| Source: Yara match | File source: 1.0.LETTER OF INTENT.exe.400000.8.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 0.2.LETTER OF INTENT.exe.4771d60.4.raw.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 1.0.LETTER OF INTENT.exe.400000.6.raw.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 1.2.LETTER OF INTENT.exe.400000.0.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 0.2.LETTER OF INTENT.exe.469f500.5.raw.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 0.2.LETTER OF INTENT.exe.4747140.6.raw.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 1.0.LETTER OF INTENT.exe.400000.6.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 1.0.LETTER OF INTENT.exe.400000.8.raw.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 1.2.LETTER OF INTENT.exe.400000.0.raw.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 1.0.LETTER OF INTENT.exe.400000.4.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 0000000F.00000002.505138541.0000000000350000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000001.00000002.307845836.0000000001100000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 0000000F.00000002.506368186.0000000002A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000003.00000000.288819841.000000000E458000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000001.00000002.307789008.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 0000000F.00000002.506165216.0000000002700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000000.00000002.248115726.00000000045B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000001.00000000.242299044.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000003.00000000.274895699.000000000E458000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000001.00000002.303201831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000001.00000000.242704154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 1.0.LETTER OF INTENT.exe.400000.8.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 0.2.LETTER OF INTENT.exe.4771d60.4.raw.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 1.0.LETTER OF INTENT.exe.400000.6.raw.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 1.2.LETTER OF INTENT.exe.400000.0.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 0.2.LETTER OF INTENT.exe.469f500.5.raw.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 0.2.LETTER OF INTENT.exe.4747140.6.raw.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 1.0.LETTER OF INTENT.exe.400000.6.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 1.0.LETTER OF INTENT.exe.400000.8.raw.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 1.2.LETTER OF INTENT.exe.400000.0.raw.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 1.0.LETTER OF INTENT.exe.400000.4.unpack, type: UNPACKEDPE |
| Source: Yara match | File source: 0000000F.00000002.505138541.0000000000350000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000001.00000002.307845836.0000000001100000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 0000000F.00000002.506368186.0000000002A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000003.00000000.288819841.000000000E458000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000001.00000002.307789008.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 0000000F.00000002.506165216.0000000002700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000000.00000002.248115726.00000000045B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000001.00000000.242299044.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000003.00000000.274895699.000000000E458000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000001.00000002.303201831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
| Source: Yara match | File source: 00000001.00000000.242704154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
| Source: 1.0.LETTER OF INTENT.exe.400000.8.unpack, type: UNPACKEDPE | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 1.0.LETTER OF INTENT.exe.400000.8.unpack, type: UNPACKEDPE | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 0.2.LETTER OF INTENT.exe.4771d60.4.raw.unpack, type: UNPACKEDPE | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 0.2.LETTER OF INTENT.exe.4771d60.4.raw.unpack, type: UNPACKEDPE | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 1.0.LETTER OF INTENT.exe.400000.6.raw.unpack, type: UNPACKEDPE | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 1.0.LETTER OF INTENT.exe.400000.6.raw.unpack, type: UNPACKEDPE | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 0.2.LETTER OF INTENT.exe.342a3e4.2.raw.unpack, type: UNPACKEDPE | Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen |
| Source: 1.2.LETTER OF INTENT.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 1.2.LETTER OF INTENT.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 0.2.LETTER OF INTENT.exe.469f500.5.raw.unpack, type: UNPACKEDPE | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 0.2.LETTER OF INTENT.exe.469f500.5.raw.unpack, type: UNPACKEDPE | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 0.2.LETTER OF INTENT.exe.4747140.6.raw.unpack, type: UNPACKEDPE | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 0.2.LETTER OF INTENT.exe.4747140.6.raw.unpack, type: UNPACKEDPE | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 1.0.LETTER OF INTENT.exe.400000.6.unpack, type: UNPACKEDPE | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 1.0.LETTER OF INTENT.exe.400000.6.unpack, type: UNPACKEDPE | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 1.0.LETTER OF INTENT.exe.400000.8.raw.unpack, type: UNPACKEDPE | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 1.0.LETTER OF INTENT.exe.400000.8.raw.unpack, type: UNPACKEDPE | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 1.2.LETTER OF INTENT.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 1.2.LETTER OF INTENT.