Play interactive tour

Edit tour

Analysis Report New Order Request_0232147.exe

Overview

General Information

Sample Name:	New Order Request_0232147.exe
Analysis ID:	404158
MD5:	5133cbc9db4989d6fbb350e0829911c8
SHA1:	72052feec6f9f94fe0831a77bdf8c3493d268e37
SHA256:	fbdc2f9c6e970ae88ff30847c4d63472a0f0aa9b8e008e5b5c37f62ac526a963
Tags:	AgentTeslaexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

New Order Request_0232147.exe (PID: 6368 cmdline: 'C:\Users\user\Desktop\New Order Request_0232147.exe' MD5: 5133CBC9DB4989D6FBB350E0829911C8)

New Order Request_0232147.exe (PID: 6596 cmdline: {path} MD5: 5133CBC9DB4989D6FBB350E0829911C8)

New Order Request_0232147.exe (PID: 6604 cmdline: {path} MD5: 5133CBC9DB4989D6FBB350E0829911C8)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "calidad1@iruberritechnologies.comVpx7s4QHfJx7mail.iruberritechnologies.comrichardjortega@yandex.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.263302597.0000000004548000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.495432203.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.500811322.0000000002C51000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: New Order Request_0232147.exe PID: 6368	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: New Order Request_0232147.exe PID: 6368	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: New Order Request_0232147.exe PID: 6604	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: New Order Request_0232147.exe PID: 6604	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.New Order Request_0232147.exe.45ee328.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.New Order Request_0232147.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.New Order Request_0232147.exe.45ee328.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.New Order Request_0232147.exe.45ee328.3.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "calidad1@iruberritechnologies.comVpx7s4QHfJx7mail.iruberritechnologies.comrichardjortega@yandex.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: New Order Request_0232147.exe	Virustotal: Detection: 14%			Perma Link
Source: New Order Request_0232147.exe	ReversingLabs: Detection: 17%

Source: 5.2.New Order Request_0232147.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: New Order Request_0232147.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: New Order Request_0232147.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: global traffic

TCP traffic: 192.168.2.5:49730 -> 149.202.85.210:587

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: global traffic

TCP traffic: 192.168.2.5:49730 -> 149.202.85.210:587

Source: unknown

DNS traffic detected: queries for: mail.iruberritechnologies.com

Source: New Order Request_0232147.exe, 00000005.00000002.500811322.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: New Order Request_0232147.exe, 00000005.00000002.500811322.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: New Order Request_0232147.exe, 00000005.00000002.500811322.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: http://LPzxab.com
Source: New Order Request_0232147.exe, 00000005.00000002.503206058.0000000002F00000.00000004.00000001.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: New Order Request_0232147.exe, 00000005.00000002.503206058.0000000002F00000.00000004.00000001.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: New Order Request_0232147.exe, 00000005.00000002.503206058.0000000002F00000.00000004.00000001.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: New Order Request_0232147.exe, 00000005.00000002.503206058.0000000002F00000.00000004.00000001.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: New Order Request_0232147.exe, 00000005.00000002.503177096.0000000002EFA000.00000004.00000001.sdmp	String found in binary or memory: http://iruberritechnologies.com
Source: New Order Request_0232147.exe, 00000005.00000002.503177096.0000000002EFA000.00000004.00000001.sdmp	String found in binary or memory: http://mail.iruberritechnologies.com
Source: New Order Request_0232147.exe, 00000005.00000002.503206058.0000000002F00000.00000004.00000001.sdmp	String found in binary or memory: http://r3.i.lencr.org/0?
Source: New Order Request_0232147.exe, 00000005.00000002.503206058.0000000002F00000.00000004.00000001.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: New Order Request_0232147.exe, 00000000.00000003.237770203.000000000628E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: New Order Request_0232147.exe, 00000000.00000003.237770203.000000000628E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTC
Source: New Order Request_0232147.exe, 00000000.00000003.237770203.000000000628E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTCZ
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: New Order Request_0232147.exe, 00000000.00000003.243298062.0000000006285000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: New Order Request_0232147.exe, 00000000.00000002.259475460.00000000019A7000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comh
Source: New Order Request_0232147.exe, 00000000.00000002.259475460.00000000019A7000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comion
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: New Order Request_0232147.exe, 00000000.00000003.234986480.0000000006288000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn(
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: New Order Request_0232147.exe, 00000000.00000003.234986480.0000000006288000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnFYT/
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: New Order Request_0232147.exe, 00000000.00000003.242633271.0000000006285000.00000004.00000001.sdmp, New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: New Order Request_0232147.exe, 00000000.00000003.241640533.000000000628B000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: New Order Request_0232147.exe, 00000000.00000003.233482785.000000000629B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comTF
Source: New Order Request_0232147.exe, 00000000.00000003.233482785.000000000629B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comiv
Source: New Order Request_0232147.exe, 00000000.00000003.233482785.000000000629B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comt
Source: New Order Request_0232147.exe, 00000000.00000003.237365971.0000000006286000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: New Order Request_0232147.exe, 00000000.00000003.235097752.0000000006288000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com7
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: New Order Request_0232147.exe, 00000005.00000002.500811322.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: https://9TuO2oVE4tm8Yg0qRsK.org
Source: New Order Request_0232147.exe, 00000000.00000002.263302597.0000000004548000.00000004.00000001.sdmp, New Order Request_0232147.exe, 00000005.00000002.495432203.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: New Order Request_0232147.exe, 00000005.00000002.500811322.0000000002C51000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 5.2.New Order Request_0232147.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bEAE24690u002d1E26u002d4B8Cu002dAA5Bu002d108B71A5B425u007d/u00333AA9EBEu002d6032u002d421Du002dA6B8u002d318DAED5CBB5.cs

Large array initialization: .cctor: array initializer size 11983

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: New Order Request_0232147.exe

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_0578C43C	0_2_0578C43C
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_0578E4D0	0_2_0578E4D0
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_0578E4C3	0_2_0578E4C3
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE26E0	0_2_07AE26E0
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AEAE40	0_2_07AEAE40
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE5D30	0_2_07AE5D30
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE3540	0_2_07AE3540
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE1C88	0_2_07AE1C88
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE7CC8	0_2_07AE7CC8
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE8190	0_2_07AE8190
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE68E8	0_2_07AE68E8
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AEB0F0	0_2_07AEB0F0
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE1018	0_2_07AE1018
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE0040	0_2_07AE0040
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE0FB7	0_2_07AE0FB7
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE86A0	0_2_07AE86A0
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE5680	0_2_07AE5680
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE8690	0_2_07AE8690
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE26D0	0_2_07AE26D0
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AEAE32	0_2_07AEAE32
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AEC600	0_2_07AEC600
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE5670	0_2_07AE5670
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE6D80	0_2_07AE6D80
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AEC5F0	0_2_07AEC5F0
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE5D21	0_2_07AE5D21
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE2500	0_2_07AE2500
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE6D70	0_2_07AE6D70
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE04AA	0_2_07AE04AA
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE04B8	0_2_07AE04B8
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE7CB8	0_2_07AE7CB8
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE34D6	0_2_07AE34D6
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE7410	0_2_07AE7410
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE1C78	0_2_07AE1C78
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE4449	0_2_07AE4449
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE4458	0_2_07AE4458
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE73F6	0_2_07AE73F6
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AEAB68	0_2_07AEAB68
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AEAB78	0_2_07AEAB78
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE5B40	0_2_07AE5B40
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE52E8	0_2_07AE52E8
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE52F8	0_2_07AE52F8
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE58A0	0_2_07AE58A0
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE68BD	0_2_07AE68BD
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE5890	0_2_07AE5890
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AEB0E0	0_2_07AEB0E0
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE0006	0_2_07AE0006
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE6879	0_2_07AE6879
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00F92D50	5_2_00F92D50
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00F9F210	5_2_00F9F210
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00F91FEF	5_2_00F91FEF
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00F92768	5_2_00F92768
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00FF0AC4	5_2_00FF0AC4
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00FF3285	5_2_00FF3285
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00FF5B60	5_2_00FF5B60
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00FFC5D0	5_2_00FFC5D0
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00FF9198	5_2_00FF9198
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00FFBEE0	5_2_00FFBEE0
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00FF5EA8	5_2_00FF5EA8
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00FFC670	5_2_00FFC670
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_01050040	5_2_01050040
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_010543F0	5_2_010543F0
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_01053248	5_2_01053248
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_01054A75	5_2_01054A75
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_01058F40	5_2_01058F40
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_0105B790	5_2_0105B790
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_0105E567	5_2_0105E567
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_01059788	5_2_01059788
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_01059688	5_2_01059688

Source: New Order Request_0232147.exe, 00000000.00000002.262301254.00000000042A9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs New Order Request_0232147.exe
Source: New Order Request_0232147.exe, 00000000.00000002.258139630.0000000001002000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameqGOldQU8bPo4VOD.exeR vs New Order Request_0232147.exe
Source: New Order Request_0232147.exe, 00000000.00000002.263302597.0000000004548000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamempUIbZUCJJtYBvJwTrRUyqOpjFnkxPklNCt.exe4 vs New Order Request_0232147.exe
Source: New Order Request_0232147.exe, 00000000.00000002.259621608.00000000032A1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSmartFormat.dll8 vs New Order Request_0232147.exe
Source: New Order Request_0232147.exe, 00000004.00000000.254603815.00000000002E2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameqGOldQU8bPo4VOD.exeR vs New Order Request_0232147.exe
Source: New Order Request_0232147.exe, 00000005.00000000.256547687.0000000000962000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameqGOldQU8bPo4VOD.exeR vs New Order Request_0232147.exe
Source: New Order Request_0232147.exe, 00000005.00000002.497098410.0000000000CF8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs New Order Request_0232147.exe
Source: New Order Request_0232147.exe, 00000005.00000002.505433369.0000000006030000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs New Order Request_0232147.exe
Source: New Order Request_0232147.exe, 00000005.00000002.495432203.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamempUIbZUCJJtYBvJwTrRUyqOpjFnkxPklNCt.exe4 vs New Order Request_0232147.exe
Source: New Order Request_0232147.exe	Binary or memory string: OriginalFilenameqGOldQU8bPo4VOD.exeR vs New Order Request_0232147.exe

Source: New Order Request_0232147.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 5.2.New Order Request_0232147.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.2.New Order Request_0232147.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/1@6/1

Source: C:\Users\user\Desktop\New Order Request_0232147.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New Order Request_0232147.exe.log

Jump to behavior

Source: New Order Request_0232147.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\New Order Request_0232147.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: New Order Request_0232147.exe	Binary or memory string: SELECT DoctorId FROM PatientDoctor WHERE PatientId = {0};
Source: New Order Request_0232147.exe	Binary or memory string: SELECT * FROM Patients a INNER JOIN PatientDoctor b ON a.Id = b.PatientId WHERE b.DoctorId = {0} ORDER BY LastName;
Source: New Order Request_0232147.exe, 00000000.00000000.230290906.0000000000F02000.00000002.00020000.sdmp, New Order Request_0232147.exe, 00000004.00000002.256253349.00000000001E2000.00000002.00020000.sdmp, New Order Request_0232147.exe, 00000005.00000002.495906591.0000000000862000.00000002.00020000.sdmp	Binary or memory string: SELECT * FROM Patients a INNER JOIN PatientDoctor b ON a.Id = b.PatientId WHERE b.DoctorId = {0} ORDER BY LastName;oSELECT COUNT(*) FROM PatientDoctor WHERE DoctorId = {0}sSELECT DoctorId FROM PatientDoctor WHERE PatientId = {0};

Source: New Order Request_0232147.exe	Virustotal: Detection: 14%
Source: New Order Request_0232147.exe	ReversingLabs: Detection: 17%

Source: New Order Request_0232147.exe

String found in binary or memory: Administrators/addNewToolStripMenuItem

Source: unknown	Process created: C:\Users\user\Desktop\New Order Request_0232147.exe 'C:\Users\user\Desktop\New Order Request_0232147.exe'
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process created: C:\Users\user\Desktop\New Order Request_0232147.exe {path}
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process created: C:\Users\user\Desktop\New Order Request_0232147.exe {path}
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process created: C:\Users\user\Desktop\New Order Request_0232147.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process created: C:\Users\user\Desktop\New Order Request_0232147.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\New Order Request_0232147.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\New Order Request_0232147.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\New Order Request_0232147.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: New Order Request_0232147.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: New Order Request_0232147.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: New Order Request_0232147.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: New Order Request_0232147.exe

Static PE information: 0xF0C0A264 [Sun Dec 29 11:52:04 2097 UTC]

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE2F05 push ds; ret	0_2_07AE2F08
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE65EB push ecx; retf	0_2_07AE65EC
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AEC4CA push ebp; ret	0_2_07AEC4CD
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 0_2_07AE8182 push esp; retf	0_2_07AE8189
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00F954F0 pushfd ; ret	5_2_00F9561E
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00F9E6B0 pushfd ; ret	5_2_00F9E6D1
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00F97A37 push edi; retn 0000h	5_2_00F97A39
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00F9FB98 pushfd ; ret	5_2_00F9FDE6
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00FF912D push fs; iretd	5_2_00FF912F
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_00FF0650 push 99BC00D7h; ret	5_2_00FF06E6
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Code function: 5_2_013CDEEF push C802C3C1h; ret	5_2_013CDF6A

Source: initial sample

Static PE information: section name: .text entropy: 7.17013687848

Source: C:\Users\user\Desktop\New Order Request_0232147.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: New Order Request_0232147.exe PID: 6368, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\New Order Request_0232147.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\New Order Request_0232147.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: New Order Request_0232147.exe, 00000000.00000002.259851454.00000000032E5000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: New Order Request_0232147.exe, 00000000.00000002.259851454.00000000032E5000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Window / User API: threadDelayed 3749			Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Window / User API: threadDelayed 6072			Jump to behavior

