Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SWIFT TRANSFER.exe

Overview

General Information

Sample Name:SWIFT TRANSFER.exe
Analysis ID:680490
MD5:735ee862055fcbcc574b73b1695af599
SHA1:a4438d8649da60b9ed19aa5d98962dc1de1efa3a
SHA256:b496205d5045c9c9f9407bfca6a4c9088218560c2884fd737c8efe76352ae3ca
Tags:agentteslaexe
Infos:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Yara detected AntiVM3
Snort IDS alert for network traffic
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Modifies the hosts file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
One or more processes crash
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Yara detected Credential Stealer
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • SWIFT TRANSFER.exe (PID: 5952 cmdline: "C:\Users\user\Desktop\SWIFT TRANSFER.exe" MD5: 735EE862055FCBCC574B73B1695AF599)
    • SWIFT TRANSFER.exe (PID: 5752 cmdline: C:\Users\user\Desktop\SWIFT TRANSFER.exe MD5: 735EE862055FCBCC574B73B1695AF599)
      • WerFault.exe (PID: 1228 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1700 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "marketing9@activandalucia.com", "Password": "iyke123456789@$", "Host": "mail.activandalucia.com"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.271754334.0000000002B22000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
    00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
        00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_AgentTesla_d3ac2b2funknownunknown
        • 0x304fe:$a13: get_DnsResolver
        • 0x2ecef:$a20: get_LastAccessed
        • 0x30e7c:$a27: set_InternalServerPort
        • 0x311a1:$a30: set_GuidMasterKey
        • 0x2edf6:$a33: get_Clipboard
        • 0x2ee04:$a34: get_Keyboard
        • 0x30119:$a35: get_ShiftKeyDown
        • 0x3012a:$a36: get_AltKeyDown
        • 0x2ee11:$a37: get_Password
        • 0x2f8b5:$a38: get_PasswordHash
        • 0x308fe:$a39: get_DefaultCredentials
        00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
          Click to see the 11 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          4.0.SWIFT TRANSFER.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            4.0.SWIFT TRANSFER.exe.400000.0.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
              4.0.SWIFT TRANSFER.exe.400000.0.unpackMALWARE_Win_AgentTeslaV3AgentTeslaV3 infostealer payloadditekSHen
              • 0x32fce:$s10: logins
              • 0x32a35:$s11: credential
              • 0x2eff6:$g1: get_Clipboard
              • 0x2f004:$g2: get_Keyboard
              • 0x2f011:$g3: get_Password
              • 0x30309:$g4: get_CtrlKeyDown
              • 0x30319:$g5: get_ShiftKeyDown
              • 0x3032a:$g6: get_AltKeyDown
              4.0.SWIFT TRANSFER.exe.400000.0.unpackWindows_Trojan_AgentTesla_d3ac2b2funknownunknown
              • 0x306fe:$a13: get_DnsResolver
              • 0x2eeef:$a20: get_LastAccessed
              • 0x3107c:$a27: set_InternalServerPort
              • 0x313a1:$a30: set_GuidMasterKey
              • 0x2eff6:$a33: get_Clipboard
              • 0x2f004:$a34: get_Keyboard
              • 0x30319:$a35: get_ShiftKeyDown
              • 0x3032a:$a36: get_AltKeyDown
              • 0x2f011:$a37: get_Password
              • 0x2fab5:$a38: get_PasswordHash
              • 0x30afe:$a39: get_DefaultCredentials
              0.2.SWIFT TRANSFER.exe.3a04e80.6.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                Click to see the 22 entries

                Sigma Signatures

                ⊘No Sigma rule has matched

                Snort Signatures

                Timestamp:192.168.2.3185.162.171.75497445872851779 08/08/22-17:36:37.122597
                SID:2851779
                Source Port:49744
                Destination Port:587
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.3185.162.171.75497445872030171 08/08/22-17:36:37.122505
                SID:2030171
                Source Port:49744
                Destination Port:587
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.3185.162.171.75497445872840032 08/08/22-17:36:37.122597
                SID:2840032
                Source Port:49744
                Destination Port:587
                Protocol:TCP
                Classtype:A Network Trojan was detected

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for submitted file
                Source: SWIFT TRANSFER.exeReversingLabs: Detection: 37%
                Machine Learning detection for sample
                Source: SWIFT TRANSFER.exeJoe Sandbox ML: detected
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "marketing9@activandalucia.com", "Password": "iyke123456789@$", "Host": "mail.activandalucia.com"}
                Source: SWIFT TRANSFER.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: SWIFT TRANSFER.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: Binary string: System.Core.ni.pdbRSDSD source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\symbols\dll\System.pdb( source: SWIFT TRANSFER.exe, 00000004.00000000.304103446.000000000129B000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Xml.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: SWIFT TRANSFER.PDB source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: C:\Windows\System.pdbpdbtem.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.304259363.00000000012AD000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.pdb|M source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Management.pdb8 source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: i,C:\Windows\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: C:\Users\user\Desktop\SWIFT TRANSFER.PDB source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: System.Configuration.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: .pdb) source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\dll\System.pdbE source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: mscorlib.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Configuration.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000002.329259032.0000000001280000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.310573186.0000000001280000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Xml.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: CustomMarshalers.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.304259363.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Core.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: Microsoft.VisualBasic.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Users\user\Desktop\SWIFT TRANSFER.PDBay- source: SWIFT TRANSFER.exe, 00000004.00000000.303998535.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000002.329297686.0000000001297000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Windows.Forms.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\dll\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: mscorlib.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Management.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: mscorlib.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Core.pdb| source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Core.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Configuration.ni.pdbRSDSO* source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: CustomMarshalers.pdbCA source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Xml.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.ni.pdb source: WERBDDB.tmp.dmp.15.dr

                Networking

                barindex
                Snort IDS alert for network traffic
                Source: TrafficSnort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49744 -> 185.162.171.75:587
                Source: TrafficSnort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.3:49744 -> 185.162.171.75:587
                Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49744 -> 185.162.171.75:587
                Source: Joe Sandbox ViewASN Name: ASN-XTUDIONETES ASN-XTUDIONETES
                Source: Joe Sandbox ViewIP Address: 185.162.171.75 185.162.171.75
                Source: global trafficTCP traffic: 192.168.2.3:49744 -> 185.162.171.75:587
                Source: global trafficTCP traffic: 192.168.2.3:49744 -> 185.162.171.75:587
                Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://DynDns.comDynDNSnamejidPsi/Psi
                Source: SWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.307429408.00000000031D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://TWzBs3cIiDHX5nVtjxF.com
                Source: SWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://activandalucia.com
                Source: SWIFT TRANSFER.exe, 00000000.00000003.247217501.00000000057B6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://en.w
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
                Source: SWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mail.activandalucia.com
                Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ohMkNy.com
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com6
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comFN
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comFc
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.coma
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comalsa
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comalsd
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comd
                Source: SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.come.com
                Source: SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.268803149.00000000057B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.coml1
                Source: SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.como
                Source: SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.como$
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                Source: SWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cF
                Source: SWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248581922.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                Source: SWIFT TRANSFER.exe, 00000000.00000003.248500769.00000000057B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cncro
                Source: SWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cns-e
                Source: SWIFT TRANSFER.exe, 00000000.00000003.248500769.00000000057B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cnz
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                Source: SWIFT TRANSFER.exe, 00000000.00000003.255063791.00000000057E8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/U
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/$
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp//$
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/6
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/=
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/N
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/P
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/c
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/j
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/G
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/u
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/u
                Source: SWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249845353.00000000057CB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                Source: SWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249845353.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247410435.00000000057CB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com#
                Source: SWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247035784.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247060632.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.come
                Source: SWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247035784.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247060632.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comt
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org%
                Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org%facebooktwittergmailinstagrammovieskypepornhackwhatsappdiscordemailpassword%st
                Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
                Source: unknownDNS traffic detected: queries for: mail.activandalucia.com
                Source: SWIFT TRANSFER.exe, 00000000.00000002.269297304.0000000000C8A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

