlk+qXmRHqaB0mSq6", "Uch4GPdKVzshf3sB/y8=", "zPNua9dQbiB0Vwpt7Pn4wEoTJBU9", "HZtax4/e8dM57w8bojTVvkwTJBU9", "uTlOCbAIUnBZUbsO0xKPD5I=", "XqUSspnoLSUlBHMQETY=", "rSTV4D+7Er9VuQ==", "bd3oTDOnF3ybTdg=", "pyDqCl2xul22qvLoVuGBZueCJZm3zw==", "deyiDdEUUTUaqVezL857jZ97lDP8xw==", "syQDtrscLQ2kRB49hQ==", "KlzKRxhUdxUtj9khEX3IjYLEw+Qb5X0=", "l9NbxqQUPC8vBnMQETY=", "LaiNxSxCizujRB49hQ==", "QLiHqfxYm1kshbv853KG87WWpL8=", "kOp/JDkY0qwjrg==", "GdW4A7HsB3ybTdg=", "QbqiVFmfl0Ma5Slgnh3WHeyBJZm3zw==", "DY45YM89dV+1RB49hQ==", "aqkyAuctVzMO5X3DqxKPD5I=", "WoDzipz+PStyOtgA", "lQraDqf9JQnmr/fnLin2qSey"]}
Uses 32bit PE files
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.276717039.00000000013C8000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.280618742.000000000156A000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000003.429124075.0000000000EBE000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000003.427047954.0000000000D15000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.276717039.00000000013C8000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.280618742.000000000156A000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, cmd.exe, 00000015.00000003.429124075.0000000000EBE000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000003.427047954.0000000000D15000.00000004.00000800.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4x nop then pop edi 21_2_005D8910
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4x nop then pop edi 21_2_005D890F

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.familism.net/qaom/
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236947938.00000000060CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://en.wi
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.285088525.0000000003392000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239517946.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239379153.00000000060B2000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237645977.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237561745.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237725635.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237607822.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237418195.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237253717.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237348551.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237394542.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237371268.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237725635.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comEach4
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237725635.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comz
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.249977639.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241315732.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241999799.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241349024.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248521016.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248657981.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.250073464.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248392812.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248249433.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243054980.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241188909.00000000060CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241339444.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241553390.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241401813.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241449552.00000000060CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersd
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241302162.00000000060CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designerse1
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241302162.00000000060CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersl
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designerss
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243458235.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243510605.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243106460.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243537061.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comE.TTF
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244037027.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243761000.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244069272.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243727765.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244008649.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243982106.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242602401.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243789684.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242880352.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243930754.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242632805.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243578782.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242810453.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comF
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241226152.00000000060D4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comN?:
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241349024.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241622575.00000000060CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalic
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243578782.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243458235.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243080983.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243510605.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243106460.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243054980.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243633570.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243537061.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalsd7
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242188590.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242263259.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comd7
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241349024.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comdQ
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241999799.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241904236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241839678.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241622575.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241815649.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241677362.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241882852.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241936236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comdnF
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.249977639.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248521016.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248657981.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248392812.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248249433.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.come.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241999799.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241904236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241839678.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241815649.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241677362.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241882852.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241936236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241860717.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comessedG?1
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242880352.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242632805.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242810453.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243458235.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243080983.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242746948.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243510605.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243106460.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243054980.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243537061.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comgrito
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242602401.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242880352.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242632805.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243578782.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242810453.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243458235.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243080983.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242746948.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243510605.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243106460.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243054980.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243633570.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243537061.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comicTFf
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248203304.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248249433.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comltvoN?:
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241999799.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241904236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241839678.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241815649.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241677362.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241882852.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241936236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241860717.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comm
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248203304.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248249433.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.como
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241315732.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241349024.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241401813.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241562151.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241449552.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241226152.00000000060D4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comrsiv
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242602401.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242880352.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242632805.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242810453.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243080983.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242552714.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242746948.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comtoTF
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242188590.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242263259.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comtu
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236573699.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.c