Source: C:\Users\user\Desktop\New Order Request_0232147.exe TID: 6372	Thread sleep time: -31500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe TID: 6392	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe TID: 5480	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe TID: 5476	Thread sleep count: 3749 > 30	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe TID: 5476	Thread sleep count: 6072 > 30	Jump to behavior

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Thread delayed: delay time: 31500	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: New Order Request_0232147.exe, 00000000.00000002.259851454.00000000032E5000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: New Order Request_0232147.exe, 00000000.00000002.259851454.00000000032E5000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: New Order Request_0232147.exe, 00000000.00000002.259851454.00000000032E5000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: New Order Request_0232147.exe, 00000000.00000002.259851454.00000000032E5000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: New Order Request_0232147.exe, 00000000.00000002.259851454.00000000032E5000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: New Order Request_0232147.exe, 00000000.00000002.259851454.00000000032E5000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: New Order Request_0232147.exe, 00000000.00000002.259851454.00000000032E5000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: New Order Request_0232147.exe, 00000000.00000002.259851454.00000000032E5000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: New Order Request_0232147.exe, 00000000.00000002.259851454.00000000032E5000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\New Order Request_0232147.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\New Order Request_0232147.exe

Code function: 5_2_01050040 LdrInitializeThunk,

5_2_01050040

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\New Order Request_0232147.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\New Order Request_0232147.exe

Memory written: C:\Users\user\Desktop\New Order Request_0232147.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process created: C:\Users\user\Desktop\New Order Request_0232147.exe {path}			Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Process created: C:\Users\user\Desktop\New Order Request_0232147.exe {path}			Jump to behavior

Source: New Order Request_0232147.exe, 00000005.00000002.500108767.0000000001630000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: New Order Request_0232147.exe, 00000005.00000002.500108767.0000000001630000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: New Order Request_0232147.exe, 00000005.00000002.500108767.0000000001630000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: New Order Request_0232147.exe, 00000005.00000002.500108767.0000000001630000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: New Order Request_0232147.exe, 00000005.00000002.500108767.0000000001630000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Users\user\Desktop\New Order Request_0232147.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Users\user\Desktop\New Order Request_0232147.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\New Order Request_0232147.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.263302597.0000000004548000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.495432203.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New Order Request_0232147.exe PID: 6368, type: MEMORY
Source: Yara match	File source: Process Memory Space: New Order Request_0232147.exe PID: 6604, type: MEMORY
Source: Yara match	File source: 0.2.New Order Request_0232147.exe.45ee328.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.New Order Request_0232147.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Order Request_0232147.exe.45ee328.3.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\New Order Request_0232147.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\New Order Request_0232147.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\New Order Request_0232147.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000005.00000002.500811322.0000000002C51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New Order Request_0232147.exe PID: 6604, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.263302597.0000000004548000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.495432203.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New Order Request_0232147.exe PID: 6368, type: MEMORY
Source: Yara match	File source: Process Memory Space: New Order Request_0232147.exe PID: 6604, type: MEMORY
Source: Yara match	File source: 0.2.New Order Request_0232147.exe.45ee328.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.New Order Request_0232147.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Order Request_0232147.exe.45ee328.3.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping2	Query Registry1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	Credentials in Registry1	Security Software Discovery211	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing2	DCSync	System Information Discovery114	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Timestomp1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
New Order Request_0232147.exe	15%	Virustotal		Browse
New Order Request_0232147.exe	17%	ReversingLabs	ByteCode-MSIL.Trojan.Wacatac

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
5.2.New Order Request_0232147.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

Source	Detection	Scanner	Label	Link
iruberritechnologies.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comiv	0%	URL Reputation	safe
http://www.sajatypeworks.comiv	0%	URL Reputation	safe
http://www.sajatypeworks.comiv	0%	URL Reputation	safe
http://www.tiro.com7	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.carterandcone.comTCZ	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/0?	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://iruberritechnologies.com	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.sajatypeworks.comt	0%	URL Reputation	safe
http://www.sajatypeworks.comt	0%	URL Reputation	safe
http://www.sajatypeworks.comt	0%	URL Reputation	safe
http://www.sajatypeworks.comTF	0%	Avira URL Cloud	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://LPzxab.com	0%	Avira URL Cloud	safe
https://9TuO2oVE4tm8Yg0qRsK.org	0%	Avira URL Cloud	safe
http://www.fontbureau.comion	0%	URL Reputation	safe
http://www.fontbureau.comion	0%	URL Reputation	safe
http://www.fontbureau.comion	0%	URL Reputation	safe
http://www.founder.com.cn/cnFYT/	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://mail.iruberritechnologies.com	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.comh	0%	Avira URL Cloud	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.founder.com.cn/cn(	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
iruberritechnologies.com	149.202.85.210	true	true	0%, Virustotal, Browse	unknown
mail.iruberritechnologies.com	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	New Order Request_0232147.exe, 00000005.00000002.500811322.0000000002C51000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false		high
http://www.sajatypeworks.comiv	New Order Request_0232147.exe, 00000000.00000003.233482785.000000000629B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.com7	New Order Request_0232147.exe, 00000000.00000003.235097752.0000000006288000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false		high
http://www.carterandcone.comTCZ	New Order Request_0232147.exe, 00000000.00000003.237770203.000000000628E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.i.lencr.org/0?	New Order Request_0232147.exe, 00000005.00000002.503206058.0000000002F00000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	New Order Request_0232147.exe, 00000000.00000003.243298062.0000000006285000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com	New Order Request_0232147.exe, 00000000.00000003.237770203.000000000628E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://iruberritechnologies.com	New Order Request_0232147.exe, 00000005.00000002.503177096.0000000002EFA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	New Order Request_0232147.exe, 00000000.00000003.242633271.0000000006285000.00000004.00000001.sdmp, New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://r3.o.lencr.org0	New Order Request_0232147.exe, 00000005.00000002.503206058.0000000002F00000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.com	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	New Order Request_0232147.exe, 00000000.00000003.237365971.0000000006286000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	New Order Request_0232147.exe, 00000000.00000002.263302597.0000000004548000.00000004.00000001.sdmp, New Order Request_0232147.exe, 00000005.00000002.495432203.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.root-x1.letsencrypt.org0	New Order Request_0232147.exe, 00000005.00000002.503206058.0000000002F00000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false		high
http://DynDns.comDynDNS	New Order Request_0232147.exe, 00000005.00000002.500811322.0000000002C51000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.comt	New Order Request_0232147.exe, 00000000.00000003.233482785.000000000629B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.comTF	New Order Request_0232147.exe, 00000000.00000003.233482785.000000000629B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.letsencrypt.org0	New Order Request_0232147.exe, 00000005.00000002.503206058.0000000002F00000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	New Order Request_0232147.exe, 00000005.00000002.500811322.0000000002C51000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comTC	New Order Request_0232147.exe, 00000000.00000003.237770203.000000000628E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://LPzxab.com	New Order Request_0232147.exe, 00000005.00000002.500811322.0000000002C51000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://9TuO2oVE4tm8Yg0qRsK.org	New Order Request_0232147.exe, 00000005.00000002.500811322.0000000002C51000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comion	New Order Request_0232147.exe, 00000000.00000002.259475460.00000000019A7000.00000004.00000040.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cnFYT/	New Order Request_0232147.exe, 00000000.00000003.234986480.0000000006288000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://mail.iruberritechnologies.com	New Order Request_0232147.exe, 00000005.00000002.503177096.0000000002EFA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false		high
http://www.fontbureau.comh	New Order Request_0232147.exe, 00000000.00000002.259475460.00000000019A7000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://www.monotype.	New Order Request_0232147.exe, 00000000.00000003.241640533.000000000628B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	New Order Request_0232147.exe, 00000000.00000002.268539867.0000000006370000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn(	New Order Request_0232147.exe, 00000000.00000003.234986480.0000000006288000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.202.85.210	iruberritechnologies.com	France		16276	OVHFR	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	404158
Start date:	04.05.2021
Start time:	19:00:41
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	New Order Request_0232147.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/1@6/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 126 Number of non-executed functions: 25
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Excluded IPs from analysis (whitelisted): 93.184.220.29, 204.79.197.200, 13.107.21.200, 20.82.210.154, 13.88.21.125, 52.147.198.201, 92.122.145.220, 52.255.188.83, 104.43.139.144, 23.57.80.111, 2.20.142.210, 2.20.142.209, 92.122.213.194, 92.122.213.247, 20.54.26.129 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, cs9.wac.phicdn.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, ocsp.digicert.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:01:41	API Interceptor	706x Sleep call for process: New Order Request_0232147.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
149.202.85.210	Zwi#U0119ksz-2873037.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OVHFR	Transcation03232016646pdf.exe	Get hash	malicious	Browse	79.137.109.121
	5e60c283_by_Libranalysis.xlsm	Get hash	malicious	Browse	51.77.73.218
	MZyeln5mSFOjxMx.exe	Get hash	malicious	Browse	66.70.204.222
	5e60c283_by_Libranalysis.xlsm	Get hash	malicious	Browse	51.77.73.218
	51086cc4_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	8aa43191_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	5e60c283_by_Libranalysis.xlsm	Get hash	malicious	Browse	51.77.73.218
	51086cc4_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	8aa43191_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	840e7dfd_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	840e7dfd_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	94765446_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	d192feb6_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	7bc33f1c_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	94765446_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	448b5d7d_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	7bc33f1c_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	feb26e28_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	cfba18f5_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	ae394500_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New Order Request_0232147.exe.log Download File
Process:	C:\Users\user\Desktop\New Order Request_0232147.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.16370494238722
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	New Order Request_0232147.exe
File size:	1045504
MD5:	5133cbc9db4989d6fbb350e0829911c8
SHA1:	72052feec6f9f94fe0831a77bdf8c3493d268e37
SHA256:	fbdc2f9c6e970ae88ff30847c4d63472a0f0aa9b8e008e5b5c37f62ac526a963
SHA512:	8f13f01160e182cb9169ebaffc97e48f1f84661c613370cf9c9c77dc39b4e8c1686a74cd4e438530e27970a0fe9c0465043434aad000f66b4469f9009c0807e1
SSDEEP:	24576:Zv0t4KctioLA/9NjMjEjqRUj+hRZJr+F/:Zv0t4KEyYoOWaJr+F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...d.................0.................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x5007e2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xF0C0A264 [Sun Dec 29 11:52:04 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x100790	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x102000	0x604	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x104000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x100774	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xfe7e8	0xfe800	False	0.625946824349	data	7.17013687848	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x102000	0x604	0x800	False	0.330078125	data	3.44053524231	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x104000	0xc	0x200	False	0.044921875	data	0.0815394123432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x102090	0x374	data
RT_MANIFEST	0x102414	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2019
Assembly Version	1.0.0.0
InternalName	qGOldQU8bPo4VOD.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	HospitalManagementSystem
ProductVersion	1.0.0.0
FileDescription	HospitalManagementSystem
OriginalFilename	qGOldQU8bPo4VOD.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source IP	Dest IP
05/04/21-19:03:34.149691	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.5	8.8.8.8
05/04/21-19:03:35.147063	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.5	8.8.8.8
05/04/21-19:03:38.608596	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.5	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2021 19:03:35.674813986 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:35.724775076 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:35.724873066 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:35.874888897 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:35.875323057 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:35.925534010 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:35.925946951 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:35.978585005 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.029336929 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.059819937 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.131764889 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.131798983 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.131819963 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.131889105 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.139411926 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.189862013 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.232606888 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.524369955 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.574446917 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.576993942 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.627314091 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.628407001 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.717538118 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.732202053 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.733273029 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.783344030 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.784981966 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.848463058 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.849080086 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.899036884 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.903260946 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.903429031 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.903563023 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.903666019 CEST	49730	587	192.168.2.5	149.202.85.210
May 4, 2021 19:03:36.953233957 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.953267097 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.953285933 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:36.953876019 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:37.489578962 CEST	587	49730	149.202.85.210	192.168.2.5
May 4, 2021 19:03:37.529539108 CEST	49730	587	192.168.2.5	149.202.85.210