                Spam, unwanted Advertisements and Ransom Demands

                barindex
                Modifies the hosts file
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTRMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTRMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: SWIFT TRANSFER.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTRMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTRMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1700
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeCode function: 0_2_04CFCD040_2_04CFCD04
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeCode function: 0_2_04CFF0D00_2_04CFF0D0
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeCode function: 0_2_05299BB00_2_05299BB0
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeCode function: 0_2_05299B9F0_2_05299B9F
                Source: SWIFT TRANSFER.exe, 00000000.00000002.285789862.00000000070B0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameDoncepre.dll@ vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000000.243752092.00000000004E2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameSoapParameterAttrib.exeB vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamereaJZGgUbbSPEfasvVHwwYdgRFCEEO.exe4 vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDoncepre.dll@ vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.270431587.000000000293B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWebName.dll4 vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000003.259589583.0000000000D19000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameKeysNormalize.dll4 vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.269297304.0000000000C8A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.285119359.0000000006EE0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameKeysNormalize.dll4 vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamereaJZGgUbbSPEfasvVHwwYdgRFCEEO.exe4 vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.285393726.0000000006F40000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameWebName.dll4 vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000004.00000000.303386378.00000000011FA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000004.00000000.267496263.0000000000438000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: OriginalFilenamereaJZGgUbbSPEfasvVHwwYdgRFCEEO.exe4 vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exeBinary or memory string: OriginalFilenameSoapParameterAttrib.exeB vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: SWIFT TRANSFER.exeReversingLabs: Detection: 37%
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile read: C:\Users\user\Desktop\SWIFT TRANSFER.exeJump to behavior
                Source: SWIFT TRANSFER.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: unknownProcess created: C:\Users\user\Desktop\SWIFT TRANSFER.exe "C:\Users\user\Desktop\SWIFT TRANSFER.exe"
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess created: C:\Users\user\Desktop\SWIFT TRANSFER.exe C:\Users\user\Desktop\SWIFT TRANSFER.exe
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1700
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess created: C:\Users\user\Desktop\SWIFT TRANSFER.exe C:\Users\user\Desktop\SWIFT TRANSFER.exeJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SWIFT TRANSFER.exe.logJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERBDDB.tmpJump to behavior
                Source: classification engineClassification label: mal100.troj.adwa.spyw.evad.winEXE@4/6@2/1
                Source: SWIFT TRANSFER.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5752
                Source: SWIFT TRANSFER.exe, ProcExpGUI/Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                Source: 0.0.SWIFT TRANSFER.exe.4e0000.0.unpack, ProcExpGUI/Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                Source: SWIFT TRANSFER.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                Source: SWIFT TRANSFER.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: Binary string: System.Core.ni.pdbRSDSD source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\symbols\dll\System.pdb( source: SWIFT TRANSFER.exe, 00000004.00000000.304103446.000000000129B000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Xml.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: SWIFT TRANSFER.PDB source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: C:\Windows\System.pdbpdbtem.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.304259363.00000000012AD000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.pdb|M source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Management.pdb8 source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: i,C:\Windows\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: C:\Users\user\Desktop\SWIFT TRANSFER.PDB source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: System.Configuration.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: .pdb) source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\dll\System.pdbE source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: mscorlib.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Configuration.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000002.329259032.0000000001280000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.310573186.0000000001280000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Xml.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: CustomMarshalers.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.304259363.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Core.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: Microsoft.VisualBasic.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Users\user\Desktop\SWIFT TRANSFER.PDBay- source: SWIFT TRANSFER.exe, 00000004.00000000.303998535.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000002.329297686.0000000001297000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Windows.Forms.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\dll\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: mscorlib.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Management.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: mscorlib.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Core.pdb| source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Core.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Configuration.ni.pdbRSDSO* source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: CustomMarshalers.pdbCA source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Xml.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.ni.pdb source: WERBDDB.tmp.dmp.15.dr

                Data Obfuscation

                barindex
                .NET source code contains potential unpacker
                Source: SWIFT TRANSFER.exe, ProcExpGUI/Form1.cs.Net Code: WaitHandle System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                Source: 0.0.SWIFT TRANSFER.exe.4e0000.0.unpack, ProcExpGUI/Form1.cs.Net Code: WaitHandle System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeCode function: 0_2_0529AC38 push eax; ret 0_2_0529AC39
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeCode function: 0_2_0529AC90 pushfd ; ret 0_2_0529AC91
                Source: initial sampleStatic PE information: section name: .text entropy: 7.792812997909333
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Yara detected AntiVM3
                Source: Yara matchFile source: 00000000.00000002.271754334.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTR
                Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                Source: SWIFT TRANSFER.exe, 00000000.00000002.271754334.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
                Source: SWIFT TRANSFER.exe, 00000000.00000002.271754334.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
                Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe TID: 6028Thread sleep time: -45877s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe TID: 5888Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe TID: 5364Thread sleep time: -3689348814741908s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe TID: 1008Thread sleep count: 9589 > 30Jump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeWindow / User API: threadDelayed 9589Jump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeThread delayed: delay time: 45877Jump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
                Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
                Source: SWIFT TRANSFER.exe, 00000004.00000000.304103446.000000000129B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess queried: DebugPortJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess queried: DebugPortJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeMemory allocated: page read and write | page guardJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Modifies the hosts file
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Injects a PE file into a foreign processes
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeMemory written: C:\Users\user\Desktop\SWIFT TRANSFER.exe base: 400000 value starts with: 4D5AJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess created: C:\Users\user\Desktop\SWIFT TRANSFER.exe C:\Users\user\Desktop\SWIFT TRANSFER.exeJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Users\user\Desktop\SWIFT TRANSFER.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Users\user\Desktop\SWIFT TRANSFER.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Lowering of HIPS / PFW / Operating System Security Settings

                barindex
                Modifies the hosts file
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected AgentTesla
                Source: Yara matchFile source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTR
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
                Tries to harvest and steal ftp login credentials
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\Jump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: Yara matchFile source: 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTR

                Remote Access Functionality

                barindex
                Yara detected AgentTesla
                Source: Yara matchFile source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTR

                Mitre Att&ck Matrix

                Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                Valid Accounts211
                Windows Management Instrumentation                		Path Interception111
                Process Injection                		1
                Masquerading                		2
                OS Credential Dumping                		221
                Security Software Discovery                		Remote Services1
                Email Collection                		Exfiltration Over Other Network Medium1
                Encrypted Channel                		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
                File and Directory Permissions Modification                		1
                Input Capture                		1
                Process Discovery                		Remote Desktop Protocol1
                Input Capture                		Exfiltration Over Bluetooth1
                Non-Standard Port                		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)1
                Disable or Modify Tools                		1
                Credentials in Registry                		141
                Virtualization/Sandbox Evasion                		SMB/Windows Admin Shares11
                Archive Collected Data                		Automated Exfiltration1
                Non-Application Layer Protocol                		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)141
                Virtualization/Sandbox Evasion                		NTDS1
                Application Window Discovery                		Distributed Component Object Model2
                Data from Local System                		Scheduled Transfer11
                Application Layer Protocol                		SIM Card SwapCarrier Billing Fraud
                Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script111
                Process Injection                		LSA Secrets1
                Remote System Discovery                		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                Replication Through Removable MediaLaunchdRc.commonRc.common1
                Deobfuscate/Decode Files or Information                		Cached Domain Credentials114
                System Information Discovery                		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                External Remote ServicesScheduled TaskStartup ItemsStartup Items2
                Obfuscated Files or Information                		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job12
                Software Packing                		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                SWIFT TRANSFER.exe38%ReversingLabsByteCode-MSIL.Trojan.AgentTesla
                SWIFT TRANSFER.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                SourceDetectionScannerLabelLinkDownload
                4.0.SWIFT TRANSFER.exe.400000.0.unpack100%AviraHEUR/AGEN.1203035Download File