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn6
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnZ
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnb-n
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnr
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244725982.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244841654.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245162197.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245031662.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245128766.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244923054.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244954693.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244725982.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244968212.00000000060D8000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245288432.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.249977639.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247776276.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.246780981.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245690952.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247331002.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248521016.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247062279.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248657981.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.246315588.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245384768.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.250073464.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247030819.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245313604.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245752027.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248203304.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247266835.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248392812.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.246402353.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/%
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238423141.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238618123.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238538445.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238618123.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238538445.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/6
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239849647.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240076436.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240030862.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240708870.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239999372.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240479501.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239966190.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240758246.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240663615.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240527492.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239773487.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239745515.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240437508.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239942847.00000000060CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0-s
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239849647.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240076436.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240030862.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239999372.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239966190.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239773487.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239745515.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239942847.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/f
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239673589.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238423141.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239527886.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238369385.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239673589.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238423141.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239527886.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238618123.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238538445.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/lnlN?:
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239673589.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239527886.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/xN
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237144267.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237144267.00000000060CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn2
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237144267.00000000060CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cnlg?
Creates a DirectInput object (often for capturing keystrokes)
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.279048844.000000000155B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: SwiftMessage_Unlocked_Transaction ProofMessage.exe PID: 3144, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: SwiftMessage_Unlocked_Transaction ProofMessage.exe PID: 1888, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: cmd.exe PID: 2896, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Uses 32bit PE files
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: SwiftMessage_Unlocked_Transaction ProofMessage.exe PID: 3144, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: SwiftMessage_Unlocked_Transaction ProofMessage.exe PID: 1888, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: cmd.exe PID: 2896, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Detected potential crypto function
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 0_2_0150F250 0_2_0150F250
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 0_2_0150F240 0_2_0150F240
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 0_2_0150D2AC 0_2_0150D2AC
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01744120 8_2_01744120
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172F900 8_2_0172F900
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174A830 8_2_0174A830
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017FE824 8_2_017FE824
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1002 8_2_017E1002
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F28EC 8_2_017F28EC
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017520A0 8_2_017520A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F20A8 8_2_017F20A8
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173B090 8_2_0173B090
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174AB40 8_2_0174AB40
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F2B28 8_2_017F2B28
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E03DA 8_2_017E03DA
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017EDBD2 8_2_017EDBD2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175EBB0 8_2_0175EBB0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017DFA2B 8_2_017DFA2B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F22AE 8_2_017F22AE
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F1D55 8_2_017F1D55
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01720D20 8_2_01720D20
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F2D07 8_2_017F2D07
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173D5E0 8_2_0173D5E0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F25DD 8_2_017F25DD
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01752581 8_2_01752581
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017ED466 8_2_017ED466
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173841F 8_2_0173841F
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F1FF1 8_2_017F1FF1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017FDFCE 8_2_017FDFCE
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01746E30 8_2_01746E30
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017ED616 8_2_017ED616
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F2EF7 8_2_017F2EF7
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_00420395 8_2_00420395
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E2B28 21_2_032E2B28
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323AB40 21_2_0323AB40
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324EBB0 21_2_0324EBB0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032D03DA 21_2_032D03DA
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032DDBD2 21_2_032DDBD2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032CFA2B 21_2_032CFA2B
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E22AE 21_2_032E22AE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03234120 21_2_03234120
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321F900 21_2_0321F900
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032399BF 21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032EE824 21_2_032EE824
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323A830 21_2_0323A830
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032D1002 21_2_032D1002
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032420A0 21_2_032420A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E20A8 21_2_032E20A8
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0322B090 21_2_0322B090
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E28EC 21_2_032E28EC
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E1FF1 21_2_032E1FF1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032EDFCE 21_2_032EDFCE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03236E30 21_2_03236E30
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032DD616 21_2_032DD616
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E2EF7 21_2_032E2EF7
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03210D20 21_2_03210D20
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E2D07 21_2_032E2D07
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E1D55 21_2_032E1D55
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03242581 21_2_03242581
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0322D5E0 21_2_0322D5E0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E25DD 21_2_032E25DD
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0322841F 21_2_0322841F
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032DD466 21_2_032DD466
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005D8910 21_2_005D8910
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005F001C 21_2_005F001C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005DE9D0 21_2_005DE9D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005F0395 21_2_005F0395
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005D9D90 21_2_005D9D90
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005D2D90 21_2_005D2D90
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005D2FB0 21_2_005D2FB0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: String function: 0172B150 appears 54 times
Source: C:\Windows\SysWOW64\cmd.exe Code function: String function: 0321B150 appears 72 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769910 NtAdjustPrivilegesToken,LdrInitializeThunk, 8_2_01769910
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017699A0 NtCreateSection,LdrInitializeThunk, 8_2_017699A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769860 NtQuerySystemInformation,LdrInitializeThunk, 8_2_01769860