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2021 19:01:25.592560053 CEST	53	64344	8.8.8.8	192.168.2.5
May 4, 2021 19:01:26.003287077 CEST	62060	53	192.168.2.5	8.8.8.8
May 4, 2021 19:01:26.060152054 CEST	53	62060	8.8.8.8	192.168.2.5
May 4, 2021 19:01:26.093084097 CEST	61805	53	192.168.2.5	8.8.8.8
May 4, 2021 19:01:26.144553900 CEST	53	61805	8.8.8.8	192.168.2.5
May 4, 2021 19:01:26.345740080 CEST	54795	53	192.168.2.5	8.8.8.8
May 4, 2021 19:01:26.395255089 CEST	53	54795	8.8.8.8	192.168.2.5
May 4, 2021 19:01:27.437642097 CEST	49557	53	192.168.2.5	8.8.8.8
May 4, 2021 19:01:27.486398935 CEST	53	49557	8.8.8.8	192.168.2.5
May 4, 2021 19:01:28.266197920 CEST	61733	53	192.168.2.5	8.8.8.8
May 4, 2021 19:01:28.317600965 CEST	53	61733	8.8.8.8	192.168.2.5
May 4, 2021 19:01:29.049745083 CEST	65447	53	192.168.2.5	8.8.8.8
May 4, 2021 19:01:29.109853029 CEST	53	65447	8.8.8.8	192.168.2.5
May 4, 2021 19:01:29.161185026 CEST	52441	53	192.168.2.5	8.8.8.8
May 4, 2021 19:01:29.221350908 CEST	53	52441	8.8.8.8	192.168.2.5
May 4, 2021 19:01:30.116239071 CEST	62176	53	192.168.2.5	8.8.8.8
May 4, 2021 19:01:30.167891026 CEST	53	62176	8.8.8.8	192.168.2.5
May 4, 2021 19:01:30.920952082 CEST	59596	53	192.168.2.5	8.8.8.8
May 4, 2021 19:01:30.969603062 CEST	53	59596	8.8.8.8	192.168.2.5
May 4, 2021 19:01:31.944355965 CEST	65296	53	192.168.2.5	8.8.8.8
May 4, 2021 19:01:31.995897055 CEST	53	65296	8.8.8.8	192.168.2.5
May 4, 2021 19:01:32.728172064 CEST	63183	53	192.168.2.5	8.8.8.8
May 4, 2021 19:01:32.776891947 CEST	53	63183	8.8.8.8	192.168.2.5
May 4, 2021 19:01:34.211884022 CEST	60151	53	192.168.2.5	8.8.8.8
May 4, 2021 19:01:34.270097017 CEST	53	60151	8.8.8.8	192.168.2.5
May 4, 2021 19:01:35.463999987 CEST	56969	53	192.168.2.5	8.8.8.8
May 4, 2021 19:01:35.515537024 CEST	53	56969	8.8.8.8	192.168.2.5
May 4, 2021 19:01:50.874479055 CEST	55161	53	192.168.2.5	8.8.8.8
May 4, 2021 19:01:50.938227892 CEST	53	55161	8.8.8.8	192.168.2.5
May 4, 2021 19:02:02.922646046 CEST	54757	53	192.168.2.5	8.8.8.8
May 4, 2021 19:02:02.974347115 CEST	53	54757	8.8.8.8	192.168.2.5
May 4, 2021 19:02:21.236640930 CEST	49992	53	192.168.2.5	8.8.8.8
May 4, 2021 19:02:21.294007063 CEST	53	49992	8.8.8.8	192.168.2.5
May 4, 2021 19:02:45.338238955 CEST	60075	53	192.168.2.5	8.8.8.8
May 4, 2021 19:02:45.389822006 CEST	53	60075	8.8.8.8	192.168.2.5
May 4, 2021 19:02:55.162802935 CEST	55016	53	192.168.2.5	8.8.8.8
May 4, 2021 19:02:55.221085072 CEST	53	55016	8.8.8.8	192.168.2.5
May 4, 2021 19:03:10.427627087 CEST	64345	53	192.168.2.5	8.8.8.8
May 4, 2021 19:03:10.493542910 CEST	53	64345	8.8.8.8	192.168.2.5
May 4, 2021 19:03:30.029875040 CEST	57128	53	192.168.2.5	8.8.8.8
May 4, 2021 19:03:31.029841900 CEST	57128	53	192.168.2.5	8.8.8.8
May 4, 2021 19:03:32.045248032 CEST	57128	53	192.168.2.5	8.8.8.8
May 4, 2021 19:03:32.948568106 CEST	54791	53	192.168.2.5	8.8.8.8
May 4, 2021 19:03:32.997354031 CEST	53	54791	8.8.8.8	192.168.2.5
May 4, 2021 19:03:34.092262030 CEST	57128	53	192.168.2.5	8.8.8.8
May 4, 2021 19:03:34.134357929 CEST	53	57128	8.8.8.8	192.168.2.5
May 4, 2021 19:03:34.134438038 CEST	53	57128	8.8.8.8	192.168.2.5
May 4, 2021 19:03:34.149570942 CEST	53	57128	8.8.8.8	192.168.2.5
May 4, 2021 19:03:34.505417109 CEST	50463	53	192.168.2.5	8.8.8.8
May 4, 2021 19:03:35.146867037 CEST	53	57128	8.8.8.8	192.168.2.5
May 4, 2021 19:03:35.435235977 CEST	50394	53	192.168.2.5	8.8.8.8
May 4, 2021 19:03:35.492245913 CEST	53	50394	8.8.8.8	192.168.2.5
May 4, 2021 19:03:35.498763084 CEST	50463	53	192.168.2.5	8.8.8.8
May 4, 2021 19:03:35.558713913 CEST	53	50463	8.8.8.8	192.168.2.5
May 4, 2021 19:03:38.608398914 CEST	53	50463	8.8.8.8	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 4, 2021 19:03:34.149691105 CEST	192.168.2.5	8.8.8.8	d020	(Port unreachable)	Destination Unreachable
May 4, 2021 19:03:35.147063017 CEST	192.168.2.5	8.8.8.8	d020	(Port unreachable)	Destination Unreachable
May 4, 2021 19:03:38.608596087 CEST	192.168.2.5	8.8.8.8	d020	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 4, 2021 19:03:30.029875040 CEST	192.168.2.5	8.8.8.8	0x9dbd	Standard query (0)	mail.iruberritechnologies.com	A (IP address)	IN (0x0001)
May 4, 2021 19:03:31.029841900 CEST	192.168.2.5	8.8.8.8	0x9dbd	Standard query (0)	mail.iruberritechnologies.com	A (IP address)	IN (0x0001)
May 4, 2021 19:03:32.045248032 CEST	192.168.2.5	8.8.8.8	0x9dbd	Standard query (0)	mail.iruberritechnologies.com	A (IP address)	IN (0x0001)
May 4, 2021 19:03:34.092262030 CEST	192.168.2.5	8.8.8.8	0x9dbd	Standard query (0)	mail.iruberritechnologies.com	A (IP address)	IN (0x0001)
May 4, 2021 19:03:34.505417109 CEST	192.168.2.5	8.8.8.8	0xf0aa	Standard query (0)	mail.iruberritechnologies.com	A (IP address)	IN (0x0001)
May 4, 2021 19:03:35.498763084 CEST	192.168.2.5	8.8.8.8	0xf0aa	Standard query (0)	mail.iruberritechnologies.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 4, 2021 19:03:34.134357929 CEST	8.8.8.8	192.168.2.5	0x9dbd	No error (0)	mail.iruberritechnologies.com	iruberritechnologies.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 19:03:34.134357929 CEST	8.8.8.8	192.168.2.5	0x9dbd	No error (0)	iruberritechnologies.com		149.202.85.210	A (IP address)	IN (0x0001)
May 4, 2021 19:03:34.134438038 CEST	8.8.8.8	192.168.2.5	0x9dbd	No error (0)	mail.iruberritechnologies.com	iruberritechnologies.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 19:03:34.134438038 CEST	8.8.8.8	192.168.2.5	0x9dbd	No error (0)	iruberritechnologies.com		149.202.85.210	A (IP address)	IN (0x0001)
May 4, 2021 19:03:34.149570942 CEST	8.8.8.8	192.168.2.5	0x9dbd	No error (0)	mail.iruberritechnologies.com	iruberritechnologies.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 19:03:34.149570942 CEST	8.8.8.8	192.168.2.5	0x9dbd	No error (0)	iruberritechnologies.com		149.202.85.210	A (IP address)	IN (0x0001)
May 4, 2021 19:03:35.146867037 CEST	8.8.8.8	192.168.2.5	0x9dbd	No error (0)	mail.iruberritechnologies.com	iruberritechnologies.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 19:03:35.146867037 CEST	8.8.8.8	192.168.2.5	0x9dbd	No error (0)	iruberritechnologies.com		149.202.85.210	A (IP address)	IN (0x0001)
May 4, 2021 19:03:35.558713913 CEST	8.8.8.8	192.168.2.5	0xf0aa	No error (0)	mail.iruberritechnologies.com	iruberritechnologies.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 19:03:35.558713913 CEST	8.8.8.8	192.168.2.5	0xf0aa	No error (0)	iruberritechnologies.com		149.202.85.210	A (IP address)	IN (0x0001)
May 4, 2021 19:03:38.608398914 CEST	8.8.8.8	192.168.2.5	0xf0aa	No error (0)	mail.iruberritechnologies.com	iruberritechnologies.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 19:03:38.608398914 CEST	8.8.8.8	192.168.2.5	0xf0aa	No error (0)	iruberritechnologies.com		149.202.85.210	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 4, 2021 19:03:35.874888897 CEST	587	49730	149.202.85.210	192.168.2.5	220-ns3020561.ip-149-202-85.eu ESMTP Exim 4.94 #2 Tue, 04 May 2021 19:03:34 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 4, 2021 19:03:35.875323057 CEST	49730	587	192.168.2.5	149.202.85.210	EHLO 688098
May 4, 2021 19:03:35.925534010 CEST	587	49730	149.202.85.210	192.168.2.5	250-ns3020561.ip-149-202-85.eu Hello 688098 [84.17.52.3] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-X_PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 4, 2021 19:03:35.925946951 CEST	49730	587	192.168.2.5	149.202.85.210	STARTTLS
May 4, 2021 19:03:35.978585005 CEST	587	49730	149.202.85.210	192.168.2.5	220 TLS go ahead

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: New Order Request_0232147.exe PID: 6368 Parent PID: 5668

General

Start time:	19:01:32
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\New Order Request_0232147.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\New Order Request_0232147.exe'
Imagebase:	0xf00000
File size:	1045504 bytes
MD5 hash:	5133CBC9DB4989D6FBB350E0829911C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.263302597.0000000004548000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: New Order Request_0232147.exe PID: 6596 Parent PID: 6368

General

Start time:	19:01:43
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\New Order Request_0232147.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x1e0000
File size:	1045504 bytes
MD5 hash:	5133CBC9DB4989D6FBB350E0829911C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: New Order Request_0232147.exe PID: 6604 Parent PID: 6368

General

Start time:	19:01:44
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\New Order Request_0232147.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x860000
File size:	1045504 bytes
MD5 hash:	5133CBC9DB4989D6FBB350E0829911C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.495432203.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.500811322.0000000002C51000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: New Order Request_0232147.exe PID: 6368 Parent PID: 5668 New Order Request_0232147.exeCOMMON

Executed Functions

Function 07AE6879, Relevance: 2.8, Strings: 2, Instructions: 312COMMON

Download Yara Rule

Strings

id/6, xrefs: 07AE6A35
*H'a, xrefs: 07AE6C64

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: *H'a$id/6
API String ID: 0-571203939
Opcode ID: 704b958e63912f459f626c1c57f9a573dcc5e8b33b0b177d105c244aedc4c43c
Instruction ID: 210dd881b21764bed47a1ba3e300ea586e79a1fbcacd6e096930f07267c22337
Opcode Fuzzy Hash: 704b958e63912f459f626c1c57f9a573dcc5e8b33b0b177d105c244aedc4c43c
Instruction Fuzzy Hash: 2CD17AB0A18209DFC744DFA8E94989DBBF1FF89304B1484AAE91ADB260D734DD01CF94

Uniqueness

Uniqueness Score: -1.00%

Function 07AE68BD, Relevance: 2.8, Strings: 2, Instructions: 291COMMON

Download Yara Rule

Strings

id/6, xrefs: 07AE6A35
*H'a, xrefs: 07AE6C64

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: *H'a$id/6
API String ID: 0-571203939
Opcode ID: c537dc5a37065af64d65720567cd862d09e32718c9287bcd09afeeeeb1559fcb
Instruction ID: 39672f04d9a004a368857d54145edf42508af5c90fed4943602f4e093e69b76c
Opcode Fuzzy Hash: c537dc5a37065af64d65720567cd862d09e32718c9287bcd09afeeeeb1559fcb
Instruction Fuzzy Hash: 3DD158B4A18209DFC744DFA8E98899DBBF1FF89304B0484AAE51ADB260D734DD41CF95

Uniqueness

Uniqueness Score: -1.00%

Function 07AE68E8, Relevance: 2.8, Strings: 2, Instructions: 276COMMON

Download Yara Rule

Strings

id/6, xrefs: 07AE6A35
*H'a, xrefs: 07AE6C64

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: *H'a$id/6
API String ID: 0-571203939
Opcode ID: 7b8a5205522f9eb9012ce5bbabc0ffd045c9edea553046bdfc81daac05efeb1b
Instruction ID: a992373c2b276aaf81be082d8eb058a994398e11f41964f44c153087d97f4b29
Opcode Fuzzy Hash: 7b8a5205522f9eb9012ce5bbabc0ffd045c9edea553046bdfc81daac05efeb1b
Instruction Fuzzy Hash: 69D147B4A18209DFCB44DFA8E98899DBBF1FF89304B1584A9E51ADB260D7349D01CF94

Uniqueness

Uniqueness Score: -1.00%

Function 07AE8190, Relevance: 1.6, Strings: 1, Instructions: 354COMMON

Download Yara Rule

Strings

+~, xrefs: 07AE8551

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: +~
API String ID: 0-1503371684
Opcode ID: 1c69febfe9049eb0f82be18fca47939fd4e7197899485e26d3884940758215b6
Instruction ID: b2a8ca87a398d80b9c3391aa6a298e275aa08fc03338d85deb898e4119691ec3
Opcode Fuzzy Hash: 1c69febfe9049eb0f82be18fca47939fd4e7197899485e26d3884940758215b6
Instruction Fuzzy Hash: 86D1E2B0E0421A8FCB04CFB9C5405EFBBF6FF89304F159429D525AB354EB3999428BA1

Uniqueness

Uniqueness Score: -1.00%

Function 07AE34D6, Relevance: 1.6, Strings: 1, Instructions: 351COMMON

Download Yara Rule

Strings

xB7, xrefs: 07AE3729

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: xB7
API String ID: 0-4080973473
Opcode ID: ac002d6c1a5ff193c5ef619a06a121e65af7a9e891253a50f66d0e326a36bf0a
Instruction ID: 85fee5b17966d29d74deddb344666f2b68c2891ca01b3a6165953ad70c48f96b
Opcode Fuzzy Hash: ac002d6c1a5ff193c5ef619a06a121e65af7a9e891253a50f66d0e326a36bf0a
Instruction Fuzzy Hash: B7E13BB0E1420ADFCB04CFA6D4854AEFBB6FF8A311B549556C426AB314D734EA42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07AE3540, Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

xB7, xrefs: 07AE3729

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: xB7
API String ID: 0-4080973473
Opcode ID: e4ed72becc16f07877c602a927b6eac0e3fcf6316128a4ee82d33f923bcc8362
Instruction ID: 54c68dba22f895ea46f43b5e228f4cf9aa6181a25908b53e618497a224930157
Opcode Fuzzy Hash: e4ed72becc16f07877c602a927b6eac0e3fcf6316128a4ee82d33f923bcc8362
Instruction Fuzzy Hash: 4ED129B0D1420ADFCB04CFA6D5858AEFBB6FF8A301F509555D426AB314D734AA42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07AE7CC8, Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

m{sc, xrefs: 07AE7DEA

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: m{sc
API String ID: 0-1610968484
Opcode ID: 20abfd7de583bdbfc467c697eb111f4447c3c7fb27781d218c3ac40f6bcfaf04
Instruction ID: b195f9ede033fe54667ab0cb30febd5a208bd8666de6bf95126ee3f4de449301
Opcode Fuzzy Hash: 20abfd7de583bdbfc467c697eb111f4447c3c7fb27781d218c3ac40f6bcfaf04
Instruction Fuzzy Hash: 11A101B4E152198FCB48CFA9C9815EEFBF6BF89300F14D12AC415AB358E73499428F65