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.fontbureau.comalsa0%URL Reputationsafe
                http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                http://www.founder.com.cn/cncro0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/jp/G0%URL Reputationsafe
                http://www.tiro.com0%URL Reputationsafe
                http://www.founder.com.cF0%Avira URL Cloudsafe
                http://www.goodfont.co.kr0%URL Reputationsafe
                http://www.fontbureau.comFN0%Avira URL Cloudsafe
                http://www.fontbureau.coml10%URL Reputationsafe
                http://www.sajatypeworks.com0%URL Reputationsafe
                http://www.typography.netD0%URL Reputationsafe
                http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                http://fontfabrik.com0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/60%URL Reputationsafe
                http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                http://www.fontbureau.com60%Avira URL Cloudsafe
                http://www.sandoll.co.kr0%URL Reputationsafe
                http://www.urwpp.deDPlease0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/$0%URL Reputationsafe
                http://www.zhongyicts.com.cn0%URL Reputationsafe
                http://www.sajatypeworks.come0%URL Reputationsafe
                http://www.sakkal.com0%URL Reputationsafe
                https://api.ipify.org%0%URL Reputationsafe
                http://www.fontbureau.comalsd0%URL Reputationsafe
                http://www.sajatypeworks.comt0%URL Reputationsafe
                http://www.galapagosdesign.com/U0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/P0%URL Reputationsafe
                http://www.fontbureau.como$0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/N0%URL Reputationsafe
                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www0%URL Reputationsafe
                http://mail.activandalucia.com0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp//$0%Avira URL Cloudsafe
                http://www.founder.com.cn/cnz0%URL Reputationsafe
                http://TWzBs3cIiDHX5nVtjxF.com0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/jp/u0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                http://www.fontbureau.coma0%URL Reputationsafe
                http://www.fontbureau.comd0%URL Reputationsafe
                http://www.fontbureau.come.com0%URL Reputationsafe
                http://en.w0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/=0%URL Reputationsafe
                http://www.carterandcone.coml0%URL Reputationsafe
                http://activandalucia.com0%Avira URL Cloudsafe
                http://www.founder.com.cn/cn0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/u0%URL Reputationsafe
                http://DynDns.comDynDNSnamejidPsi/Psi0%Avira URL Cloudsafe
                http://ohMkNy.com0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                http://www.fontbureau.como0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/j0%URL Reputationsafe
                http://www.fontbureau.comFc0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/c0%URL Reputationsafe
                http://www.sajatypeworks.com#0%Avira URL Cloudsafe
                https://api.ipify.org%facebooktwittergmailinstagrammovieskypepornhackwhatsappdiscordemailpassword%st0%Avira URL Cloudsafe
                http://www.founder.com.cn/cns-e0%URL Reputationsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                activandalucia.com
                		185.162.171.75
                		truetrue
                  		unknown
                  mail.activandalucia.com
                  		unknown
                  		unknowntrue
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://www.fontbureau.comalsaSWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://127.0.0.1:HTTP/1.1SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		low
                    http://www.fontbureau.com/designersGSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      http://www.fontbureau.com/designers/?SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://www.founder.com.cn/cn/bTheSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.founder.com.cn/cncroSWIFT TRANSFER.exe, 00000000.00000003.248500769.00000000057B7000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.jiyu-kobo.co.jp/jp/GSWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designers?SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://www.tiro.comSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.founder.com.cFSWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.fontbureau.com/designersSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.goodfont.co.krSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.comFNSWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.coml1SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.268803149.00000000057B0000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.sajatypeworks.comSWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249845353.00000000057CB000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.typography.netDSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.founder.com.cn/cn/cTheSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.galapagosdesign.com/staff/dennis.htmSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://fontfabrik.comSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/6SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.galapagosdesign.com/DPleaseSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.com6SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fonts.comSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://www.sandoll.co.krSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.urwpp.deDPleaseSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/$SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.zhongyicts.com.cnSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.sajatypeworks.comeSWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247035784.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247060632.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.sakkal.comSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              https://api.ipify.org%SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		low
                              http://www.fontbureau.comalsdSWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.apache.org/licenses/LICENSE-2.0SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://www.fontbureau.comSWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.sajatypeworks.comtSWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247035784.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247060632.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.galapagosdesign.com/USWIFT TRANSFER.exe, 00000000.00000003.255063791.00000000057E8000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/PSWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.como$SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		low
                                  http://www.jiyu-kobo.co.jp/NSWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://wwwSWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://mail.activandalucia.comSWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp//$SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.founder.com.cn/cnzSWIFT TRANSFER.exe, 00000000.00000003.248500769.00000000057B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://TWzBs3cIiDHX5nVtjxF.comSWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.307429408.00000000031D7000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/jp/uSWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/jp/SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.comaSWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.comdSWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.come.comSWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://en.wSWIFT TRANSFER.exe, 00000000.00000003.247217501.00000000057B6000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/=SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.carterandcone.comlSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://activandalucia.comSWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.fontbureau.com/designers/cabarga.htmlNSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.founder.com.cn/cnSWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248581922.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.com/designers/frere-jones.htmlSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.jiyu-kobo.co.jp/uSWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://DynDns.comDynDNSnamejidPsi/PsiSWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://ohMkNy.comSWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.jiyu-kobo.co.jp/SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.comoSWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com/designers8SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.jiyu-kobo.co.jp/jSWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.fontbureau.comFcSWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.jiyu-kobo.co.jp/cSWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.sajatypeworks.com#SWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249845353.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247410435.00000000057CB000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://api.ipify.org%facebooktwittergmailinstagrammovieskypepornhackwhatsappdiscordemailpassword%stSWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		low
                                        http://www.founder.com.cn/cns-eSWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown

                                        World Map of Contacted IPs

                                        • No. of IPs < 25%
                                        • 25% < No. of IPs < 50%
                                        • 50% < No. of IPs < 75%
                                        • 75% < No. of IPs

                                        Public IPs

                                        IPDomainCountryFlagASNASN NameMalicious
                                        185.162.171.75
                                        		activandalucia.comSpain
                                        		60458ASN-XTUDIONETEStrue

                                        General Information

                                        Joe Sandbox Version:35.0.0 Citrine
                                        Analysis ID:680490
                                        Start date and time: 08/08/202217:35:082022-08-08 17:35:08 +02:00
                                        Joe Sandbox Product:CloudBasic
                                        Overall analysis duration:0h 6m 59s
                                        Hypervisor based Inspection enabled:false
                                        Report type:full
                                        Sample file name:SWIFT TRANSFER.exe
                                        Cookbook file name:default.jbs
                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                        Number of analysed new started processes analysed:29
                                        Number of new started drivers analysed:0
                                        Number of existing processes analysed:0
                                        Number of existing drivers analysed:0
                                        Number of injected processes analysed:0
                                        Technologies:
                                        • HCA enabled
                                        • EGA enabled
                                        • HDC enabled
                                        • AMSI enabled
                                        Analysis Mode:default
                                        Analysis stop reason:Timeout
                                        Detection:MAL
                                        Classification:mal100.troj.adwa.spyw.evad.winEXE@4/6@2/1
                                        EGA Information:
                                        • Successful, ratio: 100%
                                        HDC Information:Failed
                                        HCA Information:
                                        • Successful, ratio: 100%
                                        • Number of executed functions: 10
                                        • Number of non-executed functions: 4
                                        Cookbook Comments:
                                        • Found application associated with file extension: .exe
                                        • Adjust boot time
                                        • Enable AMSI

                                        Warnings

                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WerFault.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
                                        • Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.189.173.21
                                        • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, login.live.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, sls.update.microsoft.com, onedsblobprdwus16.westus.cloudapp.azure.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com
                                        • Not all processes where analyzed, report is missing behavior information
                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                        • Report size getting too big, too many NtSetInformationFile calls found.
                                        • VT rate limit hit for: SWIFT TRANSFER.exe

                                        Simulations

                                        Behavior and APIs

                                        TimeTypeDescription
                                        17:36:18API Interceptor126x Sleep call for process: SWIFT TRANSFER.exe modified
                                        17:36:49API Interceptor1x Sleep call for process: WerFault.exe modified

                                        Joe Sandbox View / Context

                                        IPs

                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                        185.162.171.75Image0001.exeGet hashmaliciousBrowse
                                          SecuriteInfo.com.Trojan.Olock.1.17482.exeGet hashmaliciousBrowse
                                            order 00041221.exeGet hashmaliciousBrowse
                                              SecuriteInfo.com.W32.AIDetectNet.01.30741.exeGet hashmaliciousBrowse
                                                SecuriteInfo.com.Trojan.Olock.1.16546.exeGet hashmaliciousBrowse
                                                  SWIFT TRANSFER-00298760.exeGet hashmaliciousBrowse
                                                    Confirmation_27Jul2022_154550_8e0bd6d3-fd26-4d20-bf61-44ddde788c6e_1658922350107.exeGet hashmaliciousBrowse
                                                      E700 quotation20111209.exeGet hashmaliciousBrowse
                                                        20-18636.exeGet hashmaliciousBrowse
                                                          SecuriteInfo.com.W32.AIDetectNet.01.8966.exeGet hashmaliciousBrowse
                                                            Purchase Order_Request for QUOTE Specs.exeGet hashmaliciousBrowse
                                                              E700 quotation20111209.exeGet hashmaliciousBrowse
                                                                Swift - 70,990.00 - 220070.exeGet hashmaliciousBrowse
                                                                  Spare Parts Quotation.exeGet hashmaliciousBrowse
                                                                    SecuriteInfo.com.W32.AIDetectNet.01.7177.exeGet hashmaliciousBrowse

                                                                      Domains

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      activandalucia.comDocument needed.docGet hashmaliciousBrowse
                                                                      • 185.42.104.172
                                                                      Invoice 4976870 February.docGet hashmaliciousBrowse
                                                                      • 46.16.62.46
                                                                      Invoice 4976870 February.docGet hashmaliciousBrowse
                                                                      • 46.16.62.46
                                                                      bb05fa04-817e-482e-9791-a09f565226fc.docGet hashmaliciousBrowse
                                                                      • 185.42.104.172