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769840 NtDelayExecution,LdrInitializeThunk, 8_2_01769840
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017698F0 NtReadVirtualMemory,LdrInitializeThunk, 8_2_017698F0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769A50 NtCreateFile,LdrInitializeThunk, 8_2_01769A50
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769A20 NtResumeThread,LdrInitializeThunk, 8_2_01769A20
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769A00 NtProtectVirtualMemory,LdrInitializeThunk, 8_2_01769A00
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769540 NtReadFile,LdrInitializeThunk, 8_2_01769540
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017695D0 NtClose,LdrInitializeThunk, 8_2_017695D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769710 NtQueryInformationToken,LdrInitializeThunk, 8_2_01769710
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769FE0 NtCreateMutant,LdrInitializeThunk, 8_2_01769FE0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017697A0 NtUnmapViewOfSection,LdrInitializeThunk, 8_2_017697A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769780 NtMapViewOfSection,LdrInitializeThunk, 8_2_01769780
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769660 NtAllocateVirtualMemory,LdrInitializeThunk, 8_2_01769660
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017696E0 NtFreeVirtualMemory,LdrInitializeThunk, 8_2_017696E0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769950 NtQueueApcThread, 8_2_01769950
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017699D0 NtCreateProcessEx, 8_2_017699D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0176B040 NtSuspendThread, 8_2_0176B040
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769820 NtEnumerateKey, 8_2_01769820
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017698A0 NtWriteVirtualMemory, 8_2_017698A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769B00 NtSetValueKey, 8_2_01769B00
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0176A3B0 NtGetContextThread, 8_2_0176A3B0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769A10 NtQuerySection, 8_2_01769A10
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769A80 NtOpenDirectoryObject, 8_2_01769A80
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769560 NtWriteFile, 8_2_01769560
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0176AD30 NtSetContextThread, 8_2_0176AD30
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769520 NtWaitForSingleObject, 8_2_01769520
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017695F0 NtQueryInformationFile, 8_2_017695F0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0176A770 NtOpenThread, 8_2_0176A770
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769770 NtSetInformationFile, 8_2_01769770
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769760 NtOpenProcess, 8_2_01769760
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769730 NtQueryVirtualMemory, 8_2_01769730
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0176A710 NtOpenProcessToken, 8_2_0176A710
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769670 NtQueryInformationProcess, 8_2_01769670
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769650 NtQueryValueKey, 8_2_01769650
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769610 NtEnumerateValueKey, 8_2_01769610
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017696D0 NtCreateKey, 8_2_017696D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259A50 NtCreateFile,LdrInitializeThunk, 21_2_03259A50
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259910 NtAdjustPrivilegesToken,LdrInitializeThunk, 21_2_03259910
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032599A0 NtCreateSection,LdrInitializeThunk, 21_2_032599A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259860 NtQuerySystemInformation,LdrInitializeThunk, 21_2_03259860
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259840 NtDelayExecution,LdrInitializeThunk, 21_2_03259840
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259710 NtQueryInformationToken,LdrInitializeThunk, 21_2_03259710
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259780 NtMapViewOfSection,LdrInitializeThunk, 21_2_03259780
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259FE0 NtCreateMutant,LdrInitializeThunk, 21_2_03259FE0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032596E0 NtFreeVirtualMemory,LdrInitializeThunk, 21_2_032596E0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032596D0 NtCreateKey,LdrInitializeThunk, 21_2_032596D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259540 NtReadFile,LdrInitializeThunk, 21_2_03259540
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032595D0 NtClose,LdrInitializeThunk, 21_2_032595D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259B00 NtSetValueKey, 21_2_03259B00
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0325A3B0 NtGetContextThread, 21_2_0325A3B0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259A20 NtResumeThread, 21_2_03259A20
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259A00 NtProtectVirtualMemory, 21_2_03259A00
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259A10 NtQuerySection, 21_2_03259A10
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259A80 NtOpenDirectoryObject, 21_2_03259A80
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259950 NtQueueApcThread, 21_2_03259950
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032599D0 NtCreateProcessEx, 21_2_032599D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259820 NtEnumerateKey, 21_2_03259820
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0325B040 NtSuspendThread, 21_2_0325B040
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032598A0 NtWriteVirtualMemory, 21_2_032598A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032598F0 NtReadVirtualMemory, 21_2_032598F0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259730 NtQueryVirtualMemory, 21_2_03259730
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0325A710 NtOpenProcessToken, 21_2_0325A710
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259760 NtOpenProcess, 21_2_03259760
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0325A770 NtOpenThread, 21_2_0325A770
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259770 NtSetInformationFile, 21_2_03259770
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032597A0 NtUnmapViewOfSection, 21_2_032597A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259610 NtEnumerateValueKey, 21_2_03259610
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259660 NtAllocateVirtualMemory, 21_2_03259660
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259670 NtQueryInformationProcess, 21_2_03259670
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259650 NtQueryValueKey, 21_2_03259650
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259520 NtWaitForSingleObject, 21_2_03259520
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0325AD30 NtSetContextThread, 21_2_0325AD30
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03259560 NtWriteFile, 21_2_03259560
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032595F0 NtQueryInformationFile, 21_2_032595F0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005EB850 NtClose, 21_2_005EB850
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005EB820 NtDeleteFile, 21_2_005EB820
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005EB720 NtCreateFile, 21_2_005EB720
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005EB7D0 NtReadFile, 21_2_005EB7D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005EB81A NtDeleteFile, 21_2_005EB81A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005EB71A NtCreateFile, 21_2_005EB71A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005EB7CA NtReadFile, 21_2_005EB7CA
Sample file is different than original file name gathered from version info
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.303696641.00000000077C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameKeysNormalize.dll4 vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDoncepre.dll@ vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.257169333.0000000007824000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSwitchValueSt.exeB vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.251729648.00000000015F0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameKeysNormalize.dll4 vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000000.230772744.0000000000E06000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSwitchValueSt.exeB vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.304257285.00000000078F0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameWebName.dll4 vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.279048844.000000000155B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.304726057.0000000007A70000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameDoncepre.dll@ vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.278766398.00000000014DE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.282569146.0000000001689000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe Binary or memory string: OriginalFilenameSwitchValueSt.exeB vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: wKwiksScXFp.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe Virustotal: Detection: 38%
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe File read: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Jump to behavior
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe "C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe"
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wKwiksScXFp.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wKwiksScXFp" /XML "C:\Users\user\AppData\Local\Temp\tmpFDE9.tmp
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process created: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wKwiksScXFp.exe Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wKwiksScXFp" /XML "C:\Users\user\AppData\Local\Temp\tmpFDE9.tmp Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process created: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe File created: C:\Users\user\AppData\Roaming\wKwiksScXFp.exe Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe File created: C:\Users\user\AppData\Local\Temp\tmpFDE9.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@10/8@0/0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Mutant created: \Sessions\1\BaseNamedObjects\rObCTeCTUwCXtLerA
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3404:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3608:120:WilError_01
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.276717039.00000000013C8000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.280618742.000000000156A000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000003.429124075.0000000000EBE000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000003.427047954.0000000000D15000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.276717039.00000000013C8000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.280618742.000000000156A000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, cmd.exe, 00000015.00000003.429124075.0000000000EBE000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000003.427047954.0000000000D15000.00000004.00000800.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0177D0D1 push ecx; ret 8_2_0177D0E4
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_00420166 push 75DEC230h; ret 8_2_00420173
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0326D0D1 push ecx; ret 21_2_0326D0E4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005F0166 push 75DEC230h; ret 21_2_005F0173