Uniqueness

Uniqueness Score: -1.00%

Function 07AE7CB8, Relevance: 1.5, Strings: 1, Instructions: 251COMMON

Download Yara Rule

Strings

m{sc, xrefs: 07AE7DEA

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: m{sc
API String ID: 0-1610968484
Opcode ID: 214211579cafb0a8ddbf97366a0a2158bbc1370e08f6bdb9e1cae9e30d13b471
Instruction ID: 05101531e6828e8062e95b982c6214787df7549c91b5a6e689534b1053ad93f7
Opcode Fuzzy Hash: 214211579cafb0a8ddbf97366a0a2158bbc1370e08f6bdb9e1cae9e30d13b471
Instruction Fuzzy Hash: 52A112B4E052598FCB48CFA9D9805EEFBF6BF89300F14816AC415AB358E7349942CB65

Uniqueness

Uniqueness Score: -1.00%

Function 07AE0FB7, Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

$~"-, xrefs: 07AE1213

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: $~"-
API String ID: 0-2987833466
Opcode ID: 804ebc941f0919fe81d4a8575f5d1dffb6ea285517a60b581524cd970ca44704
Instruction ID: 3a177ca6c9e5218b65f978630dab3e7bf7a53751a285323a1ecf59b3f164715e
Opcode Fuzzy Hash: 804ebc941f0919fe81d4a8575f5d1dffb6ea285517a60b581524cd970ca44704
Instruction Fuzzy Hash: B3A13575E152198FCB08CFA9D984ADEFBB2FF89310F24852AD419AB354D7309942CF94

Uniqueness

Uniqueness Score: -1.00%

Function 07AE1018, Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

$~"-, xrefs: 07AE1213

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: $~"-
API String ID: 0-2987833466
Opcode ID: 30a2abc0fdff7b612a4b69b9c2b114196ec1d80435e4dcc413e830be8eee155d
Instruction ID: b1f7064d5580f3d2e22a692634e984300d747f0c9be05e6afb6edce6d630c07a
Opcode Fuzzy Hash: 30a2abc0fdff7b612a4b69b9c2b114196ec1d80435e4dcc413e830be8eee155d
Instruction Fuzzy Hash: F781E3B4E142198FCB08CFE9D984AAEFBB2BF89300F20852AD519BB354D7359941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 07AEAB68, Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ea9ad0b64aeb02f1ed2c006453d31ca2b702af2d9687efbd8b21e4c7cf521b
Instruction ID: 61e0282cd67cdc50a0420d141300f5253281b46c28df592c37625509487d3bca
Opcode Fuzzy Hash: 67ea9ad0b64aeb02f1ed2c006453d31ca2b702af2d9687efbd8b21e4c7cf521b
Instruction Fuzzy Hash: 758136B4E1520ACFCB04DFA5D5819AEBBB6FF89300F10D42AD425BB354D7389A428F95

Uniqueness

Uniqueness Score: -1.00%

Function 07AEAE32, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e8115c33e96324131ac1c1882de9671aeea9730aeee1ca49397b2b2868cdab
Instruction ID: 6f1407a95c7f9b8d871e912a9d7083519b18b694230a9f504e78ca08f4b8efcc
Opcode Fuzzy Hash: e0e8115c33e96324131ac1c1882de9671aeea9730aeee1ca49397b2b2868cdab
Instruction Fuzzy Hash: BA619EB0E16219DFCB04CFA5D5846EDFBB6FF89310F24A42AE425BB254D3349946CB18

Uniqueness

Uniqueness Score: -1.00%

Function 07AEAE40, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ada8f7596143f63b2d121960f20f5e317628c499db49871c703b3264143e7a
Instruction ID: 26a02aa8b67cb3624422e315d2a1a6c305c791e2ae063c637d06545a51d77927
Opcode Fuzzy Hash: e0ada8f7596143f63b2d121960f20f5e317628c499db49871c703b3264143e7a
Instruction Fuzzy Hash: A2616FB0D16219DFCB05CFA5D584AEDFBB6FF89300F24A02AE425BB254D7349906CB14

Uniqueness

Uniqueness Score: -1.00%

Function 07AE0040, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7717f62041acaba3ddf856ec00707a5ed5e1c0babf644c574bcc69ee9fb1a8
Instruction ID: 978c2b84bd26d677f0aeb89cafca5838600fb222150543e002d25e9c0a053db1
Opcode Fuzzy Hash: 5a7717f62041acaba3ddf856ec00707a5ed5e1c0babf644c574bcc69ee9fb1a8
Instruction Fuzzy Hash: 9851D6B4E042199FDB04DFAAC981AEEFBB2FF89300F24C569D514AB254D7749942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07AE1C78, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0206defc2205e333aa7704c20087d8cb79eb4f4715307c10aa3e10be8ce3654a
Instruction ID: 66e5653d0b1fdb0e0c8869c279bb36e3bbb429eee2fb0818c7ac8a9d9efb58b5
Opcode Fuzzy Hash: 0206defc2205e333aa7704c20087d8cb79eb4f4715307c10aa3e10be8ce3654a
Instruction Fuzzy Hash: 52513DB0E0521D8FDB08CFAAC4816AEFBF6FF89200F14C42AD425A7254D7349A41CF95

Uniqueness

Uniqueness Score: -1.00%

Function 07AE1C88, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e6c57e3a2a4e96a49596f26504b5ea726fafe344e366ca67d51d6d92c3ffd5e
Instruction ID: f1b9e3aa3e347f9bcfc3f201595e084d1c970b4ea8d4c1e7658c28b468a21cbf
Opcode Fuzzy Hash: 5e6c57e3a2a4e96a49596f26504b5ea726fafe344e366ca67d51d6d92c3ffd5e
Instruction Fuzzy Hash: DC512CB0E0522D8FDB08CFAAD5816AEFBF6FF89200F14C02AD425B7254D7349A418F94

Uniqueness

Uniqueness Score: -1.00%

Function 07AE0006, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ac34b8a80a5d564beddf21486c5ce1ff63872c0b3d44b9b4dad9191ea776a0
Instruction ID: 600a10384c8e5877bd191354caa08f0328bc9d1949849fb0664b25050003fd81
Opcode Fuzzy Hash: a2ac34b8a80a5d564beddf21486c5ce1ff63872c0b3d44b9b4dad9191ea776a0
Instruction Fuzzy Hash: F7514870E052488FDB05CFAAC9406EEBBF2EF89300F15C1A6D414AB255DB749D46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07AEB0F0, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ae209a2a612a1ae15bd28cd7936acb0e98bfe21e6e7649062805632ae0dad9
Instruction ID: edef3dc933bac611bb827d93475669b1437d8f1af259eef330c5a12c2aaee44d
Opcode Fuzzy Hash: d7ae209a2a612a1ae15bd28cd7936acb0e98bfe21e6e7649062805632ae0dad9
Instruction Fuzzy Hash: 11514EB1E5461ACBDB28CF25C8487A9F7B6FFD9300F1082BAC11DA7614EB705A818F50

Uniqueness

Uniqueness Score: -1.00%

Function 07AEB0E0, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6d89a537fb6de19c7d089483b76782dce178239644608afddd8e145906f5f17
Instruction ID: d686dc49e8830f3f9229533419676b0710eae7e19e3c7b7d9e95a416920ce643
Opcode Fuzzy Hash: f6d89a537fb6de19c7d089483b76782dce178239644608afddd8e145906f5f17
Instruction Fuzzy Hash: C1412CB5E5461ACFDB28CF65C9487D9B7B2FFD8300F1482AAD11CA7654EB705A818F80

Uniqueness

Uniqueness Score: -1.00%

Function 07AE26E0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86c38ddc3a1806438bb2423060c044ebe0c4b3f88c0a1be1a2a95fdc267c424
Instruction ID: 91213e6af7dd68a411be471f8ffcd03c3db808414ce742ea5586182f9d846645
Opcode Fuzzy Hash: c86c38ddc3a1806438bb2423060c044ebe0c4b3f88c0a1be1a2a95fdc267c424
Instruction Fuzzy Hash: BD31D2B1E056188BDB18CFABD9446DEBBF7AFC8310F14C06A9509A6264DB341A46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07AE26D0, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765d4c52678cbd7b62191fb2c75a6b9dc233ab89db02758c3f1e61219ec0182d
Instruction ID: 329690e7f878bbd71cbf654a2a5ce46348e895d733b284d81180452de25dad6d
Opcode Fuzzy Hash: 765d4c52678cbd7b62191fb2c75a6b9dc233ab89db02758c3f1e61219ec0182d
Instruction Fuzzy Hash: 4121CCB0E056588BDB19CFABD9446DEBBF7AFC9300F14C07A9409AA264EB351945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07AE5D30, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b213088b827d5822dc47dcdf5dc7d7f14183062505bf90ef701a5469a3fbd079
Instruction ID: 1f79a573e6fff375b1d68a3a65815c6ce4f7fc970458b77f56b46f7baad2f7e9
Opcode Fuzzy Hash: b213088b827d5822dc47dcdf5dc7d7f14183062505bf90ef701a5469a3fbd079
Instruction Fuzzy Hash: 0021CDB1E056188BEB58CF6BDC4469EF7F7AFC8200F14C5BAC918A6224DB3416568F51

Uniqueness

Uniqueness Score: -1.00%

Function 0578B9D8, Relevance: 6.1, APIs: 4, Instructions: 125threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0578BA48
GetCurrentThread.KERNEL32 ref: 0578BA85
GetCurrentProcess.KERNEL32 ref: 0578BAC2
GetCurrentThreadId.KERNEL32 ref: 0578BB1B

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a04d15d3ca5298beaf8c9935c02ce40c6119310b8ca400972aa8e7bac048db76
Instruction ID: ae3cbabb46c5d029329883d1bfb407c25fb454e787ad7a77ed4294be7c716b4a
Opcode Fuzzy Hash: a04d15d3ca5298beaf8c9935c02ce40c6119310b8ca400972aa8e7bac048db76
Instruction Fuzzy Hash: 265142B09006098FDB10DFA9D989BEEBBF4EB48314F248459E819A7250D774A848CF66

Uniqueness

Uniqueness Score: -1.00%

Function 0578B9E8, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0578BA48
GetCurrentThread.KERNEL32 ref: 0578BA85
GetCurrentProcess.KERNEL32 ref: 0578BAC2
GetCurrentThreadId.KERNEL32 ref: 0578BB1B

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3c0c6238740ceb57fe947bf8d4da0950ac5e079907c64fd7389d34c18773bb0b
Instruction ID: 3b06553ae8e1c241a4722e13634f27ce85a7e80c08d91318a306d0baf6a58fc3
Opcode Fuzzy Hash: 3c0c6238740ceb57fe947bf8d4da0950ac5e079907c64fd7389d34c18773bb0b
Instruction Fuzzy Hash: A45142B09007098FDB14DFA9D989BEEBBF4FF48314F248459E809A7250D774A848CF66

Uniqueness

Uniqueness Score: -1.00%

Function 057896F0, Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 05789936

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f874ffadb7bb8538e2674a802d98f13a681c87fc0f2e817a58bc63626c56e9ab
Instruction ID: 84d811d1ead6df3c3a9e2201ecc5c1ff578294762ce49d5b869d3ae159ec4d6c
Opcode Fuzzy Hash: f874ffadb7bb8538e2674a802d98f13a681c87fc0f2e817a58bc63626c56e9ab
Instruction Fuzzy Hash: 67713670A04B058FD724EF2AD454BAABBF1BF88214F10892DD64ADBB40D735E845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07AECD00, Relevance: 1.6, APIs: 1, Instructions: 143processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 07AECE53

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: be6ef8c8001956369405876e75a1ebb06be3f2d9db120062d7a9662e47e35d12
Instruction ID: 1877390e74d609fc4c62343fa651fd0e47388f9563f5100e23bbef113bc319b8
Opcode Fuzzy Hash: be6ef8c8001956369405876e75a1ebb06be3f2d9db120062d7a9662e47e35d12
Instruction Fuzzy Hash: 29512AB1D00319DFDB50DF95C880BDDBBB5BF88314F158199E908A7250DB759A88CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0578FC4F, Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0578FD6A

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: db3074d39733d85d6b9dfb45bd0cc74a459b02c88eef8a7d1c6dd6836e5b4c49
Instruction ID: 324d0396caac5ed141a16516721f90a090773496d41610eff00e3165a52a52cc
Opcode Fuzzy Hash: db3074d39733d85d6b9dfb45bd0cc74a459b02c88eef8a7d1c6dd6836e5b4c49
Instruction Fuzzy Hash: AC51D0B1D103189FDB14DFAAC884ADEBFB5FF48314F24852AE919AB210D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0578FC58, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0578FD6A