                                                                      ASNs

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      ASN-XTUDIONETESImage0001.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fdsena3.web.app%2fR3wlair07xnZ1H05untairQ3bd0TR3wH05nZ1&c=mountaireGet hashmaliciousBrowse
                                                                      • 181.215.246.202
                                                                      http://www.awin1.com/awclick.php?mid=2041&id=201309&clickref=201309-dm&p=https%3a%2f%2fappmso.firebaseapp.com%2fnZ1arR3wQ3bllH05d0TiaR3wH05nH0507xpartH05ud0TnlGet hashmaliciousBrowse
                                                                      • 181.215.246.202
                                                                      SecuriteInfo.com.Trojan.Olock.1.17482.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      order 00041221.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      SecuriteInfo.com.W32.AIDetectNet.01.30741.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      SecuriteInfo.com.Trojan.Olock.1.16546.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      SWIFT TRANSFER-00298760.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      Confirmation_27Jul2022_154550_8e0bd6d3-fd26-4d20-bf61-44ddde788c6e_1658922350107.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      E700 quotation20111209.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      20-18636.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      SecuriteInfo.com.W32.AIDetectNet.01.8966.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      Purchase Order_Request for QUOTE Specs.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      E700 quotation20111209.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      Swift - 70,990.00 - 220070.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      Spare Parts Quotation.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      SecuriteInfo.com.W32.AIDetectNet.01.7177.exeGet hashmaliciousBrowse
                                                                      • 185.162.171.75
                                                                      MKsmbjykWZGet hashmaliciousBrowse
                                                                      • 185.37.230.235
                                                                      ofuUbQVOQiGet hashmaliciousBrowse
                                                                      • 185.37.230.234
                                                                      phantom.x86Get hashmaliciousBrowse
                                                                      • 191.96.245.240

                                                                      JA3 Fingerprints

                                                                      ⊘No context

                                                                      Dropped Files

                                                                      ⊘No context

                                                                      Created / dropped Files

                                                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SWIFT TRANSFER.e_e02ad048c9bab2cfb5fa7c41a51938c2ea97c964_73dd571f_0481d645\Report.wer

                                                                      Download File
                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                      File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):65536
                                                                      Entropy (8bit):1.1717842007123833
                                                                      Encrypted:false
                                                                      SSDEEP:192:WD12vRB2dHBUZMX6aPXUAaEIr/u7smS274ItdAh:xvRBMBUZMX6apnIr/u7smX4ItdA
                                                                      MD5:9BBCEF06BC366DB22F394811ECC2E6D7
                                                                      SHA1:B3AFE3A62915A9E74FC9296F1A61E52749304B2F
                                                                      SHA-256:444FB5FC85085539A24AB252CB41EFF89D9E7C83044F10EF9E9AF3E23E771A5D
                                                                      SHA-512:3C530FF658B9A2F39F0596E6C0905E64F7C75E3F08A00EFEDEB2A39B815CB3EF13BF50D6155F4B95A6CB05B8B096EA9140AAE4F6ED93C37C4A567A75304B5888
                                                                      Malicious:false
                                                                      Reputation:low
                                                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.4.4.7.9.0.0.2.9.5.9.6.6.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.0.4.4.7.9.0.0.7.8.6.5.9.0.4.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.d.3.4.6.c.3.e.-.9.0.5.0.-.4.7.c.c.-.9.e.e.f.-.c.9.2.1.5.5.b.6.0.7.d.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.a.6.6.d.c.1.6.-.5.9.1.c.-.4.a.7.6.-.8.a.8.1.-.9.f.7.5.8.6.2.b.8.5.7.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.W.I.F.T. .T.R.A.N.S.F.E.R...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.o.a.p.P.a.r.a.m.e.t.e.r.A.t.t.r.i.b...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.7.8.-.0.0.0.1.-.0.0.1.d.-.b.d.e.e.-.0.4.0.b.8.8.a.b.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.d.5.5.d.4.c.3.1.c.d.a.d.5.c.b.8.7.1.1.7.0.7.4.1.7.8.f.a.b.6.3.0.0.0.0.0.0.0.0.!.0.0.0.0.a.4.4.3.8.d.8.6.4.9.d.a.6.0.b.9.e.d.1.9.a.

                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERBDDB.tmp.dmp

                                                                      Download File
                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                      File Type:Mini DuMP crash report, 15 streams, Tue Aug 9 00:36:46 2022, 0x1205a4 type
                                                                      Category:dropped
                                                                      Size (bytes):331284
                                                                      Entropy (8bit):3.465530901495165
                                                                      Encrypted:false
                                                                      SSDEEP:3072:tTYDLKiKrjd+pmpXCguOy9gIOgF5+R0UUCgU0YGjYemWSM31oCRuX1d0/F:qKopKq9RpD+9Tj0pSGncFd0d
                                                                      MD5:F3D587948F8CAD181F73774BF2FA79A3
                                                                      SHA1:381A1CBD15ABB78F2CFBE480631B2D1CD86207CE
                                                                      SHA-256:E4F59323D84504378AD9A7F73E7B5496332C677436DF9C3E8ADED197902839BB
                                                                      SHA-512:476ED7D44792AA64251B4B29185E98BBDE9F71CADF559A5A7EB41C383160EA1E4E882804505C93275037C73E69111BD01791498894D2CE28084BC8F3A6FE4D69
                                                                      Malicious:false
                                                                      Reputation:low
                                                                      Preview:MDMP....... ..........b............4........... ...H.......$...h'.......*...d..........`.......8...........T........... @...............'..........x)...................................................................U...........B.......*......GenuineIntelW...........T.......x......b.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE47.tmp.WERInternalMetadata.xml

                                                                      Download File
                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                      File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):6398
                                                                      Entropy (8bit):3.7184008918597233
                                                                      Encrypted:false
                                                                      SSDEEP:192:Rrl7r3GLNiYy6UkzeqYZWSGXqCprs89b3usfIj9m:RrlsNi16VYESGXL3tfj
                                                                      MD5:AF74ADB6BDF2F6E9969733D15DB19EE9
                                                                      SHA1:429BF764B6F5F4B2156758A737C3A87839D78479
                                                                      SHA-256:AB36802BCF813D147F98CCC027383FA39834F7879B6E3496447185263688B704
                                                                      SHA-512:5D621527F858D6E30319FCDB8AF8E70364C1D948AF35FA48E9245DA2F80921B5CF6EFF5E6F79F389A7A7A411E3897FBDD7A70331D63B2B5518CF5A8CE38C36C5
                                                                      Malicious:false
                                                                      Reputation:low
                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.5.2.<./.P.i.d.>.......

                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERCF71.tmp.xml

                                                                      Download File
                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):4762
                                                                      Entropy (8bit):4.490459471843885
                                                                      Encrypted:false
                                                                      SSDEEP:48:cvIwSD8zsXJgtWI9YUhWgc8sqYjk8fm8M4JwLjJ2Fns+q8vALjJVR+ZOOotXd:uITf5HPgrsqYtJGKDoOoxd
                                                                      MD5:E6331D171E1B25BCEF4B236C7E4E37E2
                                                                      SHA1:8F416276567B3692F3D0873208F6C3952BE17EA4
                                                                      SHA-256:10F01086E08F58084EE6181CAB60B33DE1EF630CF5F3DB857066AAA6FC99CF28
                                                                      SHA-512:5A5EFB43B71B6F503554099831E3D77F6DD03CD11E66810FDA94566101E98673655608DB70F19C0AAE152EC38766FBE9647047C537250EB791F82E5962BD3C86
                                                                      Malicious:false
                                                                      Reputation:low
                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1639307" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SWIFT TRANSFER.exe.log

                                                                      Download File
                                                                      Process:C:\Users\user\Desktop\SWIFT TRANSFER.exe
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):1308
                                                                      Entropy (8bit):5.345811588615766
                                                                      Encrypted:false
                                                                      SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84FsXE8:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzu
                                                                      MD5:2E016B886BDB8389D2DD0867BE55F87B
                                                                      SHA1:25D28EF2ACBB41764571E06E11BF4C05DD0E2F8B
                                                                      SHA-256:1D037CF00A8849E6866603297F85D3DABE09535E72EDD2636FB7D0F6C7DA3427
                                                                      SHA-512:C100729153954328AA2A77EECB2A3CBD03CB7E8E23D736000F890B17AAA50BA87745E30FB9E2B0D61E16DCA45694C79B4CE09B9F4475220BEB38CAEA546CFC2A
                                                                      Malicious:true
                                                                      Reputation:high, very likely benign file
                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                                                      C:\Windows\System32\drivers\etc\hosts

                                                                      Download File
                                                                      Process:C:\Users\user\Desktop\SWIFT TRANSFER.exe
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:modified
                                                                      Size (bytes):835
                                                                      Entropy (8bit):4.694294591169137
                                                                      Encrypted:false
                                                                      SSDEEP:24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTt8:vDZhyoZWM9rU5fFcP
                                                                      MD5:6EB47C1CF858E25486E42440074917F2
                                                                      SHA1:6A63F93A95E1AE831C393A97158C526A4FA0FAAE
                                                                      SHA-256:9B13A3EA948A1071A81787AAC1930B89E30DF22CE13F8FF751F31B5D83E79FFB
                                                                      SHA-512:08437AB32E7E905EB11335E670CDD5D999803390710ED39CBC31A2D3F05868D5D0E5D051CCD7B06A85BB466932F99A220463D27FAC29116D241E8ADAC495FA2F
                                                                      Malicious:true
                                                                      Reputation:high, very likely benign file
                                                                      Preview:# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....127.0.0.1

                                                                      Static File Info

                                                                      General

                                                                      File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                      Entropy (8bit):7.786674550423878
                                                                      TrID:
                                                                      • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                      • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                      • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                      • Generic Win/DOS Executable (2004/3) 0.01%
                                                                      • DOS Executable Generic (2002/1) 0.01%
                                                                      File name:SWIFT TRANSFER.exe
                                                                      File size:834048
                                                                      MD5:735ee862055fcbcc574b73b1695af599
                                                                      SHA1:a4438d8649da60b9ed19aa5d98962dc1de1efa3a
                                                                      SHA256:b496205d5045c9c9f9407bfca6a4c9088218560c2884fd737c8efe76352ae3ca
                                                                      SHA512:30792e3468246e6145c37f9bc7502ad20e88912dcc82c3e608eb7ff3522f11ba14890abe2a33425b14d249352ec33a46f63e8d7602a88f3d1def215d89dcac36
                                                                      SSDEEP:24576:H96FxgV10gJ+em8LKYXFWYNe9IbUDHDl:2gVWgflnWYN7U
                                                                      TLSH:7B05BF5BAF147708C5A7AAB5EE0BBD72A7F61C1D3175D0783A64BC0A4AFF301D51202A
                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&..b..............0.................. ........@.. ....................... ............@................................