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005ED924 push edx; retf 21_2_005ED927
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005EEA55 push eax; ret 21_2_005EEAA8
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005E8273 push eax; retf 21_2_005E8274
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005E82F1 pushad ; ret 21_2_005E82F4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005EEAAB push eax; ret 21_2_005EEB12
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005EEAA2 push eax; ret 21_2_005EEAA8
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005D6B10 pushfd ; retf 21_2_005D6BA2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005EEB0C push eax; ret 21_2_005EEB12
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005EBB37 push 00000063h; retf 21_2_005EBB3A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005D6B8F pushfd ; retf 21_2_005D6BA2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005E7E79 push esp; retf 21_2_005E7E7A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_005DB724 push 19B8h; ret 21_2_005DB730
Source: initial sample Static PE information: section name: .text entropy: 7.729603877475422
Source: initial sample Static PE information: section name: .text entropy: 7.729603877475422
Drops PE files
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe File created: C:\Users\user\AppData\Roaming\wKwiksScXFp.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wKwiksScXFp" /XML "C:\Users\user\AppData\Local\Temp\tmpFDE9.tmp
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.285088525.0000000003392000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SwiftMessage_Unlocked_Transaction ProofMessage.exe PID: 3144, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.285088525.0000000003392000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.285088525.0000000003392000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe TID: 1476 Thread sleep time: -45877s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe TID: 1100 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1796 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F5BA5 rdtsc 8_2_017F5BA5
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 9243 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe API coverage: 4.9 %
Source: C:\Windows\SysWOW64\cmd.exe API coverage: 7.4 %
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Thread delayed: delay time: 45877 Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 0000000B.00000000.376640838.00000000051AC000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 0000000B.00000000.310708982.00000000051F7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: -94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}71USER
Source: explorer.exe, 0000000B.00000000.315581158.0000000006005000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: explorer.exe, 0000000B.00000000.315581158.0000000006005000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 0000000B.00000000.314310480.0000000005EAB000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000B.00000000.315581158.0000000006005000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000B.00000000.310708982.00000000051F7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 0000000B.00000000.315581158.0000000006005000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: explorer.exe, 0000000B.00000000.376537434.0000000005136000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 0000000B.00000000.315581158.0000000006005000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00dRom0cY
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F5BA5 rdtsc 8_2_017F5BA5
Enables debug privileges
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172B171 mov eax, dword ptr fs:[00000030h] 8_2_0172B171
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172B171 mov eax, dword ptr fs:[00000030h] 8_2_0172B171
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172C962 mov eax, dword ptr fs:[00000030h] 8_2_0172C962
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174B944 mov eax, dword ptr fs:[00000030h] 8_2_0174B944
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174B944 mov eax, dword ptr fs:[00000030h] 8_2_0174B944
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175513A mov eax, dword ptr fs:[00000030h] 8_2_0175513A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175513A mov eax, dword ptr fs:[00000030h] 8_2_0175513A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01744120 mov eax, dword ptr fs:[00000030h] 8_2_01744120
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01744120 mov eax, dword ptr fs:[00000030h] 8_2_01744120
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01744120 mov eax, dword ptr fs:[00000030h] 8_2_01744120
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01744120 mov eax, dword ptr fs:[00000030h] 8_2_01744120
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01744120 mov ecx, dword ptr fs:[00000030h] 8_2_01744120
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01729100 mov eax, dword ptr fs:[00000030h] 8_2_01729100
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01729100 mov eax, dword ptr fs:[00000030h] 8_2_01729100
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01729100 mov eax, dword ptr fs:[00000030h] 8_2_01729100
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017B41E8 mov eax, dword ptr fs:[00000030h] 8_2_017B41E8
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172B1E1 mov eax, dword ptr fs:[00000030h] 8_2_0172B1E1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172B1E1 mov eax, dword ptr fs:[00000030h] 8_2_0172B1E1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172B1E1 mov eax, dword ptr fs:[00000030h] 8_2_0172B1E1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A51BE mov eax, dword ptr fs:[00000030h] 8_2_017A51BE
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A51BE mov eax, dword ptr fs:[00000030h] 8_2_017A51BE
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A51BE mov eax, dword ptr fs:[00000030h] 8_2_017A51BE
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A51BE mov eax, dword ptr fs:[00000030h] 8_2_017A51BE
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017561A0 mov eax, dword ptr fs:[00000030h] 8_2_017561A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017561A0 mov eax, dword ptr fs:[00000030h] 8_2_017561A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E49A4 mov eax, dword ptr fs:[00000030h] 8_2_017E49A4
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E49A4 mov eax, dword ptr fs:[00000030h] 8_2_017E49A4
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E49A4 mov eax, dword ptr fs:[00000030h] 8_2_017E49A4
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E49A4 mov eax, dword ptr fs:[00000030h] 8_2_017E49A4
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A69A6 mov eax, dword ptr fs:[00000030h] 8_2_017A69A6
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01752990 mov eax, dword ptr fs:[00000030h] 8_2_01752990
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175A185 mov eax, dword ptr fs:[00000030h] 8_2_0175A185
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174C182 mov eax, dword ptr fs:[00000030h] 8_2_0174C182
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F1074 mov eax, dword ptr fs:[00000030h] 8_2_017F1074
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E2073 mov eax, dword ptr fs:[00000030h] 8_2_017E2073
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01740050 mov eax, dword ptr fs:[00000030h] 8_2_01740050
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01740050 mov eax, dword ptr fs:[00000030h] 8_2_01740050
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174A830 mov eax, dword ptr fs:[00000030h] 8_2_0174A830
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174A830 mov eax, dword ptr fs:[00000030h] 8_2_0174A830
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174A830 mov eax, dword ptr fs:[00000030h] 8_2_0174A830
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174A830 mov eax, dword ptr fs:[00000030h] 8_2_0174A830
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175002D mov eax, dword ptr fs:[00000030h] 8_2_0175002D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175002D mov eax, dword ptr fs:[00000030h] 8_2_0175002D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175002D mov eax, dword ptr fs:[00000030h] 8_2_0175002D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175002D mov eax, dword ptr fs:[00000030h] 8_2_0175002D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175002D mov eax, dword ptr fs:[00000030h] 8_2_0175002D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173B02A mov eax, dword ptr fs:[00000030h] 8_2_0173B02A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173B02A mov eax, dword ptr fs:[00000030h] 8_2_0173B02A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173B02A mov eax, dword ptr fs:[00000030h] 8_2_0173B02A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173B02A mov eax, dword ptr fs:[00000030h] 8_2_0173B02A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F4015 mov eax, dword ptr fs:[00000030h] 8_2_017F4015
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F4015 mov eax, dword ptr fs:[00000030h] 8_2_017F4015
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A7016 mov eax, dword ptr fs:[00000030h] 8_2_017A7016
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A7016 mov eax, dword ptr fs:[00000030h] 8_2_017A7016
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A7016 mov eax, dword ptr fs:[00000030h] 8_2_017A7016
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017240E1 mov eax, dword ptr fs:[00000030h] 8_2_017240E1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017240E1 mov eax, dword ptr fs:[00000030h] 8_2_017240E1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017240E1 mov eax, dword ptr fs:[00000030h] 8_2_017240E1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017258EC mov eax, dword ptr fs:[00000030h] 8_2_017258EC
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017BB8D0 mov eax, dword ptr fs:[00000030h] 8_2_017BB8D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017BB8D0 mov ecx, dword ptr fs:[00000030h] 8_2_017BB8D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017BB8D0 mov eax, dword ptr fs:[00000030h] 8_2_017BB8D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017BB8D0 mov eax, dword ptr fs:[00000030h] 8_2_017BB8D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017BB8D0 mov eax, dword ptr fs:[00000030h] 8_2_017BB8D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017BB8D0 mov eax, dword ptr fs:[00000030h] 8_2_017BB8D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175F0BF mov ecx, dword ptr fs:[00000030h] 8_2_0175F0BF
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175F0BF mov eax, dword ptr fs:[00000030h] 8_2_0175F0BF
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175F0BF mov eax, dword ptr fs:[00000030h] 8_2_0175F0BF
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017520A0 mov eax, dword ptr fs:[00000030h] 8_2_017520A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017520A0 mov eax, dword ptr fs:[00000030h] 8_2_017520A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017520A0 mov eax, dword ptr fs:[00000030h] 8_2_017520A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017520A0 mov eax, dword ptr fs:[00000030h] 8_2_017520A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017520A0 mov eax, dword ptr fs:[00000030h] 8_2_017520A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017520A0 mov eax, dword ptr fs:[00000030h] 8_2_017520A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017690AF mov eax, dword ptr fs:[00000030h] 8_2_017690AF