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 09511857b8c95ee33d755ef5cad48610d90382d547121dd5a6701adad2673d06
Instruction ID: 714491772875ebe1d7490ae98c20d2eed8fb56adca149f3741e198115dc4d19b
Opcode Fuzzy Hash: 09511857b8c95ee33d755ef5cad48610d90382d547121dd5a6701adad2673d06
Instruction Fuzzy Hash: DD41C0B1D103189FDB14DFAAC884ADEBBB5BF48314F24812AE919AB210D7759985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05783DE4, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 05785421

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1d35ff6e17c86ce78c964a92ae586891b787f77ffad38fe2153b36ddcf1da775
Instruction ID: a5a362e1ff00d4b773a4b77b9f08b086b57248134a49a85de7cdb5b2ac13c8d5
Opcode Fuzzy Hash: 1d35ff6e17c86ce78c964a92ae586891b787f77ffad38fe2153b36ddcf1da775
Instruction Fuzzy Hash: F2411471C04618CFDB20DFA9C884BDEBBB5BF48308F208069D908AB351D7756949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05785364, Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 05785421

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a8b8aecf948dfc5a8e9897c20171c2fc0d67019d6831d570819f6f8058569e2b
Instruction ID: 0853402883a6596e818fc6b0a86ed81fa0f393ee720b66b73482ee2914db2c17
Opcode Fuzzy Hash: a8b8aecf948dfc5a8e9897c20171c2fc0d67019d6831d570819f6f8058569e2b
Instruction Fuzzy Hash: CC411271C04258CFDF24DFA9C884BDEBBB1BF48308F24805AD408AB251DB75698ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 07AED3C0, Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07AED44D

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 96539486efb19fe7f12106e353cdc2b3289c75f9352bfa6a1e96e2693293a2f6
Instruction ID: 14c60764ef949985aee95d465b011173f30cd8aa668ae165de50d94b66c6fe68
Opcode Fuzzy Hash: 96539486efb19fe7f12106e353cdc2b3289c75f9352bfa6a1e96e2693293a2f6
Instruction Fuzzy Hash: 892128B19003599FCB10CF9AD884BDEBBF4FF48310F10842AE918A7250D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0578BC10, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0578BC97

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fa0882101944c17ed98ce6981afd7b7218dc570e69b6022bdf6fdf32220ccb5b
Instruction ID: 0ae6d9fc96107965edf8be0279286ddfd396b2390fea95e79730268253471075
Opcode Fuzzy Hash: fa0882101944c17ed98ce6981afd7b7218dc570e69b6022bdf6fdf32220ccb5b
Instruction Fuzzy Hash: DA21D5B5D002089FDB10CFAAD584ADEBBF4FB48324F15841AE914A7350D379A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0578BC08, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0578BC97

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e4b15cbee5a91ed6c536b7be13ee168fa9b2e92af9e3d2bcde1587ff554ca425
Instruction ID: 28daab7bf3274a1af4b59f396739c9cd969dcdc97d967f1466b339d354c3e84a
Opcode Fuzzy Hash: e4b15cbee5a91ed6c536b7be13ee168fa9b2e92af9e3d2bcde1587ff554ca425
Instruction Fuzzy Hash: BF21E4B5D002089FDB10CFA9D584AEEBBF4FF48324F14851AE918A7350D378A944DF61

Uniqueness

Uniqueness Score: -1.00%

Function 07AED130, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07AED1AF

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8f2e0084839d959b2428a9caaa27b734f1e2fa3ac825da2c61a3827a8b1eaaf4
Instruction ID: 5391b725ce3c0baecfefba67bbfe5c6bf763118366ddba50874ff008c33f3969
Opcode Fuzzy Hash: 8f2e0084839d959b2428a9caaa27b734f1e2fa3ac825da2c61a3827a8b1eaaf4
Instruction Fuzzy Hash: 2221E4B59002599FCB10CFAAD884BDEBBF4FB48310F10842AE918A7250D374A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07AED070, Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 07AED0E7

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 36dbff8ec0c625862cdaec8b5cf728fbc8207f7e6470366130e567b1fde7a4a8
Instruction ID: 697e6609edacbc8f8b28ce793c637e8c6331bf3e298969e0328961f48e1f5f8a
Opcode Fuzzy Hash: 36dbff8ec0c625862cdaec8b5cf728fbc8207f7e6470366130e567b1fde7a4a8
Instruction Fuzzy Hash: C7211AB1E0061A9FCB10CF9AD585BEEFBF8FB48214F14812AD418B7240D778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05789148, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,057899B1,00000800,00000000,00000000), ref: 05789BC2

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3891ab415495e6b1fd4f6c16be2be00ddd8ba81a37af7a2ae11c6bdf69fb8e72
Instruction ID: 1aa499086c785d2e096d4997ed35f739b304fc4702709ad84959866a91925fa2
Opcode Fuzzy Hash: 3891ab415495e6b1fd4f6c16be2be00ddd8ba81a37af7a2ae11c6bdf69fb8e72
Instruction Fuzzy Hash: E51126B6D043089FCB10DF9AD444BEEFBF4EB98364F14842AEA15A7200C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05789B50, Relevance: 1.6, APIs: 1, Instructions: 51libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,057899B1,00000800,00000000,00000000), ref: 05789BC2

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2aa6a5e762387719371c5e9ba08818391c713e52fe4e1d78d290e7ff13afcb38
Instruction ID: a8dd6f6ed7f5fa75fe7495a4285239ffaa9a6c529768469e8b97dc559e1a19e8
Opcode Fuzzy Hash: 2aa6a5e762387719371c5e9ba08818391c713e52fe4e1d78d290e7ff13afcb38
Instruction Fuzzy Hash: 7511F3B69003488FDB10CF99D444BEEBBF0BB98324F15892ED525A7610C379A549CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07AED200, Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07AED26B

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3769f81b56a4c780615b4727c665cbe49925c029cb40081e9ad86821c57496b9
Instruction ID: be7a46eb4eb10bffa78f4d18f9a55fc474afef54b3d29a14ca2137c0b99ab83b
Opcode Fuzzy Hash: 3769f81b56a4c780615b4727c665cbe49925c029cb40081e9ad86821c57496b9
Instruction Fuzzy Hash: 4611F2B59006499FCB10DF9AD884BDEBFF8FB88324F148419E528A7250C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 057898D0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 05789936

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2e478b99e369ace50f989ee356accf4d7a5abe2fda6785e47ea71f9fd7bbb893
Instruction ID: fc247d7157fa1719892fadd393c9851dad4ad8879ba9595f40fadf4c221506e3
Opcode Fuzzy Hash: 2e478b99e369ace50f989ee356accf4d7a5abe2fda6785e47ea71f9fd7bbb893
Instruction Fuzzy Hash: 7B1113B5C006098FCB10DF9AD444BEEFBF4EF88224F15841AD529B7200D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07AED608, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07AEDCF5

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1c9cf71eee34266a4cc7ae794bbdec3c1bca751e80ad960f7588ca58014ffca3
Instruction ID: b454b17c0e3184b9e6169ab77970c8c292840d42fc438e61743050fe3e4ffa0b
Opcode Fuzzy Hash: 1c9cf71eee34266a4cc7ae794bbdec3c1bca751e80ad960f7588ca58014ffca3
Instruction Fuzzy Hash: 381103B59003499FCB10DF99D484BDEBBF8EB88324F10841AE925A7200C3B5A984CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 07AED578, Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07AED5D7

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 32fc339cd71485130fb38bf7447ebcb2c0dc302a7490c99455d678d1b788daa6
Instruction ID: b9ca737d7cea7fe930aa3528fced4a61315487af5362192033621f713063cdaa
Opcode Fuzzy Hash: 32fc339cd71485130fb38bf7447ebcb2c0dc302a7490c99455d678d1b788daa6
Instruction Fuzzy Hash: A01127B1900209CFCB10DF9AD484BDEFBF8EB48324F10841AD529A7200C775A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 015DD4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258510784.00000000015DD000.00000040.00000001.sdmp, Offset: 015DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05ea21a5013e2f1f1ec00feeb6690b63cb4f2870e2df9fee5a89ffe437f1c7c6
Instruction ID: 9ea95d5e6b9e44f3073e4f03d732c534316c56dbcaaf48728e838cc7f721f5bb
Opcode Fuzzy Hash: 05ea21a5013e2f1f1ec00feeb6690b63cb4f2870e2df9fee5a89ffe437f1c7c6
Instruction Fuzzy Hash: 2621C472504244DFDB25DF58D9C0B2ABFB5FB88318F248569D9054F286C336D455CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017CD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258959325.00000000017CD000.00000040.00000001.sdmp, Offset: 017CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91fb577fcd06047f18ac5ada161cd4c1d17afdfecb2597cca5f68a75ba7eabb2
Instruction ID: b2c5f9ca3db278f1b3d8ee81a38c5e9c13ebae78814669a559b6b63cf723a97f
Opcode Fuzzy Hash: 91fb577fcd06047f18ac5ada161cd4c1d17afdfecb2597cca5f68a75ba7eabb2
Instruction Fuzzy Hash: 2F213771604244DFCB21CF58D5C0B26FBA5FB88754F24C5BDD9094B246C336D887CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 017CD1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258959325.00000000017CD000.00000040.00000001.sdmp, Offset: 017CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a5c3340c4b7aa62c5dc14ee272349cfc317fe19ea1fa43b8443486be2789c8
Instruction ID: 81b1e608195565aaafe01a07197042a3cb09e68b823eb9f63c834db3953f2441
Opcode Fuzzy Hash: 47a5c3340c4b7aa62c5dc14ee272349cfc317fe19ea1fa43b8443486be2789c8
Instruction Fuzzy Hash: 7B2107B1608244DFDB11DF94D9C0B26FBA6FB88724F24C5BDD9494B246C336D846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 015DD4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258510784.00000000015DD000.00000040.00000001.sdmp, Offset: 015DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1123575b5aaf0881bfdd39de16f5a69e8cd5c354235142b97153b87f6fafa61c
Instruction ID: 6fb4ee6fd9a1064ac8159ee3b64e0143f7eccf7860bb422613a29963d5ff8474
Opcode Fuzzy Hash: 1123575b5aaf0881bfdd39de16f5a69e8cd5c354235142b97153b87f6fafa61c
Instruction Fuzzy Hash: E811B176504280DFCB12CF58D5C4B1ABF71FB88324F24C6A9D8450F656C33AD45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 017CD1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258959325.00000000017CD000.00000040.00000001.sdmp, Offset: 017CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b27aeed6b26fa5aada13b84e26f751cd76a2ab4377421a1e1d4cb90213a144
Instruction ID: 2fed8641a40c8b03e53616ec6bb7ed1410db3d8baa9757a1fc0755bd40c2f52c
Opcode Fuzzy Hash: 21b27aeed6b26fa5aada13b84e26f751cd76a2ab4377421a1e1d4cb90213a144
Instruction Fuzzy Hash: 0911BE75508280DFCB12CF54C5C0B15FBA2FB84724F24C6ADD8494B656C33AD45ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 017CD017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258959325.00000000017CD000.00000040.00000001.sdmp, Offset: 017CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b27aeed6b26fa5aada13b84e26f751cd76a2ab4377421a1e1d4cb90213a144
Instruction ID: 7773b54c2851f6ec5cd6a4c3f2854d8238269bf776cc14869c12fadb26996ee9
Opcode Fuzzy Hash: 21b27aeed6b26fa5aada13b84e26f751cd76a2ab4377421a1e1d4cb90213a144
Instruction Fuzzy Hash: 0B110075504280CFCB12CF18D5C0B15FFA1FB88314F24C6ADD8094B656C33AD44ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 015DD651, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258510784.00000000015DD000.00000040.00000001.sdmp, Offset: 015DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87533cbd8496d807c4d835f268a8b99c0889e0e1781d30aebb2674cbfebe7b1
Instruction ID: 1cdd440ec8074ab13534f537a2c748c11c455d10a66dcd5c1b7423c5c64947df
Opcode Fuzzy Hash: d87533cbd8496d807c4d835f268a8b99c0889e0e1781d30aebb2674cbfebe7b1
Instruction Fuzzy Hash: 9C01F7720083449BE7208A6DCD84B66BFE8FF40234F19845AEE085E2C2C378D444CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 015DD650, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258510784.00000000015DD000.00000040.00000001.sdmp, Offset: 015DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78bc613f3cb38daaafe3db7395bb48093655a13d965764e333ea993947d7326a
Instruction ID: b76fbf8b0c307fff8f878f85115ec08286f31708e5fadcdc15d04c86a5747e80
Opcode Fuzzy Hash: 78bc613f3cb38daaafe3db7395bb48093655a13d965764e333ea993947d7326a
Instruction Fuzzy Hash: E6F068714043449FE7218A59DDC4B66FFE8EB41774F18C45AEE085F286C3799844CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07AE58A0, Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

B;jO, xrefs: 07AE58FA
ol, xrefs: 07AE5993

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: B;jO$ol
API String ID: 0-515534814
Opcode ID: 605438e281fd617b5135ed9345194047980c49a948ebc2cab955115375eb2058
Instruction ID: 730731f966c8c1f14cf27b0faea36cc032e354be4d904360226ecfdd7f5b3ef2
Opcode Fuzzy Hash: 605438e281fd617b5135ed9345194047980c49a948ebc2cab955115375eb2058
Instruction Fuzzy Hash: A371E4B4E15209DFCB08CFA9D9805DEFBF6FB89214F28942AD415BB214D3349A528B64

Uniqueness

Uniqueness Score: -1.00%

Function 07AE5890, Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

B;jO, xrefs: 07AE58FA
ol, xrefs: 07AE5993

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: B;jO$ol
API String ID: 0-515534814
Opcode ID: ada27c09bc651d966df81213240f4aeb2bcba308c9f96b24148e6fef0027d970
Instruction ID: 473a27b791b09416e8e9773e5a626714724f7be904215a69bd33e63c2d30121d
Opcode Fuzzy Hash: ada27c09bc651d966df81213240f4aeb2bcba308c9f96b24148e6fef0027d970
Instruction Fuzzy Hash: 657104B4E15209CFCB08CFA9D9805DEFBF6EF8D214F28942AD415B7214D3349A52CB64