                                                                      File Icon

                                                                      Icon Hash:00828e8e8686b000

                                                                      Static PE Info

                                                                      General

                                                                      Entrypoint:0x4cd0fa
                                                                      Entrypoint Section:.text
                                                                      Digitally signed:false
                                                                      Imagebase:0x400000
                                                                      Subsystem:windows gui
                                                                      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                      Time Stamp:0x62F0B226 [Mon Aug 8 06:50:14 2022 UTC]
                                                                      TLS Callbacks:
                                                                      CLR (.Net) Version:
                                                                      OS Version Major:4
                                                                      OS Version Minor:0
                                                                      File Version Major:4
                                                                      File Version Minor:0
                                                                      Subsystem Version Major:4
                                                                      Subsystem Version Minor:0
                                                                      Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                      Entrypoint Preview

                                                                      Instruction
                                                                      jmp dword ptr [00402000h]
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al

                                                                      Data Directories

                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xcd0a80x4f.text
                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xce0000x3c0.rsrc
                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0xd00000xc.reloc
                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                      Sections

                                                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                      .text0x20000xcb1000xcb200False0.8196189903846154data7.792812997909333IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                      .rsrc0xce0000x3c00x400False0.3837890625data3.001696674534704IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                      .reloc0xd00000xc0x200False0.044921875data0.09800417566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                      Resources

                                                                      NameRVASizeTypeLanguageCountry
                                                                      RT_VERSION0xce0580x364data

                                                                      Imports

                                                                      DLLImport
                                                                      mscoree.dll_CorExeMain

                                                                      Network Behavior

                                                                      Snort IDS Alerts

                                                                      TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                      192.168.2.3185.162.171.75497445872851779 08/08/22-17:36:37.122597TCP2851779ETPRO TROJAN Agent Tesla Telegram Exfil49744587192.168.2.3185.162.171.75
                                                                      192.168.2.3185.162.171.75497445872030171 08/08/22-17:36:37.122505TCP2030171ET TROJAN AgentTesla Exfil Via SMTP49744587192.168.2.3185.162.171.75
                                                                      192.168.2.3185.162.171.75497445872840032 08/08/22-17:36:37.122597TCP2840032ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M249744587192.168.2.3185.162.171.75

                                                                      Network Port Distribution

                                                                      TCP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      Aug 8, 2022 17:36:36.486733913 CEST49744587192.168.2.3185.162.171.75
                                                                      Aug 8, 2022 17:36:36.532057047 CEST58749744185.162.171.75192.168.2.3
                                                                      Aug 8, 2022 17:36:36.532193899 CEST49744587192.168.2.3185.162.171.75
                                                                      Aug 8, 2022 17:36:36.733409882 CEST58749744185.162.171.75192.168.2.3
                                                                      Aug 8, 2022 17:36:36.733877897 CEST49744587192.168.2.3185.162.171.75
                                                                      Aug 8, 2022 17:36:36.779390097 CEST58749744185.162.171.75192.168.2.3
                                                                      Aug 8, 2022 17:36:36.781019926 CEST49744587192.168.2.3185.162.171.75
                                                                      Aug 8, 2022 17:36:36.826838017 CEST58749744185.162.171.75192.168.2.3
                                                                      Aug 8, 2022 17:36:36.827361107 CEST49744587192.168.2.3185.162.171.75
                                                                      Aug 8, 2022 17:36:36.911923885 CEST58749744185.162.171.75192.168.2.3
                                                                      Aug 8, 2022 17:36:36.917680025 CEST58749744185.162.171.75192.168.2.3
                                                                      Aug 8, 2022 17:36:36.973114014 CEST49744587192.168.2.3185.162.171.75
                                                                      Aug 8, 2022 17:36:37.018518925 CEST58749744185.162.171.75192.168.2.3
                                                                      Aug 8, 2022 17:36:37.018560886 CEST58749744185.162.171.75192.168.2.3
                                                                      Aug 8, 2022 17:36:37.023947954 CEST49744587192.168.2.3185.162.171.75
                                                                      Aug 8, 2022 17:36:37.075958967 CEST58749744185.162.171.75192.168.2.3
                                                                      Aug 8, 2022 17:36:37.076226950 CEST49744587192.168.2.3185.162.171.75
                                                                      Aug 8, 2022 17:36:37.121546030 CEST58749744185.162.171.75192.168.2.3
                                                                      Aug 8, 2022 17:36:37.121611118 CEST58749744185.162.171.75192.168.2.3
                                                                      Aug 8, 2022 17:36:37.122504950 CEST49744587192.168.2.3185.162.171.75
                                                                      Aug 8, 2022 17:36:37.122596979 CEST49744587192.168.2.3185.162.171.75
                                                                      Aug 8, 2022 17:36:37.123333931 CEST49744587192.168.2.3185.162.171.75
                                                                      Aug 8, 2022 17:36:37.123416901 CEST49744587192.168.2.3185.162.171.75
                                                                      Aug 8, 2022 17:36:37.167886972 CEST58749744185.162.171.75192.168.2.3
                                                                      Aug 8, 2022 17:36:37.168486118 CEST58749744185.162.171.75192.168.2.3
                                                                      Aug 8, 2022 17:36:37.206161976 CEST58749744185.162.171.75192.168.2.3
                                                                      Aug 8, 2022 17:36:37.343115091 CEST49744587192.168.2.3185.162.171.75
                                                                      Aug 8, 2022 17:36:50.403903961 CEST49744587192.168.2.3185.162.171.75

                                                                      UDP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      Aug 8, 2022 17:36:36.304270029 CEST5641753192.168.2.38.8.8.8
                                                                      Aug 8, 2022 17:36:36.350898027 CEST53564178.8.8.8192.168.2.3
                                                                      Aug 8, 2022 17:36:36.407972097 CEST5592353192.168.2.38.8.8.8
                                                                      Aug 8, 2022 17:36:36.456037045 CEST53559238.8.8.8192.168.2.3

                                                                      DNS Queries

                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                      Aug 8, 2022 17:36:36.304270029 CEST192.168.2.38.8.8.80xcb34Standard query (0)mail.activandalucia.comA (IP address)IN (0x0001)
                                                                      Aug 8, 2022 17:36:36.407972097 CEST192.168.2.38.8.8.80xecf6Standard query (0)mail.activandalucia.comA (IP address)IN (0x0001)

                                                                      DNS Answers

                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                      Aug 8, 2022 17:36:36.350898027 CEST8.8.8.8192.168.2.30xcb34No error (0)mail.activandalucia.comactivandalucia.comCNAME (Canonical name)IN (0x0001)
                                                                      Aug 8, 2022 17:36:36.350898027 CEST8.8.8.8192.168.2.30xcb34No error (0)activandalucia.com185.162.171.75A (IP address)IN (0x0001)
                                                                      Aug 8, 2022 17:36:36.456037045 CEST8.8.8.8192.168.2.30xecf6No error (0)mail.activandalucia.comactivandalucia.comCNAME (Canonical name)IN (0x0001)
                                                                      Aug 8, 2022 17:36:36.456037045 CEST8.8.8.8192.168.2.30xecf6No error (0)activandalucia.com185.162.171.75A (IP address)IN (0x0001)