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01729080 mov eax, dword ptr fs:[00000030h] 8_2_01729080
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A3884 mov eax, dword ptr fs:[00000030h] 8_2_017A3884
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A3884 mov eax, dword ptr fs:[00000030h] 8_2_017A3884
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01753B7A mov eax, dword ptr fs:[00000030h] 8_2_01753B7A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01753B7A mov eax, dword ptr fs:[00000030h] 8_2_01753B7A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172DB60 mov ecx, dword ptr fs:[00000030h] 8_2_0172DB60
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F8B58 mov eax, dword ptr fs:[00000030h] 8_2_017F8B58
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172F358 mov eax, dword ptr fs:[00000030h] 8_2_0172F358
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172DB40 mov eax, dword ptr fs:[00000030h] 8_2_0172DB40
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E131B mov eax, dword ptr fs:[00000030h] 8_2_017E131B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017503E2 mov eax, dword ptr fs:[00000030h] 8_2_017503E2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017503E2 mov eax, dword ptr fs:[00000030h] 8_2_017503E2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017503E2 mov eax, dword ptr fs:[00000030h] 8_2_017503E2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017503E2 mov eax, dword ptr fs:[00000030h] 8_2_017503E2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017503E2 mov eax, dword ptr fs:[00000030h] 8_2_017503E2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017503E2 mov eax, dword ptr fs:[00000030h] 8_2_017503E2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174DBE9 mov eax, dword ptr fs:[00000030h] 8_2_0174DBE9
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A53CA mov eax, dword ptr fs:[00000030h] 8_2_017A53CA
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A53CA mov eax, dword ptr fs:[00000030h] 8_2_017A53CA
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01754BAD mov eax, dword ptr fs:[00000030h] 8_2_01754BAD
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01754BAD mov eax, dword ptr fs:[00000030h] 8_2_01754BAD
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01754BAD mov eax, dword ptr fs:[00000030h] 8_2_01754BAD
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F5BA5 mov eax, dword ptr fs:[00000030h] 8_2_017F5BA5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01752397 mov eax, dword ptr fs:[00000030h] 8_2_01752397
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175B390 mov eax, dword ptr fs:[00000030h] 8_2_0175B390
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E138A mov eax, dword ptr fs:[00000030h] 8_2_017E138A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01731B8F mov eax, dword ptr fs:[00000030h] 8_2_01731B8F
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01731B8F mov eax, dword ptr fs:[00000030h] 8_2_01731B8F
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017DD380 mov ecx, dword ptr fs:[00000030h] 8_2_017DD380
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0176927A mov eax, dword ptr fs:[00000030h] 8_2_0176927A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017DB260 mov eax, dword ptr fs:[00000030h] 8_2_017DB260
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017DB260 mov eax, dword ptr fs:[00000030h] 8_2_017DB260
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F8A62 mov eax, dword ptr fs:[00000030h] 8_2_017F8A62
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017EEA55 mov eax, dword ptr fs:[00000030h] 8_2_017EEA55
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017B4257 mov eax, dword ptr fs:[00000030h] 8_2_017B4257
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01729240 mov eax, dword ptr fs:[00000030h] 8_2_01729240
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01729240 mov eax, dword ptr fs:[00000030h] 8_2_01729240
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01729240 mov eax, dword ptr fs:[00000030h] 8_2_01729240
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01729240 mov eax, dword ptr fs:[00000030h] 8_2_01729240
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01764A2C mov eax, dword ptr fs:[00000030h] 8_2_01764A2C
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01764A2C mov eax, dword ptr fs:[00000030h] 8_2_01764A2C
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h] 8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h] 8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h] 8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h] 8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h] 8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h] 8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h] 8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h] 8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h] 8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01725210 mov eax, dword ptr fs:[00000030h] 8_2_01725210
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01725210 mov ecx, dword ptr fs:[00000030h] 8_2_01725210
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01725210 mov eax, dword ptr fs:[00000030h] 8_2_01725210
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01725210 mov eax, dword ptr fs:[00000030h] 8_2_01725210
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172AA16 mov eax, dword ptr fs:[00000030h] 8_2_0172AA16
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172AA16 mov eax, dword ptr fs:[00000030h] 8_2_0172AA16
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01743A1C mov eax, dword ptr fs:[00000030h] 8_2_01743A1C
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017EAA16 mov eax, dword ptr fs:[00000030h] 8_2_017EAA16
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017EAA16 mov eax, dword ptr fs:[00000030h] 8_2_017EAA16
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01738A0A mov eax, dword ptr fs:[00000030h] 8_2_01738A0A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01752AE4 mov eax, dword ptr fs:[00000030h] 8_2_01752AE4
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01752ACB mov eax, dword ptr fs:[00000030h] 8_2_01752ACB
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173AAB0 mov eax, dword ptr fs:[00000030h] 8_2_0173AAB0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173AAB0 mov eax, dword ptr fs:[00000030h] 8_2_0173AAB0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175FAB0 mov eax, dword ptr fs:[00000030h] 8_2_0175FAB0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017252A5 mov eax, dword ptr fs:[00000030h] 8_2_017252A5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017252A5 mov eax, dword ptr fs:[00000030h] 8_2_017252A5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017252A5 mov eax, dword ptr fs:[00000030h] 8_2_017252A5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017252A5 mov eax, dword ptr fs:[00000030h] 8_2_017252A5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017252A5 mov eax, dword ptr fs:[00000030h] 8_2_017252A5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175D294 mov eax, dword ptr fs:[00000030h] 8_2_0175D294
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175D294 mov eax, dword ptr fs:[00000030h] 8_2_0175D294
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174C577 mov eax, dword ptr fs:[00000030h] 8_2_0174C577
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174C577 mov eax, dword ptr fs:[00000030h] 8_2_0174C577
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01747D50 mov eax, dword ptr fs:[00000030h] 8_2_01747D50
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01763D43 mov eax, dword ptr fs:[00000030h] 8_2_01763D43
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A3540 mov eax, dword ptr fs:[00000030h] 8_2_017A3540
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017D3D40 mov eax, dword ptr fs:[00000030h] 8_2_017D3D40
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172AD30 mov eax, dword ptr fs:[00000030h] 8_2_0172AD30
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h] 8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h] 8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h] 8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h] 8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h] 8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h] 8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h] 8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h] 8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h] 8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h] 8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h] 8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h] 8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h] 8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017EE539 mov eax, dword ptr fs:[00000030h] 8_2_017EE539
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F8D34 mov eax, dword ptr fs:[00000030h] 8_2_017F8D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017AA537 mov eax, dword ptr fs:[00000030h] 8_2_017AA537
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01754D3B mov eax, dword ptr fs:[00000030h] 8_2_01754D3B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01754D3B mov eax, dword ptr fs:[00000030h] 8_2_01754D3B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01754D3B mov eax, dword ptr fs:[00000030h] 8_2_01754D3B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017D8DF1 mov eax, dword ptr fs:[00000030h] 8_2_017D8DF1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173D5E0 mov eax, dword ptr fs:[00000030h] 8_2_0173D5E0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173D5E0 mov eax, dword ptr fs:[00000030h] 8_2_0173D5E0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017EFDE2 mov eax, dword ptr fs:[00000030h] 8_2_017EFDE2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017EFDE2 mov eax, dword ptr fs:[00000030h] 8_2_017EFDE2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017EFDE2 mov eax, dword ptr fs:[00000030h] 8_2_017EFDE2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017EFDE2 mov eax, dword ptr fs:[00000030h] 8_2_017EFDE2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A6DC9 mov eax, dword ptr fs:[00000030h] 8_2_017A6DC9
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A6DC9 mov eax, dword ptr fs:[00000030h] 8_2_017A6DC9
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A6DC9 mov eax, dword ptr fs:[00000030h] 8_2_017A6DC9
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A6DC9 mov ecx, dword ptr fs:[00000030h] 8_2_017A6DC9
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A6DC9 mov eax, dword ptr fs:[00000030h] 8_2_017A6DC9
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A6DC9 mov eax, dword ptr fs:[00000030h] 8_2_017A6DC9
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01751DB5 mov eax, dword ptr fs:[00000030h] 8_2_01751DB5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01751DB5 mov eax, dword ptr fs:[00000030h] 8_2_01751DB5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01751DB5 mov eax, dword ptr fs:[00000030h] 8_2_01751DB5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F05AC mov eax, dword ptr fs:[00000030h] 8_2_017F05AC
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F05AC mov eax, dword ptr fs:[00000030h] 8_2_017F05AC
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017535A1 mov eax, dword ptr fs:[00000030h] 8_2_017535A1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175FD9B mov eax, dword ptr fs:[00000030h] 8_2_0175FD9B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175FD9B mov eax, dword ptr fs:[00000030h] 8_2_0175FD9B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01752581 mov eax, dword ptr fs:[00000030h] 8_2_01752581