Uniqueness

Uniqueness Score: -1.00%

Function 07AE4458, Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

mal, xrefs: 07AE44AA

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: mal
API String ID: 0-2276259572
Opcode ID: 6b1013f0f8eea4c2ec56d89c4fa0fdf2c8eba0354c5a2f2c958a606e97cc2663
Instruction ID: 38239df60b71ddcbb6926059b61787293dab7423396198c1f985e7d358db511e
Opcode Fuzzy Hash: 6b1013f0f8eea4c2ec56d89c4fa0fdf2c8eba0354c5a2f2c958a606e97cc2663
Instruction Fuzzy Hash: AD71D0B4A10219CFCB44CFA9D58499EFBFAFF89210F258169E419AB310D334AA42CF55

Uniqueness

Uniqueness Score: -1.00%

Function 07AE4449, Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

mal, xrefs: 07AE44AA

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: mal
API String ID: 0-2276259572
Opcode ID: c8d4bc42098b5afbde7506d4c4086a0a25f9f18a33e5240b541f325918b1ec6f
Instruction ID: 8c73b1887ed694b6cf4e94f3e36cb07475b8f8fbe32f3d535250ad75118e9809
Opcode Fuzzy Hash: c8d4bc42098b5afbde7506d4c4086a0a25f9f18a33e5240b541f325918b1ec6f
Instruction Fuzzy Hash: 3571E274A10259CFCB44CFA9D58499EFBF6FF89310F24845AE415AB310D334AA42CF55

Uniqueness

Uniqueness Score: -1.00%

Function 07AE52E8, Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

z[, xrefs: 07AE543E

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: z[
API String ID: 0-2546902386
Opcode ID: d1bc5e5c30d0c8854217d7ac11064b92a9b8c6ac1fe69579a79d9f309e2e47bb
Instruction ID: c1566c84cc847802d47be00bc9ea709e9c5c88b111176ceec6bec0e753596630
Opcode Fuzzy Hash: d1bc5e5c30d0c8854217d7ac11064b92a9b8c6ac1fe69579a79d9f309e2e47bb
Instruction Fuzzy Hash: 31615EB4E1420ADFCB08CFA5D8815EEFBB6EF89304F248466D425A7314D7749652CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07AE52F8, Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

z[, xrefs: 07AE543E

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: z[
API String ID: 0-2546902386
Opcode ID: e6cf86bca5db56e926ae3ab562fe01dcf9f8a08ba322cac73bb96cbc284be986
Instruction ID: eba78e86060a7b5300fb57d23a3a1ee64116bc596d97037b53cce4f84e1ee655
Opcode Fuzzy Hash: e6cf86bca5db56e926ae3ab562fe01dcf9f8a08ba322cac73bb96cbc284be986
Instruction Fuzzy Hash: DD613CB0E1420ADFCB08CFA6D9805EEFBB6EF89304F248129D425B7214D7749652CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07AE86A0, Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

a:/6, xrefs: 07AE8717

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: a:/6
API String ID: 0-1451524808
Opcode ID: 0ba223def2588d92c9ed85752411c82202814798a0daa9b82d7f980ab8694b1a
Instruction ID: a571e27b5cafc6c07fc75791561f51731ccf210086a808111ed36f663ab8e659
Opcode Fuzzy Hash: 0ba223def2588d92c9ed85752411c82202814798a0daa9b82d7f980ab8694b1a
Instruction Fuzzy Hash: 61517EB0E142198BDB14CF9AD9805AEFBF6FFC9304F24D1A9D818A7215D7349A42CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07AE8690, Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

a:/6, xrefs: 07AE8717

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID: a:/6
API String ID: 0-1451524808
Opcode ID: 480e377dbfa2d8c92e519cd9a8103c7fb53f3e507caab8c6bb5fd14ef81b23e8
Instruction ID: 39f43add686e2e6ca3628ab76c5bd3d5e233abbdba319e5e8ca9e474c0e36f51
Opcode Fuzzy Hash: 480e377dbfa2d8c92e519cd9a8103c7fb53f3e507caab8c6bb5fd14ef81b23e8
Instruction Fuzzy Hash: 80515FB0E142598FDB14CF5AC9805ADFBF6FF89304F24D1A9D418A7215D7349A41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0578E4D0, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 974038862a1cb79f66dd59c8624d2a737c294335938a6b4296b15afb8ebc524f
Instruction ID: 5ed6b2b05accb1894b8aff0312e333764d2b6603b027304beedc7e3be2eaf515
Opcode Fuzzy Hash: 974038862a1cb79f66dd59c8624d2a737c294335938a6b4296b15afb8ebc524f
Instruction Fuzzy Hash: E81293F142174A8AD310CF65E99B58D3FA1B74932CB90C308E2616FAD1DFB8154AEF94

Uniqueness

Uniqueness Score: -1.00%

Function 0578C43C, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ae1617e6bd4232e84fdc5c9740011487fe50b85fce197cc8aa93d8cc7d223b9
Instruction ID: d5f1e492a1a328d81c3a49661205be1eee00352f1f241db648cbbe807eedcee3
Opcode Fuzzy Hash: 1ae1617e6bd4232e84fdc5c9740011487fe50b85fce197cc8aa93d8cc7d223b9
Instruction Fuzzy Hash: 87A19032E50219CFCF15EFA5C8489EDBBB6FF85300B15816AE805BB260EB31A945DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0578E4C3, Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.267523516.0000000005780000.00000040.00000001.sdmp, Offset: 05780000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a038db24ec1f86f1db4f7466897a899d5990c649b055b256ec6bc39fbda0d265
Instruction ID: 575448241f52206523a454df8292b8f0fa747c8f59ea1484f5e61caab461ad06
Opcode Fuzzy Hash: a038db24ec1f86f1db4f7466897a899d5990c649b055b256ec6bc39fbda0d265
Instruction Fuzzy Hash: CDC1FAB18217498AD710DF65E98B18D7FA1BB8932CF508308E2616FAD0DFB4154AEF94

Uniqueness

Uniqueness Score: -1.00%

Function 07AE6D80, Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3cbec180c0a7f0b204851832529bf494be41a9e45bde7b656c60e2f5d8f7d4
Instruction ID: 92bfbb42e7f4a1e0892fbf0bfe1369aac192373b4fc217077eee7ad7e11804c1
Opcode Fuzzy Hash: 8d3cbec180c0a7f0b204851832529bf494be41a9e45bde7b656c60e2f5d8f7d4
Instruction Fuzzy Hash: 8F9149B4E142198FCB14CF69D980AAEFBB6FF89300F24C1A9D519A7315D7309A81CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07AE6D70, Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1cac2cc3a5c832fc642a6314f23e5f28c2b5a0435b11714968050cd31e75608
Instruction ID: 4fd212b729fcc10f624d704eb64f5b97206f59e0c87ce2ed6045f31ddb848723
Opcode Fuzzy Hash: c1cac2cc3a5c832fc642a6314f23e5f28c2b5a0435b11714968050cd31e75608
Instruction Fuzzy Hash: 6D8138B4E142199FCB14CF69D980AAEFBB6FF89200F24C1A9D419A7355D7309A41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07AEC600, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c44ef847b6fc7cdaf2edb5415609dea39c14bc713ac266f856c6aaa11b64cb
Instruction ID: 8e0d1ccdbc66e7dc81ca8c4c6fddc5881b842f935ddca9825ea21430dd9b9a64
Opcode Fuzzy Hash: 69c44ef847b6fc7cdaf2edb5415609dea39c14bc713ac266f856c6aaa11b64cb
Instruction Fuzzy Hash: 2D8138B0E142198FCB14CF69D980AAEFBB6FF89310F24D1A9D419A7355D7309A81CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07AEC5F0, Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a2777f2bcd62c41122fb871a3b651e950c15e97ea16aa5c858893bcd912502
Instruction ID: cfb07d1affd7f345cc8917094499ebceef09e7205843463e47a447012e5518ad
Opcode Fuzzy Hash: 97a2777f2bcd62c41122fb871a3b651e950c15e97ea16aa5c858893bcd912502
Instruction Fuzzy Hash: 608138B4E142199FCB14CF69C980AAEFBB6FF89310F24D1AAD418A7355D7309A41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07AEAB78, Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0a0d780323d36f06dbbc437e96fb8db7c84a48e62785f5c94a69e71cf3a324
Instruction ID: 8acfbcd2b57d15322e8f00c75c0d6f1baa17bc534612e46decb21d4cff02e802
Opcode Fuzzy Hash: cd0a0d780323d36f06dbbc437e96fb8db7c84a48e62785f5c94a69e71cf3a324
Instruction Fuzzy Hash: 317104B4E1520ACFCB04DFA6D5859AEFBB6FF89300F10D42AD425B7214D7389A428F95

Uniqueness

Uniqueness Score: -1.00%

Function 07AE2500, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa989329d8ccc3fcbc6b46dbd4dda16c63d32a79acb22399afe997eb7338646
Instruction ID: 78cdebbf60ebe947b59d2d191306d755054e01ac536706d15878dc810f5a728e
Opcode Fuzzy Hash: dfa989329d8ccc3fcbc6b46dbd4dda16c63d32a79acb22399afe997eb7338646
Instruction Fuzzy Hash: 20519FB0D1560ADFCB04CFA9C5805EEFBBAFF89310F248526E515B7254D730AA42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07AE5670, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c721a8a0a80f77d998ac15a0428016a36070f768958ee3807b0495bb53dc7d
Instruction ID: 01342541aa7917051880dfd79f55d28e7c4210137ba2a71c5bc9f6dd849669a8
Opcode Fuzzy Hash: 74c721a8a0a80f77d998ac15a0428016a36070f768958ee3807b0495bb53dc7d
Instruction Fuzzy Hash: 894109B0D1420ACFCB04CFAAD9815EEFBF6AF99200F24D46AC415E7214D7349A55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07AE5680, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432eca8efbce4b2c4e935adc059a26065ec2980cf42dd061648e31a74eced6c4
Instruction ID: d0a2f2d7a1cad89456f22fc67bba394e3a470dc9641eeae725c594d7ba9d0ef8
Opcode Fuzzy Hash: 432eca8efbce4b2c4e935adc059a26065ec2980cf42dd061648e31a74eced6c4
Instruction Fuzzy Hash: FC41F7B0D1420ADFCB04CFAAD9815AEFBF6BF89304F24D42AC425A7214D7349A558F95

Uniqueness

Uniqueness Score: -1.00%

Function 07AE5B40, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f926b63a0a51fc0a2c79c60b055cb01dc588d6bca46ee57600d3ea015010a6
Instruction ID: f3471dc3ba0b0eda9e64aed4138d46b5335203636490f28e7cafb28eae8c2170
Opcode Fuzzy Hash: d0f926b63a0a51fc0a2c79c60b055cb01dc588d6bca46ee57600d3ea015010a6
Instruction Fuzzy Hash: 8A4147B0E0520A9FCB44CFA9D9815EEFBF2FF89304F24C16AC415A7254E7309A518FA4

Uniqueness

Uniqueness Score: -1.00%

Function 07AE04B8, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45feca42421cdf7a832707350cd7c57afb049114b1ec9bb27e4253f3f9520b9
Instruction ID: 1dea57c111c7e30495264afb657940830b37250e3312d42b569f9c4e9b0b8674
Opcode Fuzzy Hash: c45feca42421cdf7a832707350cd7c57afb049114b1ec9bb27e4253f3f9520b9
Instruction Fuzzy Hash: 5F31C9B5E056199BEB58CFABD94079EFAF7FBC8300F14C0AAC518A6254DB304A418F51

Uniqueness

Uniqueness Score: -1.00%

Function 07AE04AA, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231e658b97083d0fd75e75c892ab87703c539a57405629f09039173f811b2ed2
Instruction ID: 6566551e09d2534a400518be5e1a00fd4e90188de8877a06e80f84a991a9b2c9
Opcode Fuzzy Hash: 231e658b97083d0fd75e75c892ab87703c539a57405629f09039173f811b2ed2
Instruction Fuzzy Hash: 1831D9B5E056199BEB18CFABC95069EBAF3AFC8200F14C0AAC508AA254DB3049418F52

Uniqueness

Uniqueness Score: -1.00%

Function 07AE7410, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b788cbb22eec01eb9292b8dc2f9e709b6859a15d3d91bc3d627b17eb04133148
Instruction ID: f890b8eacb25babc958b97f42994581e1533828e8c9e0d9018d19c79bfac4ed2
Opcode Fuzzy Hash: b788cbb22eec01eb9292b8dc2f9e709b6859a15d3d91bc3d627b17eb04133148
Instruction Fuzzy Hash: F11117B1E112199BDB48CFAAD941ADEFBF7EFC8210F14C03AD518A7214EB345A458B51

Uniqueness

Uniqueness Score: -1.00%

Function 07AE73F6, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a38ff16fd23cec928725728cd42b098e1bf98877778786b1068ed01a8da68d
Instruction ID: 8e46a4fcdd85583f99530ca085ffa219a42c65b6e1c93f302d3b53d076c82756
Opcode Fuzzy Hash: 46a38ff16fd23cec928725728cd42b098e1bf98877778786b1068ed01a8da68d
Instruction Fuzzy Hash: 44214AB1E156598FDB48CFAAD9406DEFBF3AFC9200F14C06AD508A7254DB344A46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07AE5D21, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269815881.0000000007AE0000.00000040.00000001.sdmp, Offset: 07AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0a154a67197d21c2e67b04b1d86d4732f240b12b69cc491af27d921ef1dd37
Instruction ID: dff5aaf80a9c9084a965a4e773fa7ddc8b0c3eeb4feb8d09d556ff512bf161e2
Opcode Fuzzy Hash: 8b0a154a67197d21c2e67b04b1d86d4732f240b12b69cc491af27d921ef1dd37
Instruction Fuzzy Hash: 6C11D7B1E056188BEB1CCF6BD8446DEFBF3AFC8200F14C17AC918A6264EB3405568F51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: New Order Request_0232147.exe PID: 6604 Parent PID: 6368 New Order Request_0232147.exeCOMMON