                                                                      SMTP Packets

                                                                      TimestampSource PortDest PortSource IPDest IPCommands
                                                                      Aug 8, 2022 17:36:36.733409882 CEST58749744185.162.171.75192.168.2.3220-cloudvip3.45st.com ESMTP Exim 4.95 #2 Mon, 08 Aug 2022 17:36:36 +0200
                                                                      220-We do not authorize the use of this system to transport unsolicited,
                                                                      220 and/or bulk e-mail.
                                                                      Aug 8, 2022 17:36:36.733877897 CEST49744587192.168.2.3185.162.171.75EHLO 376483
                                                                      Aug 8, 2022 17:36:36.779390097 CEST58749744185.162.171.75192.168.2.3250-cloudvip3.45st.com Hello 376483 [102.129.143.3]
                                                                      250-SIZE 52428800
                                                                      250-8BITMIME
                                                                      250-PIPELINING
                                                                      250-PIPE_CONNECT
                                                                      250-AUTH PLAIN LOGIN
                                                                      250-STARTTLS
                                                                      250 HELP
                                                                      Aug 8, 2022 17:36:36.781019926 CEST49744587192.168.2.3185.162.171.75AUTH login bWFya2V0aW5nOUBhY3RpdmFuZGFsdWNpYS5jb20=
                                                                      Aug 8, 2022 17:36:36.826838017 CEST58749744185.162.171.75192.168.2.3334 UGFzc3dvcmQ6
                                                                      Aug 8, 2022 17:36:36.917680025 CEST58749744185.162.171.75192.168.2.3235 Authentication succeeded
                                                                      Aug 8, 2022 17:36:36.973114014 CEST49744587192.168.2.3185.162.171.75MAIL FROM:<marketing9@activandalucia.com>
                                                                      Aug 8, 2022 17:36:37.018560886 CEST58749744185.162.171.75192.168.2.3250 OK
                                                                      Aug 8, 2022 17:36:37.023947954 CEST49744587192.168.2.3185.162.171.75RCPT TO:<sales9@activandalucia.com>
                                                                      Aug 8, 2022 17:36:37.075958967 CEST58749744185.162.171.75192.168.2.3250 Accepted
                                                                      Aug 8, 2022 17:36:37.076226950 CEST49744587192.168.2.3185.162.171.75DATA
                                                                      Aug 8, 2022 17:36:37.121611118 CEST58749744185.162.171.75192.168.2.3354 Enter message, ending with "." on a line by itself
                                                                      Aug 8, 2022 17:36:37.123416901 CEST49744587192.168.2.3185.162.171.75.
                                                                      Aug 8, 2022 17:36:37.206161976 CEST58749744185.162.171.75192.168.2.3250 OK id=1oL4o2-0006XH-2q

                                                                      Statistics

                                                                      CPU Usage

                                                                      Click to jump to process

                                                                      Memory Usage

                                                                      Click to jump to process

                                                                      High Level Behavior Distribution

                                                                      Click to dive into process behavior distribution

                                                                      Behavior

                                                                      Click to jump to process

                                                                      System Behavior

                                                                      General

                                                                      Target ID:0
                                                                      Start time:17:36:09
                                                                      Start date:08/08/2022
                                                                      Path:C:\Users\user\Desktop\SWIFT TRANSFER.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:"C:\Users\user\Desktop\SWIFT TRANSFER.exe"
                                                                      Imagebase:0x4e0000
                                                                      File size:834048 bytes
                                                                      MD5 hash:735EE862055FCBCC574B73B1695AF599
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:.Net C# or VB.NET
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.271754334.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                      Reputation:low

                                                                      General

                                                                      Target ID:4
                                                                      Start time:17:36:19
                                                                      Start date:08/08/2022
                                                                      Path:C:\Users\user\Desktop\SWIFT TRANSFER.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:C:\Users\user\Desktop\SWIFT TRANSFER.exe
                                                                      Imagebase:0xae0000
                                                                      File size:834048 bytes
                                                                      MD5 hash:735EE862055FCBCC574B73B1695AF599
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:.Net C# or VB.NET
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      Reputation:low

                                                                      General

                                                                      Target ID:15
                                                                      Start time:17:36:41
                                                                      Start date:08/08/2022
                                                                      Path:C:\Windows\SysWOW64\WerFault.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1700
                                                                      Imagebase:0x800000
                                                                      File size:434592 bytes
                                                                      MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:.Net C# or VB.NET
                                                                      Reputation:high

                                                                      Disassembly

                                                                      Reset < >

                                                                        Execution Graph

                                                                        Execution Coverage:5.4%
                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                        Signature Coverage:0%
                                                                        Total number of Nodes:112
                                                                        Total number of Limit Nodes:9
                                                                        execution_graph 25626 529e6a8 25628 529e6bd 25626->25628 25630 529e777 25628->25630 25631 529b2d8 25628->25631 25629 529e74c 25632 529b2fc 25631->25632 25633 529b303 25631->25633 25632->25629 25637 529b32a 25633->25637 25638 5299624 GetCurrentThreadId 25633->25638 25635 529b320 25639 5299624 GetCurrentThreadId 25635->25639 25637->25629 25638->25635 25639->25637 25640 4cfc1e8 GetCurrentProcess 25641 4cfc25b 25640->25641 25642 4cfc262 GetCurrentThread 25640->25642 25641->25642 25643 4cfc29f GetCurrentProcess 25642->25643 25644 4cfc298 25642->25644 25645 4cfc2d5 25643->25645 25644->25643 25646 4cfc2fd GetCurrentThreadId 25645->25646 25647 4cfc32e 25646->25647 25648 4cf40d0 25649 4cf40e2 25648->25649 25650 4cf40ee 25649->25650 25654 4cf41e0 25649->25654 25659 4cf388c 25650->25659 25652 4cf410d 25655 4cf4205 25654->25655 25663 4cf42d1 25655->25663 25667 4cf42e0 25655->25667 25660 4cf3897 25659->25660 25675 4cf5b4c 25660->25675 25662 4cf71fa 25662->25652 25665 4cf4307 25663->25665 25664 4cf43e4 25664->25664 25665->25664 25671 4cf3e18 25665->25671 25669 4cf4307 25667->25669 25668 4cf43e4 25668->25668 25669->25668 25670 4cf3e18 CreateActCtxA 25669->25670 25670->25668 25672 4cf5370 CreateActCtxA 25671->25672 25674 4cf5433 25672->25674 25676 4cf5b57 25675->25676 25679 4cf6f28 25676->25679 25678 4cf731d 25678->25662 25680 4cf6f33 25679->25680 25683 4cf6f58 25680->25683 25682 4cf73fa 25682->25678 25684 4cf6f63 25683->25684 25687 4cf6f88 25684->25687 25686 4cf74ea 25686->25682 25688 4cf6f93 25687->25688 25689 4cf7c3c 25688->25689 25691 4cfbf10 25688->25691 25689->25686 25693 4cfbf41 25691->25693 25692 4cfbf65 25692->25689 25693->25692 25697 4cfc0d0 25693->25697 25701 4cfc0c0 25693->25701 25705 4cfc08d 25693->25705 25698 4cfc0dd 25697->25698 25699 4cfc117 25698->25699 25710 4cfb594 25698->25710 25699->25692 25702 4cfc0dd 25701->25702 25703 4cfc117 25702->25703 25704 4cfb594 2 API calls 25702->25704 25703->25692 25704->25703 25706 4cfc0a3 25705->25706 25707 4cfc0eb 25705->25707 25706->25692 25708 4cfc117 25707->25708 25709 4cfb594 2 API calls 25707->25709 25708->25692 25709->25708 25711 4cfb59f 25710->25711 25713 4cfca08 25711->25713 25714 4cfb67c 25711->25714 25713->25713 25715 4cfb687 25714->25715 25716 4cf6f88 2 API calls 25715->25716 25717 4cfce77 25715->25717 25716->25717 25721 4cfe808 25717->25721 25727 4cfe7f0 25717->25727 25718 4cfceb0 25718->25713 25723 4cfe885 25721->25723 25724 4cfe839 25721->25724 25722 4cfe845 25722->25718 25723->25718 25724->25722 25725 4cff088 LoadLibraryExW GetModuleHandleW 25724->25725 25726 4cff077 LoadLibraryExW GetModuleHandleW 25724->25726 25725->25723 25726->25723 25728 4cfe7fa 25727->25728 25729 4cfe7d6 25727->25729 25728->25729 25730 4cff088 LoadLibraryExW GetModuleHandleW 25728->25730 25731 4cff077 LoadLibraryExW GetModuleHandleW 25728->25731 25729->25718 25730->25729 25731->25729 25732 4cfc410 DuplicateHandle 25733 4cfc4a6 25732->25733 25734 4cf9e10 25738 4cf9ef8 25734->25738 25746 4cf9f08 25734->25746 25735 4cf9e1f 25739 4cf9f1b 25738->25739 25741 4cf9f33 25739->25741 25754 4cfa181 25739->25754 25758 4cfa190 25739->25758 25740 4cf9f2b 25740->25741 25742 4cfa130 GetModuleHandleW 25740->25742 25741->25735 25743 4cfa15d 25742->25743 25743->25735 25747 4cf9f1b 25746->25747 25748 4cf9f33 25747->25748 25752 4cfa181 LoadLibraryExW 25747->25752 25753 4cfa190 LoadLibraryExW 25747->25753 25748->25735 25749 4cf9f2b 25749->25748 25750 4cfa130 GetModuleHandleW 25749->25750 25751 4cfa15d 25750->25751 25751->25735 25752->25749 25753->25749 25755 4cfa1a4 25754->25755 25757 4cfa1c9 25755->25757 25762 4cf9468 25755->25762 25757->25740 25759 4cfa1a4 25758->25759 25760 4cf9468 LoadLibraryExW 25759->25760 25761 4cfa1c9 25759->25761 25760->25761 25761->25740 25763 4cfa370 LoadLibraryExW 25762->25763 25765 4cfa3e9 25763->25765 25765->25757