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01752581 mov eax, dword ptr fs:[00000030h] 8_2_01752581
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01752581 mov eax, dword ptr fs:[00000030h] 8_2_01752581
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01752581 mov eax, dword ptr fs:[00000030h] 8_2_01752581
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01722D8A mov eax, dword ptr fs:[00000030h] 8_2_01722D8A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01722D8A mov eax, dword ptr fs:[00000030h] 8_2_01722D8A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01722D8A mov eax, dword ptr fs:[00000030h] 8_2_01722D8A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01722D8A mov eax, dword ptr fs:[00000030h] 8_2_01722D8A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01722D8A mov eax, dword ptr fs:[00000030h] 8_2_01722D8A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174746D mov eax, dword ptr fs:[00000030h] 8_2_0174746D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017BC450 mov eax, dword ptr fs:[00000030h] 8_2_017BC450
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017BC450 mov eax, dword ptr fs:[00000030h] 8_2_017BC450
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175A44B mov eax, dword ptr fs:[00000030h] 8_2_0175A44B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175BC2C mov eax, dword ptr fs:[00000030h] 8_2_0175BC2C
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A6C0A mov eax, dword ptr fs:[00000030h] 8_2_017A6C0A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A6C0A mov eax, dword ptr fs:[00000030h] 8_2_017A6C0A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A6C0A mov eax, dword ptr fs:[00000030h] 8_2_017A6C0A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A6C0A mov eax, dword ptr fs:[00000030h] 8_2_017A6C0A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F740D mov eax, dword ptr fs:[00000030h] 8_2_017F740D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F740D mov eax, dword ptr fs:[00000030h] 8_2_017F740D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F740D mov eax, dword ptr fs:[00000030h] 8_2_017F740D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h] 8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h] 8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h] 8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h] 8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h] 8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h] 8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h] 8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h] 8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h] 8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h] 8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h] 8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h] 8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h] 8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h] 8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E14FB mov eax, dword ptr fs:[00000030h] 8_2_017E14FB
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A6CF0 mov eax, dword ptr fs:[00000030h] 8_2_017A6CF0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A6CF0 mov eax, dword ptr fs:[00000030h] 8_2_017A6CF0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A6CF0 mov eax, dword ptr fs:[00000030h] 8_2_017A6CF0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F8CD6 mov eax, dword ptr fs:[00000030h] 8_2_017F8CD6
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173849B mov eax, dword ptr fs:[00000030h] 8_2_0173849B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173FF60 mov eax, dword ptr fs:[00000030h] 8_2_0173FF60
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F8F6A mov eax, dword ptr fs:[00000030h] 8_2_017F8F6A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173EF40 mov eax, dword ptr fs:[00000030h] 8_2_0173EF40
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175E730 mov eax, dword ptr fs:[00000030h] 8_2_0175E730
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01724F2E mov eax, dword ptr fs:[00000030h] 8_2_01724F2E
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01724F2E mov eax, dword ptr fs:[00000030h] 8_2_01724F2E
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174F716 mov eax, dword ptr fs:[00000030h] 8_2_0174F716
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017BFF10 mov eax, dword ptr fs:[00000030h] 8_2_017BFF10
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017BFF10 mov eax, dword ptr fs:[00000030h] 8_2_017BFF10
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F070D mov eax, dword ptr fs:[00000030h] 8_2_017F070D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F070D mov eax, dword ptr fs:[00000030h] 8_2_017F070D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175A70E mov eax, dword ptr fs:[00000030h] 8_2_0175A70E
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175A70E mov eax, dword ptr fs:[00000030h] 8_2_0175A70E
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017637F5 mov eax, dword ptr fs:[00000030h] 8_2_017637F5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01738794 mov eax, dword ptr fs:[00000030h] 8_2_01738794
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A7794 mov eax, dword ptr fs:[00000030h] 8_2_017A7794
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A7794 mov eax, dword ptr fs:[00000030h] 8_2_017A7794
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A7794 mov eax, dword ptr fs:[00000030h] 8_2_017A7794
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174AE73 mov eax, dword ptr fs:[00000030h] 8_2_0174AE73
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174AE73 mov eax, dword ptr fs:[00000030h] 8_2_0174AE73
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174AE73 mov eax, dword ptr fs:[00000030h] 8_2_0174AE73
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174AE73 mov eax, dword ptr fs:[00000030h] 8_2_0174AE73
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0174AE73 mov eax, dword ptr fs:[00000030h] 8_2_0174AE73
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0173766D mov eax, dword ptr fs:[00000030h] 8_2_0173766D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01737E41 mov eax, dword ptr fs:[00000030h] 8_2_01737E41
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01737E41 mov eax, dword ptr fs:[00000030h] 8_2_01737E41
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01737E41 mov eax, dword ptr fs:[00000030h] 8_2_01737E41
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01737E41 mov eax, dword ptr fs:[00000030h] 8_2_01737E41
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01737E41 mov eax, dword ptr fs:[00000030h] 8_2_01737E41
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01737E41 mov eax, dword ptr fs:[00000030h] 8_2_01737E41
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017EAE44 mov eax, dword ptr fs:[00000030h] 8_2_017EAE44
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017EAE44 mov eax, dword ptr fs:[00000030h] 8_2_017EAE44
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017DFE3F mov eax, dword ptr fs:[00000030h] 8_2_017DFE3F
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172E620 mov eax, dword ptr fs:[00000030h] 8_2_0172E620
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175A61C mov eax, dword ptr fs:[00000030h] 8_2_0175A61C
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0175A61C mov eax, dword ptr fs:[00000030h] 8_2_0175A61C
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172C600 mov eax, dword ptr fs:[00000030h] 8_2_0172C600
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172C600 mov eax, dword ptr fs:[00000030h] 8_2_0172C600
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_0172C600 mov eax, dword ptr fs:[00000030h] 8_2_0172C600
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01758E00 mov eax, dword ptr fs:[00000030h] 8_2_01758E00
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017E1608 mov eax, dword ptr fs:[00000030h] 8_2_017E1608
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017376E2 mov eax, dword ptr fs:[00000030h] 8_2_017376E2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017516E0 mov ecx, dword ptr fs:[00000030h] 8_2_017516E0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F8ED6 mov eax, dword ptr fs:[00000030h] 8_2_017F8ED6
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01768EC7 mov eax, dword ptr fs:[00000030h] 8_2_01768EC7
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017536CC mov eax, dword ptr fs:[00000030h] 8_2_017536CC
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017DFEC0 mov eax, dword ptr fs:[00000030h] 8_2_017DFEC0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F0EA5 mov eax, dword ptr fs:[00000030h] 8_2_017F0EA5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F0EA5 mov eax, dword ptr fs:[00000030h] 8_2_017F0EA5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017F0EA5 mov eax, dword ptr fs:[00000030h] 8_2_017F0EA5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017A46A7 mov eax, dword ptr fs:[00000030h] 8_2_017A46A7
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_017BFE87 mov eax, dword ptr fs:[00000030h] 8_2_017BFE87
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032D131B mov eax, dword ptr fs:[00000030h] 21_2_032D131B
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321DB60 mov ecx, dword ptr fs:[00000030h] 21_2_0321DB60
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03243B7A mov eax, dword ptr fs:[00000030h] 21_2_03243B7A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03243B7A mov eax, dword ptr fs:[00000030h] 21_2_03243B7A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321DB40 mov eax, dword ptr fs:[00000030h] 21_2_0321DB40
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E8B58 mov eax, dword ptr fs:[00000030h] 21_2_032E8B58
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321F358 mov eax, dword ptr fs:[00000030h] 21_2_0321F358
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03244BAD mov eax, dword ptr fs:[00000030h] 21_2_03244BAD
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03244BAD mov eax, dword ptr fs:[00000030h] 21_2_03244BAD
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03244BAD mov eax, dword ptr fs:[00000030h] 21_2_03244BAD
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E5BA5 mov eax, dword ptr fs:[00000030h] 21_2_032E5BA5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032D138A mov eax, dword ptr fs:[00000030h] 21_2_032D138A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032CD380 mov ecx, dword ptr fs:[00000030h] 21_2_032CD380
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03221B8F mov eax, dword ptr fs:[00000030h] 21_2_03221B8F
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03221B8F mov eax, dword ptr fs:[00000030h] 21_2_03221B8F
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03242397 mov eax, dword ptr fs:[00000030h] 21_2_03242397
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324B390 mov eax, dword ptr fs:[00000030h] 21_2_0324B390
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032403E2 mov eax, dword ptr fs:[00000030h] 21_2_032403E2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032403E2 mov eax, dword ptr fs:[00000030h] 21_2_032403E2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032403E2 mov eax, dword ptr fs:[00000030h] 21_2_032403E2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032403E2 mov eax, dword ptr fs:[00000030h] 21_2_032403E2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032403E2 mov eax, dword ptr fs:[00000030h] 21_2_032403E2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032403E2 mov eax, dword ptr fs:[00000030h] 21_2_032403E2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323DBE9 mov eax, dword ptr fs:[00000030h] 21_2_0323DBE9