Executed Functions

Function 01050040, Relevance: 2.3, APIs: 1, Instructions: 760libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 010507C8

Memory Dump Source

Source File: 00000005.00000002.499283194.0000000001050000.00000040.00000001.sdmp, Offset: 01050000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ba29fbe63cc35131c0751884308e70f552ae9bea848f967a0b2786456498efab
Instruction ID: dd5c9db98fffde3d6c95a36773e23602e803c433b3a50b897175044364578f85
Opcode Fuzzy Hash: ba29fbe63cc35131c0751884308e70f552ae9bea848f967a0b2786456498efab
Instruction Fuzzy Hash: 95623B31E006198FDB64EF78C95869EB7F1AF89304F1085A9D54AAB354EF30AE85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0105B790, Relevance: 2.0, APIs: 1, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499283194.0000000001050000.00000040.00000001.sdmp, Offset: 01050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a37ff08d86336073e727056134f55de7e675dacc0c8a52ac27243a5e0766893
Instruction ID: dc674159f251f71fa18eeace21d886626a09f7568e3d8785f5ec0abbe5711ece
Opcode Fuzzy Hash: 7a37ff08d86336073e727056134f55de7e675dacc0c8a52ac27243a5e0766893
Instruction Fuzzy Hash: 1602BC30B002059FDB54EBB8C858BAEBBE7AF85304F1588A9E506DB295DF74EC058B51

Uniqueness

Uniqueness Score: -1.00%

Function 00F92D50, Relevance: .9, Instructions: 886COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b81a38a1ebef87fe564b32f35b1b0adeab3ce8f141289966be7b994323c58b1
Instruction ID: 3f3ee898843b992d7ce25e5bb8d48f763f7ade97655b038d5ce3141094f612b1
Opcode Fuzzy Hash: 9b81a38a1ebef87fe564b32f35b1b0adeab3ce8f141289966be7b994323c58b1
Instruction Fuzzy Hash: 2E823831A04209DFEF14CF68C984AAEBBF2BF88354F158559E446DB2A1DB30EE41DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F91FEF, Relevance: .5, Instructions: 510COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1569c1ee99c80a05687770084a12bc286661f41d74d62842df0a3e25415b8322
Instruction ID: ed1ee896d80cbebd416ad743733b99b5e0b1897fe1ec83edde34cde84918bebb
Opcode Fuzzy Hash: 1569c1ee99c80a05687770084a12bc286661f41d74d62842df0a3e25415b8322
Instruction Fuzzy Hash: 32129B70A002099FDB58DF68C894BAEBBF2BF88314F118569E506EB395DB34DC45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F9F210, Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f9a456a1dbb05a0b8fdb325acb5d1a68e3b50f0a225427fe0f2793f28171d52
Instruction ID: 1d0dc6cfba860e10bec7e456cde4284bdd2517c5961db927197501a921c68338
Opcode Fuzzy Hash: 0f9a456a1dbb05a0b8fdb325acb5d1a68e3b50f0a225427fe0f2793f28171d52
Instruction Fuzzy Hash: A0D19130B002045FDB28EB75899876EB6E3AFC4718F258478D51AEB388DF75EC058B91

Uniqueness

Uniqueness Score: -1.00%

Function 00F92768, Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859c7b3e0d44b8511c0a919be14923bce334d82d1a24b0a67362443f98f7c430
Instruction ID: 3be51c7fcb58d770c6fda6dafc6fb8aa38c2a8a626043695de753179f10499c5
Opcode Fuzzy Hash: 859c7b3e0d44b8511c0a919be14923bce334d82d1a24b0a67362443f98f7c430
Instruction Fuzzy Hash: F8E10571E00109EFEF94CFA9D984AADBBF2BF98310F158169E805AB261D735DC41EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F9E8C0, Relevance: 5.4, Strings: 4, Instructions: 379COMMON

Download Yara Rule

Strings

\, xrefs: 00F9EA09
\, xrefs: 00F9E939
\, xrefs: 00F9EAFE
\, xrefs: 00F9EAC3

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID: \$\$\$\
API String ID: 0-3238275731
Opcode ID: 159b46ff608fe3cbd1e09995e4cb1c3c4f36c774667ee8e2820b8484ad808e33
Instruction ID: 7282358a88f474c2446c324cbcb2c3f28445d3e1335cefb250d2dd3c145c518e
Opcode Fuzzy Hash: 159b46ff608fe3cbd1e09995e4cb1c3c4f36c774667ee8e2820b8484ad808e33
Instruction Fuzzy Hash: EDE18C74E002448FDB54EFB4D998BAEB7B6BF84314F148929D816EB354EB34AC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F95660, Relevance: 2.0, Instructions: 2017COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce56731e9aa3fe012264ed4f5b5ceed7113f887de5fff30c5c47218842d4a7e7
Instruction ID: e4805f84ed9a7e2d4c2bc5a944f61e6125f61272c683814841115363b3629ea9
Opcode Fuzzy Hash: ce56731e9aa3fe012264ed4f5b5ceed7113f887de5fff30c5c47218842d4a7e7
Instruction Fuzzy Hash: E9B24B266EE2E64FD7174778AEB72B97F99DE82120708C2FBC4841E5E6C912444FC712

Uniqueness

Uniqueness Score: -1.00%

Function 010518A0, Relevance: 1.7, APIs: 1, Instructions: 180libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 010518E1

Memory Dump Source

Source File: 00000005.00000002.499283194.0000000001050000.00000040.00000001.sdmp, Offset: 01050000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e41e75a545c0ac6c9e735bdd4e2814be5c8ebfda5f5c0eb6ebef2039f39731be
Instruction ID: c75338a45fd417c9e7536c1b9e9b6c85d59bfe925902cedf75dd5f11f9e8d098
Opcode Fuzzy Hash: e41e75a545c0ac6c9e735bdd4e2814be5c8ebfda5f5c0eb6ebef2039f39731be
Instruction Fuzzy Hash: 20618D31A012099FDB54EFB4D458BAFBBF6AF84304F148828E842E7394EF759945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0105E178, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499283194.0000000001050000.00000040.00000001.sdmp, Offset: 01050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f2dba4576680f6c44866197af835131c2a1f9987c61dc8a1ab2dae30f2fb3ec
Instruction ID: 4b45aa79c6e5f1ea336c0578aee00d006f3694698aa71dffdfda9edb8da9c056
Opcode Fuzzy Hash: 0f2dba4576680f6c44866197af835131c2a1f9987c61dc8a1ab2dae30f2fb3ec
Instruction Fuzzy Hash: A5413472E043898FCB00CFA9C8042DEFFF5AF89210F0985AAD945E7641DB389845CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00FFDF08, Relevance: 1.6, APIs: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00FFE01C

Memory Dump Source

Source File: 00000005.00000002.499192809.0000000000FF0000.00000040.00000001.sdmp, Offset: 00FF0000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e6dd7b71c81eff6534c9713dda0a11adf46d9baef8c813d6816742c30a041cf9
Instruction ID: 48139629162453224223a520a5c72e86bfe09a5a6959e7266cc5e3ac6919ab1a
Opcode Fuzzy Hash: e6dd7b71c81eff6534c9713dda0a11adf46d9baef8c813d6816742c30a041cf9
Instruction Fuzzy Hash: 9D417670E043498FCB00CFA8C488A9EBFF2BF49304F29C16AE509AB355C7B59845CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00FFE1C4, Relevance: 1.6, APIs: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00FFE289

Memory Dump Source

Source File: 00000005.00000002.499192809.0000000000FF0000.00000040.00000001.sdmp, Offset: 00FF0000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c0cd990300578a087a49886b5bb5d9cb2cbae6805cd9e65d5d50cf9e3f7ba6a9
Instruction ID: ea29a5467d732d57da1313c9929b0547d4319978a92bd8ebdb84ee692c9cff7a
Opcode Fuzzy Hash: c0cd990300578a087a49886b5bb5d9cb2cbae6805cd9e65d5d50cf9e3f7ba6a9
Instruction Fuzzy Hash: 9741E2B1D002589FCB10CFE9D984ADEBBF5BF48314F15812AE819AB360D7749945DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FFBBD0, Relevance: 1.6, APIs: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00FFE289

Memory Dump Source

Source File: 00000005.00000002.499192809.0000000000FF0000.00000040.00000001.sdmp, Offset: 00FF0000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b91936bba38f452c06bbaab27e9c41a1c678bfa6574c9d3bc2428cd2c3176927
Instruction ID: f4c4747965157947515132e19ef112f6a1958c6d5a8424600138079af240c32d
Opcode Fuzzy Hash: b91936bba38f452c06bbaab27e9c41a1c678bfa6574c9d3bc2428cd2c3176927
Instruction Fuzzy Hash: 8E31E2B1D002589FCB20CF9AD584ADEBBF5BF48310F55802AE919AB320E770A905DF90

Uniqueness

Uniqueness Score: -1.00%

Function 01051840, Relevance: 1.6, APIs: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 010518E1

Memory Dump Source

Source File: 00000005.00000002.499283194.0000000001050000.00000040.00000001.sdmp, Offset: 01050000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5622cd07d644669b84bcbe8a0ea8047723ffe4938a78efd19b603b06568768c7
Instruction ID: 04fb094fff8c248d6d500bb78b2603cd19ab38f9b81dbbcb76bd55459548090d
Opcode Fuzzy Hash: 5622cd07d644669b84bcbe8a0ea8047723ffe4938a78efd19b603b06568768c7
Instruction Fuzzy Hash: 19310F30A053849FCB55CBB8D458BEE7FB2BF86304F1584A9D441AB392D771C845CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00FFBBC4, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00FFE01C

Memory Dump Source

Source File: 00000005.00000002.499192809.0000000000FF0000.00000040.00000001.sdmp, Offset: 00FF0000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c22d549ec70bfbdfb5563b99255f0f18ba0f23dad455ed484140bfab82cb6688
Instruction ID: d2aa282c39ed307f1daa49975406cc76a339aae76072d61156b10051155e5a73
Opcode Fuzzy Hash: c22d549ec70bfbdfb5563b99255f0f18ba0f23dad455ed484140bfab82cb6688
Instruction Fuzzy Hash: 2A3130B1D003488FCB10CF99C188B9EFBF5BF48304F29816AE909AB360C7B59944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0105E248, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0105E1CA), ref: 0105E2B7

Memory Dump Source

Source File: 00000005.00000002.499283194.0000000001050000.00000040.00000001.sdmp, Offset: 01050000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 2006db905935888752e0ec0b21e3df8eedb629e1ac10e5bfb2f56fa09bfab4e2
Instruction ID: 5be8d4ad63cdba59ff70fd055e2193ceb1debc4476ca328efbc36b7c87d5b655
Opcode Fuzzy Hash: 2006db905935888752e0ec0b21e3df8eedb629e1ac10e5bfb2f56fa09bfab4e2
Instruction Fuzzy Hash: 3C1133B1C006599FCB10CFAAD444BEEFBF4BB48224F15816AD918B7240D378A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0105CCB0, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0105E1CA), ref: 0105E2B7

Memory Dump Source

Source File: 00000005.00000002.499283194.0000000001050000.00000040.00000001.sdmp, Offset: 01050000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: dd6eb55a407ca2e7d980b23c58a71660203139e66565a9b759231f0d13b7ac6f
Instruction ID: dbf594e6d21119b288a76011dd1a2836c12c445a60f68ff07cfb596ab340ca14
Opcode Fuzzy Hash: dd6eb55a407ca2e7d980b23c58a71660203139e66565a9b759231f0d13b7ac6f
Instruction Fuzzy Hash: 3F1133B1C006199FCB10CF9AC544BEEFBF4EB48224F15816AE958B7240D378A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 00F9E87F, Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

\, xrefs: 00F9E939

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: 539395842c3159345688ffcf8c14d0b4df5e10d85aaecdf5c6118331559c76ed
Instruction ID: f496d7031b77983eb02ba6575e36400d9263a66a62e783ae60b583582f3463d3
Opcode Fuzzy Hash: 539395842c3159345688ffcf8c14d0b4df5e10d85aaecdf5c6118331559c76ed
Instruction Fuzzy Hash: 3B310131E042454FEF05CB688C657FE7BB5EF81314F18806BD459DB282EB74990997A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F9CF50, Relevance: .7, Instructions: 729COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1728fca9536a30362e6f4d1a8d024ae2c3eb4c6921168048fb62915dd783fc0c
Instruction ID: 95fedcc9a60a1b37fa5909b8a883909915af5726e43c42cbbf36a56c7b0820ff
Opcode Fuzzy Hash: 1728fca9536a30362e6f4d1a8d024ae2c3eb4c6921168048fb62915dd783fc0c
Instruction Fuzzy Hash: F142DC30F042048FDB14EBB4D858BADBBB2AF85314F2584AAE505DB3A5DB35DC46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F93E28, Relevance: .7, Instructions: 693COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f9a4f4f46cca03510fd6d8b0d94dddde1865398db7ceb0a0d484a2add1773f
Instruction ID: 3486d96581d476839250e0beafac50aa286dac98f3808928c6d3203ee83dc72c
Opcode Fuzzy Hash: 12f9a4f4f46cca03510fd6d8b0d94dddde1865398db7ceb0a0d484a2add1773f
Instruction Fuzzy Hash: 3F524234E0811C9FEB24DBA0C960B9EB7B3EF94344F1180A9C21AAB794DB359D85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F9A770, Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e899983354289e772ec800f71cc5738c5a920e2fce2fc96f3410d68f6a1aa2
Instruction ID: ed6097d350afc1f67d61fbbed26b68a87c5fbaa9733e22660c81e4d5d6526719
Opcode Fuzzy Hash: e5e899983354289e772ec800f71cc5738c5a920e2fce2fc96f3410d68f6a1aa2
Instruction Fuzzy Hash: C0F1ED30B042048FDB14DBB8D9586AEBBF2EF89354F15846AE406DB3A1DB35DC45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F9BC88, Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b68e4bf274adad60593f78271f1dcce74cd13e21b0fadc4451a9465add66d65
Instruction ID: 49f88c43f17b0f97ba20cea2c08539c3a730d5a53c4da6f7e8b0f8241bad8682
Opcode Fuzzy Hash: 2b68e4bf274adad60593f78271f1dcce74cd13e21b0fadc4451a9465add66d65
Instruction Fuzzy Hash: 5BE19A31B002048FDB05ABB4D5586AEBBF2AF85354F148579E50ADB3A5EF35DC86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F9EE40, Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b0b38442decba7c1a9d62638152426f8fc777c7de9a20027fecd579ede5c72
Instruction ID: fa2be1c620c0bba259ff90466c3c19d37d79fa4a702a2b9998ba89a00620a499
Opcode Fuzzy Hash: f8b0b38442decba7c1a9d62638152426f8fc777c7de9a20027fecd579ede5c72
Instruction Fuzzy Hash: 75D1B230B0E3C55FEB52933888256963FB69F43344F1A80F7D544CB297EA25DC4A8762