                                                                        Executed Functions

                                                                        Function 04CFC1D9 Relevance: 6.1, APIs: 4, Instructions: 124threadCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        APIs
                                                                        • GetCurrentProcess.KERNEL32 ref: 04CFC248
                                                                        • GetCurrentThread.KERNEL32 ref: 04CFC285
                                                                        • GetCurrentProcess.KERNEL32 ref: 04CFC2C2
                                                                        • GetCurrentThreadId.KERNEL32 ref: 04CFC31B
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.281495675.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_4cf0000_SWIFT TRANSFER.jbxd
                                                                        Similarity
                                                                        • API ID: Current$ProcessThread
                                                                        • String ID:
                                                                        • API String ID: 2063062207-0
                                                                        • Opcode ID: 0915aa6b40b573a4e1adb3c0ebd258dbcfd45bf4b4c25ecd940486e21f5c50db
                                                                        • Instruction ID: 31ae9f5ca5b0626ffafd9206844c8322d41d623481d5ed8c1203e381c037ab88
                                                                        • Opcode Fuzzy Hash: 0915aa6b40b573a4e1adb3c0ebd258dbcfd45bf4b4c25ecd940486e21f5c50db
                                                                        • Instruction Fuzzy Hash: E85157B0D003488FDB55DFA9D9487EEBBF2FB48308F248459E409A7750D738A944CB66
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 04CFC1E8 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        APIs
                                                                        • GetCurrentProcess.KERNEL32 ref: 04CFC248
                                                                        • GetCurrentThread.KERNEL32 ref: 04CFC285
                                                                        • GetCurrentProcess.KERNEL32 ref: 04CFC2C2
                                                                        • GetCurrentThreadId.KERNEL32 ref: 04CFC31B
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.281495675.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_4cf0000_SWIFT TRANSFER.jbxd
                                                                        Similarity
                                                                        • API ID: Current$ProcessThread
                                                                        • String ID:
                                                                        • API String ID: 2063062207-0
                                                                        • Opcode ID: b301d9c90e944dc167a79e36dd5fbaf4e02778c68653e19f56035d22a40b2ca1
                                                                        • Instruction ID: 6087e3723f9dfb59d2ffceedc61a23dd045ef4a5ee365ce35d6d1e18e0ad2a11
                                                                        • Opcode Fuzzy Hash: b301d9c90e944dc167a79e36dd5fbaf4e02778c68653e19f56035d22a40b2ca1
                                                                        • Instruction Fuzzy Hash: A75146B0D002088FDB55DFA9D948BEEBBF1FB48318F24845DE409A7750D738A944CB66
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 04CF9F08 Relevance: 1.7, APIs: 1, Instructions: 190COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 42 4cf9f08-4cf9f10 43 4cf9f1b-4cf9f1d 42->43 44 4cf9f16 call 4cf82a8 42->44 45 4cf9f1f 43->45 46 4cf9f33-4cf9f37 43->46 44->43 95 4cf9f25 call 4cfa181 45->95 96 4cf9f25 call 4cfa190 45->96 47 4cf9f4b-4cf9f8c 46->47 48 4cf9f39-4cf9f43 46->48 53 4cf9f8e-4cf9f96 47->53 54 4cf9f99-4cf9fa7 47->54 48->47 49 4cf9f2b-4cf9f2d 49->46 52 4cfa068-4cfa128 49->52 90 4cfa12a-4cfa12d 52->90 91 4cfa130-4cfa15b GetModuleHandleW 52->91 53->54 55 4cf9fcb-4cf9fcd 54->55 56 4cf9fa9-4cf9fae 54->56 60 4cf9fd0-4cf9fd7 55->60 58 4cf9fb9 56->58 59 4cf9fb0-4cf9fb7 call 4cf9410 56->59 62 4cf9fbb-4cf9fc9 58->62 59->62 64 4cf9fd9-4cf9fe1 60->64 65 4cf9fe4-4cf9feb 60->65 62->60 64->65 67 4cf9fed-4cf9ff5 65->67 68 4cf9ff8-4cfa001 call 4cf9420 65->68 67->68 72 4cfa00e-4cfa013 68->72 73 4cfa003-4cfa00b 68->73 75 4cfa015-4cfa01c 72->75 76 4cfa031-4cfa035 72->76 73->72 75->76 77 4cfa01e-4cfa02e call 4cf9430 call 4cf9440 75->77 80 4cfa03b-4cfa03e 76->80 77->76 83 4cfa061-4cfa067 80->83 84 4cfa040-4cfa05e 80->84 84->83 90->91 92 4cfa15d-4cfa163 91->92 93 4cfa164-4cfa178 91->93 92->93 95->49 96->49
                                                                        APIs
                                                                        • GetModuleHandleW.KERNELBASE(00000000), ref: 04CFA14E
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.281495675.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_4cf0000_SWIFT TRANSFER.jbxd
                                                                        Similarity
                                                                        • API ID: HandleModule
                                                                        • String ID:
                                                                        • API String ID: 4139908857-0
                                                                        • Opcode ID: af1722d603e018bb2e9628e28e6bb094caf4e584ebffdceef72e361bb4987968
                                                                        • Instruction ID: 92288d6e3be9b100b2d05dfd74ae303e32b15d94131bfed8c0b0960384fb7695
                                                                        • Opcode Fuzzy Hash: af1722d603e018bb2e9628e28e6bb094caf4e584ebffdceef72e361bb4987968
                                                                        • Instruction Fuzzy Hash: F77113B0A00B058FDB64DF29D45075AB7F2BF88204F00892DD54A97B50DB79F949CB91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 04CF3E18 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 97 4cf3e18-4cf5431 CreateActCtxA 100 4cf543a-4cf5494 97->100 101 4cf5433-4cf5439 97->101 108 4cf5496-4cf5499 100->108 109 4cf54a3-4cf54a7 100->109 101->100 108->109 110 4cf54a9-4cf54b5 109->110 111 4cf54b8 109->111 110->111 113 4cf54b9 111->113 113->113
                                                                        APIs
                                                                        • CreateActCtxA.KERNEL32(?), ref: 04CF5421
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.281495675.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_4cf0000_SWIFT TRANSFER.jbxd
                                                                        Similarity
                                                                        • API ID: Create
                                                                        • String ID:
                                                                        • API String ID: 2289755597-0
                                                                        • Opcode ID: 7c002e8e49682929f0af7596551ddb77f93056976d901143fecb857a78dbc5db
                                                                        • Instruction ID: 16ff5b453340e117d2972d4b53f36180733556d6758cc0e3d6b0925f244fc121
                                                                        • Opcode Fuzzy Hash: 7c002e8e49682929f0af7596551ddb77f93056976d901143fecb857a78dbc5db
                                                                        • Instruction Fuzzy Hash: 5E41D271D00228DFDB24DFA9C844BDEBBB6BF48308F648059D508AB251D7B56949CFA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 04CF5364 Relevance: 1.6, APIs: 1, Instructions: 95COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 114 4cf5364-4cf5431 CreateActCtxA 116 4cf543a-4cf5494 114->116 117 4cf5433-4cf5439 114->117 124 4cf5496-4cf5499 116->124 125 4cf54a3-4cf54a7 116->125 117->116 124->125 126 4cf54a9-4cf54b5 125->126 127 4cf54b8 125->127 126->127 129 4cf54b9 127->129 129->129
                                                                        APIs
                                                                        • CreateActCtxA.KERNEL32(?), ref: 04CF5421
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.281495675.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_4cf0000_SWIFT TRANSFER.jbxd
                                                                        Similarity
                                                                        • API ID: Create
                                                                        • String ID:
                                                                        • API String ID: 2289755597-0
                                                                        • Opcode ID: ab77a9dbbc04ccd5fb58af78b23383c63516097e637ad853ac7f431f1f43e091
                                                                        • Instruction ID: 6a6cda102cb3aba31bbabe900ae302044ead863836de83fb824b3d4ac36fd2af
                                                                        • Opcode Fuzzy Hash: ab77a9dbbc04ccd5fb58af78b23383c63516097e637ad853ac7f431f1f43e091
                                                                        • Instruction Fuzzy Hash: DA4105B1D00328CFDB24DFA9C8447CDBBB6BF48309F608069D508AB251D775694ACF91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 04CFC40A Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 130 4cfc40a-4cfc4a4 DuplicateHandle 131 4cfc4ad-4cfc4ca 130->131 132 4cfc4a6-4cfc4ac 130->132 132->131
                                                                        APIs
                                                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04CFC497
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.281495675.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_4cf0000_SWIFT TRANSFER.jbxd
                                                                        Similarity
                                                                        • API ID: DuplicateHandle
                                                                        • String ID:
                                                                        • API String ID: 3793708945-0
                                                                        • Opcode ID: 52e8e6fb9ca88f987ff9d3c535c77a11b94485152e3b4e667de24f364863cfe3
                                                                        • Instruction ID: 0f3e33e633334b79971d0f6147043ab071103e05efdd8f882851df2b28d0a13a
                                                                        • Opcode Fuzzy Hash: 52e8e6fb9ca88f987ff9d3c535c77a11b94485152e3b4e667de24f364863cfe3
                                                                        • Instruction Fuzzy Hash: F1211FB5D00218DFDB10CFA9D984AEEBBF5FB08324F14841AE918A3710D378A955CFA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 04CFC410 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 135 4cfc410-4cfc4a4 DuplicateHandle 136 4cfc4ad-4cfc4ca 135->136 137 4cfc4a6-4cfc4ac 135->137 137->136
                                                                        APIs
                                                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04CFC497
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.281495675.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_4cf0000_SWIFT TRANSFER.jbxd
                                                                        Similarity
                                                                        • API ID: DuplicateHandle
                                                                        • String ID:
                                                                        • API String ID: 3793708945-0
                                                                        • Opcode ID: 295c14b4bb2571545a3a878f5bec12497c79024bfd71f32b1d452aeb0102e105
                                                                        • Instruction ID: 1c9eac252c37a830d9bb0230af013655fb23e7a6655b9438a6a0c683c3523b3e
                                                                        • Opcode Fuzzy Hash: 295c14b4bb2571545a3a878f5bec12497c79024bfd71f32b1d452aeb0102e105
                                                                        • Instruction Fuzzy Hash: A921E4B5D002089FDB10CF9AD984AEEBFF5FB48324F14841AE914A3710D378A954CFA5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 04CF9468 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 140 4cf9468-4cfa3b0 142 4cfa3b8-4cfa3e7 LoadLibraryExW 140->142 143 4cfa3b2-4cfa3b5 140->143 144 4cfa3e9-4cfa3ef 142->144 145 4cfa3f0-4cfa40d 142->145 143->142 144->145
                                                                        APIs
                                                                        • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04CFA1C9,00000800,00000000,00000000), ref: 04CFA3DA
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.281495675.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_4cf0000_SWIFT TRANSFER.jbxd
                                                                        Similarity
                                                                        • API ID: LibraryLoad
                                                                        • String ID:
                                                                        • API String ID: 1029625771-0
                                                                        • Opcode ID: e6b3895a771f67e1f5358e6a3b7c3a70a378c2853b5b6422f72157334206f1b5
                                                                        • Instruction ID: 4c53427afde49849bdd2e9fd7d4b1997952795976aeb305da4c360e8e2129e07
                                                                        • Opcode Fuzzy Hash: e6b3895a771f67e1f5358e6a3b7c3a70a378c2853b5b6422f72157334206f1b5
                                                                        • Instruction Fuzzy Hash: 3811F2B69002099FDB10CF9AC844BDEFBF5EB49324F04842AD519A7600D379A949CFA5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 04CFA368 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 148 4cfa368-4cfa3b0 149 4cfa3b8-4cfa3e7 LoadLibraryExW 148->149 150 4cfa3b2-4cfa3b5 148->150 151 4cfa3e9-4cfa3ef 149->151 152 4cfa3f0-4cfa40d 149->152 150->149 151->152
                                                                        APIs
                                                                        • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04CFA1C9,00000800,00000000,00000000), ref: 04CFA3DA
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.281495675.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_4cf0000_SWIFT TRANSFER.jbxd
                                                                        Similarity
                                                                        • API ID: LibraryLoad
                                                                        • String ID:
                                                                        • API String ID: 1029625771-0
                                                                        • Opcode ID: 289a1108092cf6ca990a34b04a7dfa3f9677c3d6afabaf5a255846c83635f6ac
                                                                        • Instruction ID: 30cf7b301a25474564aae3de8092750e4cd3e012f1439c75d7ce53303591bb0d
                                                                        • Opcode Fuzzy Hash: 289a1108092cf6ca990a34b04a7dfa3f9677c3d6afabaf5a255846c83635f6ac
                                                                        • Instruction Fuzzy Hash: CF1103B6C002498FDB10CFAAC444BDEFBF5EB88314F14852AD459A7600D379A549CFA5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 04CFA0E8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 155 4cfa0e8-4cfa128 156 4cfa12a-4cfa12d 155->156 157 4cfa130-4cfa15b GetModuleHandleW 155->157 156->157 158 4cfa15d-4cfa163 157->158 159 4cfa164-4cfa178 157->159 158->159
                                                                        APIs
                                                                        • GetModuleHandleW.KERNELBASE(00000000), ref: 04CFA14E
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.281495675.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_4cf0000_SWIFT TRANSFER.jbxd
                                                                        Similarity
                                                                        • API ID: HandleModule
                                                                        • String ID:
                                                                        • API String ID: 4139908857-0
                                                                        • Opcode ID: 2e22b24b2dceb9c2f07e7297a41e45eb12ffdbe6a2214d9750551b379aa92381
                                                                        • Instruction ID: 73ab19e9193380155e72f9d94d2f590c51681ace02453ae5cc970e56f5350cf0
                                                                        • Opcode Fuzzy Hash: 2e22b24b2dceb9c2f07e7297a41e45eb12ffdbe6a2214d9750551b379aa92381
                                                                        • Instruction Fuzzy Hash: C611FDB6C002098FCB20CF9AD844ADEFBF5AB88324F14841AD829A7600D379A545CFA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Non-executed Functions