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 1.0.LETTER OF INTENT.exe.400000.4.unpack, type: UNPACKEDPE | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 1.0.LETTER OF INTENT.exe.400000.4.unpack, type: UNPACKEDPE | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 0000000F.00000002.505138541.0000000000350000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 0000000F.00000002.505138541.0000000000350000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 00000001.00000002.307845836.0000000001100000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 00000001.00000002.307845836.0000000001100000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 0000000F.00000002.506368186.0000000002A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 0000000F.00000002.506368186.0000000002A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 00000003.00000000.288819841.000000000E458000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 00000003.00000000.288819841.000000000E458000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 00000001.00000002.307789008.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 00000001.00000002.307789008.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 0000000F.00000002.506165216.0000000002700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 0000000F.00000002.506165216.0000000002700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 00000000.00000002.248115726.00000000045B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 00000000.00000002.248115726.00000000045B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 00000001.00000000.242299044.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 00000001.00000000.242299044.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 00000003.00000000.274895699.000000000E458000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 00000003.00000000.274895699.000000000E458000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 00000001.00000002.303201831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 00000001.00000002.303201831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 00000001.00000000.242704154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com |
| Source: 00000001.00000000.242704154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group |
| Source: 1.0.LETTER OF INTENT.exe.400000.8.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 1.0.LETTER OF INTENT.exe.400000.8.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 0.2.LETTER OF INTENT.exe.4771d60.4.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 0.2.LETTER OF INTENT.exe.4771d60.4.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 1.0.LETTER OF INTENT.exe.400000.6.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 1.0.LETTER OF INTENT.exe.400000.6.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 0.2.LETTER OF INTENT.exe.342a3e4.2.raw.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window |
| Source: 1.2.LETTER OF INTENT.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 1.2.LETTER OF INTENT.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 0.2.LETTER OF INTENT.exe.469f500.5.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 0.2.LETTER OF INTENT.exe.469f500.5.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 0.2.LETTER OF INTENT.exe.4747140.6.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 0.2.LETTER OF INTENT.exe.4747140.6.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 1.0.LETTER OF INTENT.exe.400000.6.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 1.0.LETTER OF INTENT.exe.400000.6.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 1.0.LETTER OF INTENT.exe.400000.8.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 1.0.LETTER OF INTENT.exe.400000.8.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 1.2.LETTER OF INTENT.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 1.2.LETTER OF INTENT.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 1.0.LETTER OF INTENT.exe.400000.4.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 1.0.LETTER OF INTENT.exe.400000.4.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 0000000F.00000002.505138541.0000000000350000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 0000000F.00000002.505138541.0000000000350000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000001.00000002.307845836.0000000001100000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000001.00000002.307845836.0000000001100000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 0000000F.00000002.506368186.0000000002A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 0000000F.00000002.506368186.0000000002A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000003.00000000.288819841.000000000E458000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000003.00000000.288819841.000000000E458000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000001.00000002.307789008.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000001.00000002.307789008.00000000010D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 0000000F.00000002.506165216.0000000002700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 0000000F.00000002.506165216.0000000002700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000000.00000002.248115726.00000000045B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000000.00000002.248115726.00000000045B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000001.00000000.242299044.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000001.00000000.242299044.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000003.00000000.274895699.000000000E458000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000003.00000000.274895699.000000000E458000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000001.00000002.303201831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000001.00000002.303201831.