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032953CA mov eax, dword ptr fs:[00000030h] 21_2_032953CA
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032953CA mov eax, dword ptr fs:[00000030h] 21_2_032953CA
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03254A2C mov eax, dword ptr fs:[00000030h] 21_2_03254A2C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03254A2C mov eax, dword ptr fs:[00000030h] 21_2_03254A2C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h] 21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h] 21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h] 21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h] 21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h] 21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h] 21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h] 21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h] 21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h] 21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03228A0A mov eax, dword ptr fs:[00000030h] 21_2_03228A0A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03215210 mov eax, dword ptr fs:[00000030h] 21_2_03215210
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03215210 mov ecx, dword ptr fs:[00000030h] 21_2_03215210
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03215210 mov eax, dword ptr fs:[00000030h] 21_2_03215210
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03215210 mov eax, dword ptr fs:[00000030h] 21_2_03215210
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321AA16 mov eax, dword ptr fs:[00000030h] 21_2_0321AA16
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321AA16 mov eax, dword ptr fs:[00000030h] 21_2_0321AA16
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032DAA16 mov eax, dword ptr fs:[00000030h] 21_2_032DAA16
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032DAA16 mov eax, dword ptr fs:[00000030h] 21_2_032DAA16
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03233A1C mov eax, dword ptr fs:[00000030h] 21_2_03233A1C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032CB260 mov eax, dword ptr fs:[00000030h] 21_2_032CB260
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032CB260 mov eax, dword ptr fs:[00000030h] 21_2_032CB260
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E8A62 mov eax, dword ptr fs:[00000030h] 21_2_032E8A62
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0325927A mov eax, dword ptr fs:[00000030h] 21_2_0325927A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03219240 mov eax, dword ptr fs:[00000030h] 21_2_03219240
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03219240 mov eax, dword ptr fs:[00000030h] 21_2_03219240
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03219240 mov eax, dword ptr fs:[00000030h] 21_2_03219240
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03219240 mov eax, dword ptr fs:[00000030h] 21_2_03219240
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032DEA55 mov eax, dword ptr fs:[00000030h] 21_2_032DEA55
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032A4257 mov eax, dword ptr fs:[00000030h] 21_2_032A4257
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032152A5 mov eax, dword ptr fs:[00000030h] 21_2_032152A5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032152A5 mov eax, dword ptr fs:[00000030h] 21_2_032152A5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032152A5 mov eax, dword ptr fs:[00000030h] 21_2_032152A5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032152A5 mov eax, dword ptr fs:[00000030h] 21_2_032152A5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032152A5 mov eax, dword ptr fs:[00000030h] 21_2_032152A5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0322AAB0 mov eax, dword ptr fs:[00000030h] 21_2_0322AAB0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0322AAB0 mov eax, dword ptr fs:[00000030h] 21_2_0322AAB0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324FAB0 mov eax, dword ptr fs:[00000030h] 21_2_0324FAB0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324D294 mov eax, dword ptr fs:[00000030h] 21_2_0324D294
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324D294 mov eax, dword ptr fs:[00000030h] 21_2_0324D294
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03242AE4 mov eax, dword ptr fs:[00000030h] 21_2_03242AE4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03242ACB mov eax, dword ptr fs:[00000030h] 21_2_03242ACB
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03234120 mov eax, dword ptr fs:[00000030h] 21_2_03234120
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03234120 mov eax, dword ptr fs:[00000030h] 21_2_03234120
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03234120 mov eax, dword ptr fs:[00000030h] 21_2_03234120
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03234120 mov eax, dword ptr fs:[00000030h] 21_2_03234120
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03234120 mov ecx, dword ptr fs:[00000030h] 21_2_03234120
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324513A mov eax, dword ptr fs:[00000030h] 21_2_0324513A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324513A mov eax, dword ptr fs:[00000030h] 21_2_0324513A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03219100 mov eax, dword ptr fs:[00000030h] 21_2_03219100
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03219100 mov eax, dword ptr fs:[00000030h] 21_2_03219100
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03219100 mov eax, dword ptr fs:[00000030h] 21_2_03219100
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321C962 mov eax, dword ptr fs:[00000030h] 21_2_0321C962
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321B171 mov eax, dword ptr fs:[00000030h] 21_2_0321B171
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321B171 mov eax, dword ptr fs:[00000030h] 21_2_0321B171
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323B944 mov eax, dword ptr fs:[00000030h] 21_2_0323B944
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323B944 mov eax, dword ptr fs:[00000030h] 21_2_0323B944
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032461A0 mov eax, dword ptr fs:[00000030h] 21_2_032461A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032461A0 mov eax, dword ptr fs:[00000030h] 21_2_032461A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032D49A4 mov eax, dword ptr fs:[00000030h] 21_2_032D49A4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032D49A4 mov eax, dword ptr fs:[00000030h] 21_2_032D49A4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032D49A4 mov eax, dword ptr fs:[00000030h] 21_2_032D49A4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032D49A4 mov eax, dword ptr fs:[00000030h] 21_2_032D49A4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032969A6 mov eax, dword ptr fs:[00000030h] 21_2_032969A6
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032951BE mov eax, dword ptr fs:[00000030h] 21_2_032951BE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032951BE mov eax, dword ptr fs:[00000030h] 21_2_032951BE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032951BE mov eax, dword ptr fs:[00000030h] 21_2_032951BE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032951BE mov eax, dword ptr fs:[00000030h] 21_2_032951BE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h] 21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h] 21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032399BF mov eax, dword ptr fs:[00000030h] 21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h] 21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h] 21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032399BF mov eax, dword ptr fs:[00000030h] 21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h] 21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h] 21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032399BF mov eax, dword ptr fs:[00000030h] 21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h] 21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h] 21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032399BF mov eax, dword ptr fs:[00000030h] 21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323C182 mov eax, dword ptr fs:[00000030h] 21_2_0323C182
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324A185 mov eax, dword ptr fs:[00000030h] 21_2_0324A185
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03242990 mov eax, dword ptr fs:[00000030h] 21_2_03242990
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321B1E1 mov eax, dword ptr fs:[00000030h] 21_2_0321B1E1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321B1E1 mov eax, dword ptr fs:[00000030h] 21_2_0321B1E1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321B1E1 mov eax, dword ptr fs:[00000030h] 21_2_0321B1E1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032A41E8 mov eax, dword ptr fs:[00000030h] 21_2_032A41E8
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0322B02A mov eax, dword ptr fs:[00000030h] 21_2_0322B02A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0322B02A mov eax, dword ptr fs:[00000030h] 21_2_0322B02A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0322B02A mov eax, dword ptr fs:[00000030h] 21_2_0322B02A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0322B02A mov eax, dword ptr fs:[00000030h] 21_2_0322B02A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324002D mov eax, dword ptr fs:[00000030h] 21_2_0324002D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324002D mov eax, dword ptr fs:[00000030h] 21_2_0324002D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324002D mov eax, dword ptr fs:[00000030h] 21_2_0324002D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324002D mov eax, dword ptr fs:[00000030h] 21_2_0324002D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324002D mov eax, dword ptr fs:[00000030h] 21_2_0324002D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323A830 mov eax, dword ptr fs:[00000030h] 21_2_0323A830
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323A830 mov eax, dword ptr fs:[00000030h] 21_2_0323A830
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323A830 mov eax, dword ptr fs:[00000030h] 21_2_0323A830
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323A830 mov eax, dword ptr fs:[00000030h] 21_2_0323A830
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E4015 mov eax, dword ptr fs:[00000030h] 21_2_032E4015
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E4015 mov eax, dword ptr fs:[00000030h] 21_2_032E4015
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03297016 mov eax, dword ptr fs:[00000030h] 21_2_03297016
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03297016 mov eax, dword ptr fs:[00000030h] 21_2_03297016
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03297016 mov eax, dword ptr fs:[00000030h] 21_2_03297016
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E1074 mov eax, dword ptr fs:[00000030h] 21_2_032E1074
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032D2073 mov eax, dword ptr fs:[00000030h] 21_2_032D2073
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03230050 mov eax, dword ptr fs:[00000030h] 21_2_03230050
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03230050 mov eax, dword ptr fs:[00000030h] 21_2_03230050