                                                                        Function 04CFF0D0 Relevance: .3, Instructions: 315COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.281495675.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_4cf0000_SWIFT TRANSFER.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: bda72f0d3b3c4efc2791ea142b5b76ae346ea19f4fc70a890ac83cdf49217dfd
                                                                        • Instruction ID: fc6bd60d8014d0139b5cc9b87b48f5a6b619b01b2ff8a5501f37c1c9daf6959c
                                                                        • Opcode Fuzzy Hash: bda72f0d3b3c4efc2791ea142b5b76ae346ea19f4fc70a890ac83cdf49217dfd
                                                                        • Instruction Fuzzy Hash: EA12B7F1412746EAE712CF65F5B82893B69F745328F904308D1619BBD8DBBC294ACF44
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05299B9F Relevance: .3, Instructions: 266COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.283220086.0000000005290000.00000040.00000800.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_5290000_SWIFT TRANSFER.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 7d8d3da0286376061df73837cafe39b07f7ad7bafd3c1691319b728493b7b10b
                                                                        • Instruction ID: 1975ca8c6e426cc8c2e5954dae9d2c32701f3dc246f0cbeea9b4aedf3be7a590
                                                                        • Opcode Fuzzy Hash: 7d8d3da0286376061df73837cafe39b07f7ad7bafd3c1691319b728493b7b10b
                                                                        • Instruction Fuzzy Hash: A5D1C931C20B5A8ACB10EF64D9946DDB7B1EF95200F50879AE50937254EF70AAD8CF91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 04CFCD04 Relevance: .3, Instructions: 265COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.281495675.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_4cf0000_SWIFT TRANSFER.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 24d079c5ed19c210db6ad2a7f5bf4cca38ec4330b0fddea3300133131460d62b
                                                                        • Instruction ID: f94680e9e4741fac3819ca4cc5d7301117190c7b9ac6df8799cdf1497738793a
                                                                        • Opcode Fuzzy Hash: 24d079c5ed19c210db6ad2a7f5bf4cca38ec4330b0fddea3300133131460d62b
                                                                        • Instruction Fuzzy Hash: 4CA16F32E0021A8FDF05DFA5C8445DEBBB3FF85304B15856AEA05AB260EB79B915DB40
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05299BB0 Relevance: .3, Instructions: 264COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.283220086.0000000005290000.00000040.00000800.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_5290000_SWIFT TRANSFER.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 3cc4a7eb05a98c6566857b07ce279a679b441e3ab1d39f7ca7f219cf0921cc37
                                                                        • Instruction ID: b0bff401e71cfb8a197e512d448f3cb1670b1bb5387c07a142086a70e817a8d5
                                                                        • Opcode Fuzzy Hash: 3cc4a7eb05a98c6566857b07ce279a679b441e3ab1d39f7ca7f219cf0921cc37
                                                                        • Instruction Fuzzy Hash: EFD1C831C20B5A8ACB10EF64D994ADDB7B1EF95200F50879AE50937254FF70AAD8CF91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%