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000001.00000000.242704154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000001.00000000.242704154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 0_2_01926810 | 0_2_01926810 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 0_2_01926D58 | 0_2_01926D58 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 0_2_0192622A | 0_2_0192622A |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 0_2_0192624F | 0_2_0192624F |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 0_2_01926260 | 0_2_01926260 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 0_2_01926801 | 0_2_01926801 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 0_2_0192B1C0 | 0_2_0192B1C0 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 0_2_061C0006 | 0_2_061C0006 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 0_2_061C0040 | 0_2_061C0040 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_00401030 | 1_2_00401030 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_00401174 | 1_2_00401174 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_0041B9E6 | 1_2_0041B9E6 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_0041D201 | 1_2_0041D201 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_0041C3FA | 1_2_0041C3FA |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_00408C6B | 1_2_00408C6B |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_00408C70 | 1_2_00408C70 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_0041BD57 | 1_2_0041BD57 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_00402D90 | 1_2_00402D90 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_0041CEDB | 1_2_0041CEDB |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_00402FB0 | 1_2_00402FB0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F622AE | 15_2_02F622AE |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F4FA2B | 15_2_02F4FA2B |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F5DBD2 | 15_2_02F5DBD2 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F503DA | 15_2_02F503DA |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ECEBB0 | 15_2_02ECEBB0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F62B28 | 15_2_02F62B28 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F628EC | 15_2_02F628EC |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02EC20A0 | 15_2_02EC20A0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F620A8 | 15_2_02F620A8 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02EAB090 | 15_2_02EAB090 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F6E824 | 15_2_02F6E824 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F51002 | 15_2_02F51002 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02EB4120 | 15_2_02EB4120 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02E9F900 | 15_2_02E9F900 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F62EF7 | 15_2_02F62EF7 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02EB6E30 | 15_2_02EB6E30 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F5D616 | 15_2_02F5D616 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F61FF1 | 15_2_02F61FF1 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F6DFCE | 15_2_02F6DFCE |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F5D466 | 15_2_02F5D466 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02EA841F | 15_2_02EA841F |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02EAD5E0 | 15_2_02EAD5E0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F625DD | 15_2_02F625DD |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02EC2581 | 15_2_02EC2581 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F61D55 | 15_2_02F61D55 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02E90D20 | 15_2_02E90D20 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02F62D07 | 15_2_02F62D07 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02A1D201 | 15_2_02A1D201 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02A1B9E6 | 15_2_02A1B9E6 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02A1CEDB | 15_2_02A1CEDB |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02A02FB0 | 15_2_02A02FB0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02A08C6B | 15_2_02A08C6B |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02A08C70 | 15_2_02A08C70 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02A02D90 | 15_2_02A02D90 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_004185D0 NtCreateFile, | 1_2_004185D0 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_00418680 NtReadFile, | 1_2_00418680 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_00418700 NtClose, | 1_2_00418700 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_004187B0 NtAllocateVirtualMemory, | 1_2_004187B0 |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_004185CF NtCreateFile, | 1_2_004185CF |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_0041867A NtReadFile, | 1_2_0041867A |
| Source: C:\Users\user\Desktop\LETTER OF INTENT.exe | Code function: 1_2_004187AA NtAllocateVirtualMemory, | 1_2_004187AA |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9A50 NtCreateFile,LdrInitializeThunk, | 15_2_02ED9A50 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9860 NtQuerySystemInformation,LdrInitializeThunk, | 15_2_02ED9860 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9840 NtDelayExecution,LdrInitializeThunk, | 15_2_02ED9840 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED99A0 NtCreateSection,LdrInitializeThunk, | 15_2_02ED99A0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9910 NtAdjustPrivilegesToken,LdrInitializeThunk, | 15_2_02ED9910 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED96E0 NtFreeVirtualMemory,LdrInitializeThunk, | 15_2_02ED96E0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED96D0 NtCreateKey,LdrInitializeThunk, | 15_2_02ED96D0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9FE0 