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032420A0 mov eax, dword ptr fs:[00000030h] 21_2_032420A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032420A0 mov eax, dword ptr fs:[00000030h] 21_2_032420A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032420A0 mov eax, dword ptr fs:[00000030h] 21_2_032420A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032420A0 mov eax, dword ptr fs:[00000030h] 21_2_032420A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032420A0 mov eax, dword ptr fs:[00000030h] 21_2_032420A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032420A0 mov eax, dword ptr fs:[00000030h] 21_2_032420A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032590AF mov eax, dword ptr fs:[00000030h] 21_2_032590AF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324F0BF mov ecx, dword ptr fs:[00000030h] 21_2_0324F0BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324F0BF mov eax, dword ptr fs:[00000030h] 21_2_0324F0BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324F0BF mov eax, dword ptr fs:[00000030h] 21_2_0324F0BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03219080 mov eax, dword ptr fs:[00000030h] 21_2_03219080
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03293884 mov eax, dword ptr fs:[00000030h] 21_2_03293884
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03293884 mov eax, dword ptr fs:[00000030h] 21_2_03293884
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032140E1 mov eax, dword ptr fs:[00000030h] 21_2_032140E1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032140E1 mov eax, dword ptr fs:[00000030h] 21_2_032140E1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032140E1 mov eax, dword ptr fs:[00000030h] 21_2_032140E1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323B8E4 mov eax, dword ptr fs:[00000030h] 21_2_0323B8E4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323B8E4 mov eax, dword ptr fs:[00000030h] 21_2_0323B8E4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032158EC mov eax, dword ptr fs:[00000030h] 21_2_032158EC
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032AB8D0 mov eax, dword ptr fs:[00000030h] 21_2_032AB8D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032AB8D0 mov ecx, dword ptr fs:[00000030h] 21_2_032AB8D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032AB8D0 mov eax, dword ptr fs:[00000030h] 21_2_032AB8D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032AB8D0 mov eax, dword ptr fs:[00000030h] 21_2_032AB8D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032AB8D0 mov eax, dword ptr fs:[00000030h] 21_2_032AB8D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032AB8D0 mov eax, dword ptr fs:[00000030h] 21_2_032AB8D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03214F2E mov eax, dword ptr fs:[00000030h] 21_2_03214F2E
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03214F2E mov eax, dword ptr fs:[00000030h] 21_2_03214F2E
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324E730 mov eax, dword ptr fs:[00000030h] 21_2_0324E730
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323B73D mov eax, dword ptr fs:[00000030h] 21_2_0323B73D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323B73D mov eax, dword ptr fs:[00000030h] 21_2_0323B73D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E070D mov eax, dword ptr fs:[00000030h] 21_2_032E070D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E070D mov eax, dword ptr fs:[00000030h] 21_2_032E070D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324A70E mov eax, dword ptr fs:[00000030h] 21_2_0324A70E
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324A70E mov eax, dword ptr fs:[00000030h] 21_2_0324A70E
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323F716 mov eax, dword ptr fs:[00000030h] 21_2_0323F716
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032AFF10 mov eax, dword ptr fs:[00000030h] 21_2_032AFF10
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032AFF10 mov eax, dword ptr fs:[00000030h] 21_2_032AFF10
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0322FF60 mov eax, dword ptr fs:[00000030h] 21_2_0322FF60
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E8F6A mov eax, dword ptr fs:[00000030h] 21_2_032E8F6A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0322EF40 mov eax, dword ptr fs:[00000030h] 21_2_0322EF40
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03228794 mov eax, dword ptr fs:[00000030h] 21_2_03228794
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03297794 mov eax, dword ptr fs:[00000030h] 21_2_03297794
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03297794 mov eax, dword ptr fs:[00000030h] 21_2_03297794
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03297794 mov eax, dword ptr fs:[00000030h] 21_2_03297794
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032537F5 mov eax, dword ptr fs:[00000030h] 21_2_032537F5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321E620 mov eax, dword ptr fs:[00000030h] 21_2_0321E620
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032CFE3F mov eax, dword ptr fs:[00000030h] 21_2_032CFE3F
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321C600 mov eax, dword ptr fs:[00000030h] 21_2_0321C600
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321C600 mov eax, dword ptr fs:[00000030h] 21_2_0321C600
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0321C600 mov eax, dword ptr fs:[00000030h] 21_2_0321C600
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03248E00 mov eax, dword ptr fs:[00000030h] 21_2_03248E00
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032D1608 mov eax, dword ptr fs:[00000030h] 21_2_032D1608
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324A61C mov eax, dword ptr fs:[00000030h] 21_2_0324A61C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0324A61C mov eax, dword ptr fs:[00000030h] 21_2_0324A61C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0322766D mov eax, dword ptr fs:[00000030h] 21_2_0322766D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323AE73 mov eax, dword ptr fs:[00000030h] 21_2_0323AE73
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323AE73 mov eax, dword ptr fs:[00000030h] 21_2_0323AE73
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323AE73 mov eax, dword ptr fs:[00000030h] 21_2_0323AE73
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323AE73 mov eax, dword ptr fs:[00000030h] 21_2_0323AE73
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_0323AE73 mov eax, dword ptr fs:[00000030h] 21_2_0323AE73
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03227E41 mov eax, dword ptr fs:[00000030h] 21_2_03227E41
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03227E41 mov eax, dword ptr fs:[00000030h] 21_2_03227E41
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03227E41 mov eax, dword ptr fs:[00000030h] 21_2_03227E41
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03227E41 mov eax, dword ptr fs:[00000030h] 21_2_03227E41
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03227E41 mov eax, dword ptr fs:[00000030h] 21_2_03227E41
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03227E41 mov eax, dword ptr fs:[00000030h] 21_2_03227E41
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032DAE44 mov eax, dword ptr fs:[00000030h] 21_2_032DAE44
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032DAE44 mov eax, dword ptr fs:[00000030h] 21_2_032DAE44
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E0EA5 mov eax, dword ptr fs:[00000030h] 21_2_032E0EA5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E0EA5 mov eax, dword ptr fs:[00000030h] 21_2_032E0EA5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032E0EA5 mov eax, dword ptr fs:[00000030h] 21_2_032E0EA5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032946A7 mov eax, dword ptr fs:[00000030h] 21_2_032946A7
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032AFE87 mov eax, dword ptr fs:[00000030h] 21_2_032AFE87
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032276E2 mov eax, dword ptr fs:[00000030h] 21_2_032276E2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032416E0 mov ecx, dword ptr fs:[00000030h] 21_2_032416E0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_03258EC7 mov eax, dword ptr fs:[00000030h] 21_2_03258EC7
Source: C:\Windows\SysWOW64\cmd.exe Code function: 21_2_032436CC mov eax, dword ptr fs:[00000030h] 21_2_032436CC
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Code function: 8_2_01769910 NtAdjustPrivilegesToken,LdrInitializeThunk, 8_2_01769910
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Section unmapped: C:\Windows\SysWOW64\cmd.exe base address: 1190000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: unknown target: unknown protection: read write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Thread register set: target process: 3616 Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Thread register set: target process: 3616 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Thread register set: target process: 3616 Jump to behavior
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wKwiksScXFp.exe
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wKwiksScXFp.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wKwiksScXFp.exe Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wKwiksScXFp" /XML "C:\Users\user\AppData\Local\Temp\tmpFDE9.tmp Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Process created: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Jump to behavior
Source: explorer.exe, 0000000B.00000000.417289152.0000000005610000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.313851535.0000000005E60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.356358687.0000000005E60000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000B.00000000.346570335.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.370474867.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.402705506.00000000005C8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000B.00000000.347464851.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.403524936.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.288246090.0000000000B50000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager,
Source: explorer.exe, 0000000B.00000000.347464851.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.403524936.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.288246090.0000000000B50000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 680488 Sample: SwiftMessage_Unlocked_Trans... Startdate: 08/08/2022 Architecture: WINDOWS Score: 100 36 Malicious sample detected (through community Yara rule) 2->36 38 Antivirus detection for URL or domain 2->38 40 Multi AV Scanner detection for dropped file 2->40 42 9 other signatures 2->42 8 SwiftMessage_Unlocked_Transaction ProofMessage.exe 7 2->8         started        process3 file4 28 C:\Users\user\AppData\...\wKwiksScXFp.exe, PE32 8->28 dropped 30 C:\Users\...\wKwiksScXFp.exe:Zone.Identifier, ASCII 8->30 dropped 32 C:\Users\user\AppData\Local\...\tmpFDE9.tmp, XML 8->32 dropped 34 SwiftMessage_Unloc...roofMessage.exe.log, ASCII 8->34 dropped 44 Adds a directory exclusion to Windows Defender 8->44 12 SwiftMessage_Unlocked_Transaction ProofMessage.exe 8->12         started        15 powershell.exe 25 8->15         started        17 schtasks.exe 1 8->17         started        signatures5 process6 signatures7 50 Modifies the context of a thread in another process (thread injection) 12->50 52 Maps a DLL or memory area into another process 12->52 54 Sample uses process hollowing technique 12->54 56 Queues an APC in another process (thread injection) 12->56 19 explorer.exe 9 12->19 injected 21 conhost.exe 15->21         started        23 conhost.exe 17->23         started        process8 process9 25 cmd.exe 19->25         started        signatures10 46 Modifies the context of a thread in another process (thread injection) 25->46 48 Maps a DLL or memory area into another process 25->48
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.familism.net/qaom/ true
  • 2%, Virustotal, Browse
  • Avira URL Cloud: malware
 low