NtCreateMutant,LdrInitializeThunk, | 15_2_02ED9FE0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9780 NtMapViewOfSection,LdrInitializeThunk, | 15_2_02ED9780 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9710 NtQueryInformationToken,LdrInitializeThunk, | 15_2_02ED9710 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED95D0 NtClose,LdrInitializeThunk, | 15_2_02ED95D0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9540 NtReadFile,LdrInitializeThunk, | 15_2_02ED9540 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9A80 NtOpenDirectoryObject, | 15_2_02ED9A80 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9A20 NtResumeThread, | 15_2_02ED9A20 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9A00 NtProtectVirtualMemory, | 15_2_02ED9A00 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9A10 NtQuerySection, | 15_2_02ED9A10 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02EDA3B0 NtGetContextThread, | 15_2_02EDA3B0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9B00 NtSetValueKey, | 15_2_02ED9B00 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED98F0 NtReadVirtualMemory, | 15_2_02ED98F0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED98A0 NtWriteVirtualMemory, | 15_2_02ED98A0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02EDB040 NtSuspendThread, | 15_2_02EDB040 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9820 NtEnumerateKey, | 15_2_02ED9820 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED99D0 NtCreateProcessEx, | 15_2_02ED99D0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9950 NtQueueApcThread, | 15_2_02ED9950 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9660 NtAllocateVirtualMemory, | 15_2_02ED9660 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9670 NtQueryInformationProcess, | 15_2_02ED9670 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9650 NtQueryValueKey, | 15_2_02ED9650 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9610 NtEnumerateValueKey, | 15_2_02ED9610 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED97A0 NtUnmapViewOfSection, | 15_2_02ED97A0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9760 NtOpenProcess, | 15_2_02ED9760 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02EDA770 NtOpenThread, | 15_2_02EDA770 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9770 NtSetInformationFile, | 15_2_02ED9770 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9730 NtQueryVirtualMemory, | 15_2_02ED9730 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02EDA710 NtOpenProcessToken, | 15_2_02EDA710 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED95F0 NtQueryInformationFile, | 15_2_02ED95F0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9560 NtWriteFile, | 15_2_02ED9560 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02ED9520 NtWaitForSingleObject, | 15_2_02ED9520 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02EDAD30 NtSetContextThread, | 15_2_02EDAD30 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02A18680 NtReadFile, | 15_2_02A18680 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02A18700 NtClose, | 15_2_02A18700 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02A185D0 NtCreateFile, | 15_2_02A185D0 |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02A1867A NtReadFile, | 15_2_02A1867A |
| Source: C:\Windows\SysWOW64\ipconfig.exe | Code function: 15_2_02A185CF NtCreateFile, | 15_2_02A185CF |
| Source: LETTER OF INTENT.exe, 00000000.00000002.249251957.0000000006110000.00000004.08000000.00040000.00000000.sdmp | Binary or memory string: OriginalFilenameDotNetZipAdditionalPlatforms.dllZ vs LETTER OF INTENT.exe |
| Source: LETTER OF INTENT.exe, 00000000.00000002.245569266.000000000340A000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameSpaceChemSolver.dll@ vs LETTER OF INTENT.exe |
| Source: LETTER OF INTENT.exe, 00000000.00000002.245113869.000000000108E000.00000002.00000001.01000000.00000003.sdmp | Binary or memory string: OriginalFilenameConsoleSpecial.exeZ vs LETTER OF INTENT.exe |
| Source: LETTER OF INTENT.exe, 00000000.00000002.248115726.00000000045B2000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameDotNetZipAdditionalPlatforms.dllZ vs LETTER OF INTENT.exe |
| Source: LETTER OF INTENT.exe, 00000000.00000002.247039012.00000000043F1000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameDotNetZipAdditionalPlatforms.dllZ vs LETTER OF INTENT.exe |
| Source: LETTER OF INTENT.exe, 00000000.00000002.245528197.0000000001CA0000.00000004.08000000.00040000.00000000.sdmp | Binary or memory string: OriginalFilenameSpaceChemSolver.dll@ vs LETTER OF INTENT.exe |
| Source: LETTER OF INTENT.exe, 00000001.00000002.309332574.000000000142F000.00000040.00000800.00020000.00000000.sdmp | Binary or memory string: OriginalFilenamentdll.dllj% vs LETTER OF INTENT.exe |
| Source: LETTER OF INTENT.exe, 00000001.00000002.308765964.000000000129F000.00000040.00000800.00020000.00000000.sdmp | Binary or memory string: OriginalFilenamentdll.dllj% vs LETTER OF INTENT.exe |
| Source: LETTER OF INTENT.exe, 00000001.00000000.242878191.000000000072E000.00000002.00000001.01000000.00000003.sdmp | Binary or memory string: OriginalFilenameConsoleSpecial.exeZ vs LETTER OF INTENT.exe |
| Source: LETTER OF INTENT.exe, 00000001.00000002.307970163.0000000001157000.00000040.10000000.00040000.00000000.sdmp | Binary or memory string: OriginalFilenameipconfig.exej% vs LETTER OF INTENT.exe |
| Source: LETTER OF INTENT.exe, 00000001.00000002.307642624.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameipconfig.exej% vs LETTER OF INTENT.exe |
| Source: LETTER OF INTENT.exe, 00000001.00000002.307730478.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameipconfig.exej% vs LETTER OF INTENT.exe |
Edit tour
LETTER OF INTENT.exe (PID: 6272 cmdline: 
cmd.exe (PID: 5044 cmdline: 
explorer.exe (PID: 1692 cmdline: 