Uniqueness

Uniqueness Score: -1.00%

Function 00F94B68, Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf938355f0de047cf0125c2d242e8916e014f1fc22661762d21a4b7c462defcb
Instruction ID: c73dec95cd989e4b35b5f04d304ee791a7934d62bfd052619db9c61e656f9e15
Opcode Fuzzy Hash: bf938355f0de047cf0125c2d242e8916e014f1fc22661762d21a4b7c462defcb
Instruction Fuzzy Hash: 4CF11B75E002158FDB14CFA9D888DADBBF2BF98315B1680A9E515EB361DB30EC42DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F9DF98, Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 174cc8338c1a6996afa537d7a7ce0a182ce8602c347c49c6cd68a71d861a5f0e
Instruction ID: 2698638f0b7637df0de97dcb223f3490ec7e761c2086a9e7da33081f4a83c8de
Opcode Fuzzy Hash: 174cc8338c1a6996afa537d7a7ce0a182ce8602c347c49c6cd68a71d861a5f0e
Instruction Fuzzy Hash: 18D18B34E043488FDB11DBB4D858A9DBBB6BF85304F1480AAE549EB396EB359C46CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00F9FA48, Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a4f5cb9c49ff0a79ecec3f65a24311ba7ed27ea0f5b263c8e89d763891bfa7
Instruction ID: 21ab620bd711d69b8f034e99dac477ce2efcb9f6fad92655691ca8df8d5fd94f
Opcode Fuzzy Hash: 16a4f5cb9c49ff0a79ecec3f65a24311ba7ed27ea0f5b263c8e89d763891bfa7
Instruction Fuzzy Hash: 30B1EE31E042058FDF24DF78C8906BEBBF6AF85310B15887AD506DB291CA34DD4ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F92D40, Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5409b8e0404bcb9db467d4e80032e22d1bdb6d53fd58c74e9e160ba2afd98877
Instruction ID: 7d75ddf65f002cde7e3e0b369a2ec07eca67aa628ab57561e7a5644d9f712968
Opcode Fuzzy Hash: 5409b8e0404bcb9db467d4e80032e22d1bdb6d53fd58c74e9e160ba2afd98877
Instruction Fuzzy Hash: 56C16930A002099FDF24CFA9C984AAEBBF2FF59318F158559E845EB261D731ED41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F9B120, Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a75f10d723b9c1f014fca08f1c79da4338682fe29c215fb6b2b7592307c974
Instruction ID: 62821fb3a29080be992002c60878fffa872ff13f28010f97ac57a3680aad3bf3
Opcode Fuzzy Hash: 12a75f10d723b9c1f014fca08f1c79da4338682fe29c215fb6b2b7592307c974
Instruction Fuzzy Hash: B7918E31F046058FCB15EFB4D5586AEBBB2EF94358B148869D502E7758EF31A9098B80

Uniqueness

Uniqueness Score: -1.00%

Function 00F95280, Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ed759ff7ed64bb319109adc08d71e1abf1844c890ac5db84a351deffb640dd
Instruction ID: 3e15c5c29d97f2988cea69ca9575f02cedba6f268515541227d83779f148244c
Opcode Fuzzy Hash: e0ed759ff7ed64bb319109adc08d71e1abf1844c890ac5db84a351deffb640dd
Instruction Fuzzy Hash: 4691C231A046198FDF12CF68C884E6EBBB2FF45761F1684A9E8159B362C770EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F94C70, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6883702221a92814bc9cd9de6e4d62ca15e05623992a920623f5bd45e56b1210
Instruction ID: 0a02aca90be44952e46bea9c89e624c18bdf7ad88dc7667c1baeae1113a9b652
Opcode Fuzzy Hash: 6883702221a92814bc9cd9de6e4d62ca15e05623992a920623f5bd45e56b1210
Instruction Fuzzy Hash: 4A91D175E002198FDB14CFA9D588D9DBBF2BB98359F168099E405AB361DB30FC82DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F9182F, Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d33b51f5e5ef7d6845a3d9f2aa80c0144a22090468893618312de5841b38cbc
Instruction ID: 5ee2eb9c8573f2e8dcc9c11801ab39db767cc8859eb31ebec946f86f57f3205f
Opcode Fuzzy Hash: 2d33b51f5e5ef7d6845a3d9f2aa80c0144a22090468893618312de5841b38cbc
Instruction Fuzzy Hash: EC61BD30B002028FEB19AA24C4A477EB7E2BFC9365B158979D546CB385CF74CC46EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F91AC0, Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3274d5ba76439ca9af461c04245f2a538e9fb4928a67462053ef6d47535386d
Instruction ID: 1c2860914a2e0b8179788fc867d0df07ea072282f80682f8d3a7f105eafb2830
Opcode Fuzzy Hash: a3274d5ba76439ca9af461c04245f2a538e9fb4928a67462053ef6d47535386d
Instruction Fuzzy Hash: 3E71AC35E40106CFEF18CF69C484AAAB7B2BF89355B25817AD412EB361D731EC01DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F9B110, Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 206eeb863214fc64545eaf55f30b30e810236bd54972524c261b91b33c0cc79d
Instruction ID: 7f7372530625daee409c0d2948027261c840f21d736ab4c0aeb2480f7f8a0d6a
Opcode Fuzzy Hash: 206eeb863214fc64545eaf55f30b30e810236bd54972524c261b91b33c0cc79d
Instruction Fuzzy Hash: F0619E31B00605CFCB18EFB1D65C6AE76A2AFD4358F148868D402E7748EF75AD4A8B90

Uniqueness

Uniqueness Score: -1.00%

Function 00F93AC8, Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e2a33acd6368fdcbf02867391ca401c6826a3fd0d3d6501a87762c6c95e2d7
Instruction ID: 1d55ba4aea2823791afe958e7387e456b443d2e1a7be39eb221c49290822bc3c
Opcode Fuzzy Hash: c9e2a33acd6368fdcbf02867391ca401c6826a3fd0d3d6501a87762c6c95e2d7
Instruction Fuzzy Hash: E451BF327045159FEB14DF3EC888A6ABBE9FF8875071544AAE406CB361EB31DD00EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D9B8, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d246d218551682a29b033b512a98fd01b5ff29f2395a3054f0283303c5b45172
Instruction ID: d258806a6705da6fe39720faac8c65153fe4354128164b8f3c740a1761b5a8f0
Opcode Fuzzy Hash: d246d218551682a29b033b512a98fd01b5ff29f2395a3054f0283303c5b45172
Instruction Fuzzy Hash: 26510330B042485FEB15AB74C8943AE7BE6AF85344F26807AE5059B381DF78DC46C751

Uniqueness

Uniqueness Score: -1.00%

Function 00F9C538, Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95529d8d1d22f710bed989d215b495f331c5249421ffbe8c626dcf436c6f432b
Instruction ID: 07dac403b19b7c2da838c465f6828f008010981309138ed114d91e6452b728dd
Opcode Fuzzy Hash: 95529d8d1d22f710bed989d215b495f331c5249421ffbe8c626dcf436c6f432b
Instruction Fuzzy Hash: 10415E31B003159FCB10AFB8E95C59EBBFAEF88315B144965E91AD7348DF35AD018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00F9B611, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73cc03be3637b9b359bc96402d3360f45dd7efdf920b74aedd04c7424b56a8d1
Instruction ID: 05cc0bf9041e0906e6166381554e9fb30c31715a19f172578b3430a281e936af
Opcode Fuzzy Hash: 73cc03be3637b9b359bc96402d3360f45dd7efdf920b74aedd04c7424b56a8d1
Instruction Fuzzy Hash: 9E419331B4D3C44FDB029775982869A3FA15F86310F1A80FBE545CB697EF28DC0A8752

Uniqueness

Uniqueness Score: -1.00%

Function 00F9EC30, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c6417e34a9df7b68e6861df8fd68c911089c51a1e618ce8ac2dc030fca80d93
Instruction ID: 4c574ef116145487db6d481c486644573d1bc0ea304520e049baa9b6b62cd950
Opcode Fuzzy Hash: 8c6417e34a9df7b68e6861df8fd68c911089c51a1e618ce8ac2dc030fca80d93
Instruction Fuzzy Hash: 3151E878E11349CFCB40EFA4E999ADDBBB1BB88340B548965D801E7728EB316D45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F9C488, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b520583099e0c41f02848d6116b16b8c99248c6f9b3ba22a58f03c7c8c9cd5bb
Instruction ID: 9b21e7c4bdb0bb14f94c84222172b6f663a8cdf103f30349cdb5f4b44eb38efb
Opcode Fuzzy Hash: b520583099e0c41f02848d6116b16b8c99248c6f9b3ba22a58f03c7c8c9cd5bb
Instruction Fuzzy Hash: C2414830B093855FCB01A77888697A97FF6AF86304F0A84F6D504DB387EA35DC098791

Uniqueness

Uniqueness Score: -1.00%

Function 00F9BC28, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2384bd2ebc907bbe4476d1c6dca9655895f186983476ad6128e9f4652260f2d
Instruction ID: 46093efeb8a39ac483921136e2232814cd98ac44d615b5c160adb4d1647401df
Opcode Fuzzy Hash: f2384bd2ebc907bbe4476d1c6dca9655895f186983476ad6128e9f4652260f2d
Instruction Fuzzy Hash: 0C41E131F103448FCB05ABB8A51866EBBE3AB89354F0484B9D40ADB395EF35DC06CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F916C8, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf8fc9ecb11a6455ee06be53249381fb719b4292152419f92c95effa2bb8c06
Instruction ID: 48b88eabf387acb8427431ee552a5d8b8e378208e37e9c893e9a64405ea7b9f5
Opcode Fuzzy Hash: daf8fc9ecb11a6455ee06be53249381fb719b4292152419f92c95effa2bb8c06
Instruction Fuzzy Hash: 7241E175A042168FEF168F64C854BAE7BF2FB89354F118965E806DB380CB34CC11DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F92618, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb825b8f64d3757a92d3b81d8fb30784df52b2acf42dd6c8cad34af352427b15
Instruction ID: 50167aebcb2a9e9f1170e4314794ce183e7de6a6d702b3a2bf7758fdd8b9d3f4
Opcode Fuzzy Hash: fb825b8f64d3757a92d3b81d8fb30784df52b2acf42dd6c8cad34af352427b15
Instruction Fuzzy Hash: 7F410131A00208EFEF54DF60C800BAABBF6EB84324F04846AE916EB650CB35DC55DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F938D8, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d3426b91a7f5fed4a9999036aaf11e27b262ca1f79da36b9c6489af58ebef37
Instruction ID: 0db3fe3f513c9936de1d0f13ef9b1c42358d3cbae7cc9a3879e8b53a403c883e
Opcode Fuzzy Hash: 0d3426b91a7f5fed4a9999036aaf11e27b262ca1f79da36b9c6489af58ebef37
Instruction Fuzzy Hash: 16414875A001158FDF14DF29C888BAA7BB6BF89354F100069F956DB3A0CB71DE50DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F954F0, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83d58aeeabbbaea513c99d008d3aee5fb4789b1cfb3ae3e171984cfb8bfb84e
Instruction ID: d921a8ee76a280b72edd371c6073dba911202cf7a91cc249a31541d531958fb8
Opcode Fuzzy Hash: f83d58aeeabbbaea513c99d008d3aee5fb4789b1cfb3ae3e171984cfb8bfb84e
Instruction Fuzzy Hash: 003106317046408FDB079F24D81466A3BE3AF85714B0A88A9E90ACB392DB34CD16DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F9C99F, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7bd7f0905a2f3bf3c23ef53eac78b429ecac635bc590aa13f1842e3dd5bfbf7
Instruction ID: dd6858413af4b7d059e1f343bef3f822b5a80e194f21aefac13f9543e29fda52
Opcode Fuzzy Hash: b7bd7f0905a2f3bf3c23ef53eac78b429ecac635bc590aa13f1842e3dd5bfbf7
Instruction Fuzzy Hash: E931A271F041194B9B69E678886476F35E39BC8368B258528D51ADB7C8DF38CC02A7D2

Uniqueness

Uniqueness Score: -1.00%

Function 00F9F738, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab54ff6062498b85de2636715c2b720ccbb27f80993b09f7ce212599117a9ee7
Instruction ID: 78746bb5d09109ba446925543acf3879959dc3d86a04f865bac23cf81162f07a
Opcode Fuzzy Hash: ab54ff6062498b85de2636715c2b720ccbb27f80993b09f7ce212599117a9ee7
Instruction Fuzzy Hash: 3031FC31F002018FDB58ABB4D5282AEBBA2AF88354B1584B9D406DB394DF35DC09CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00F9F748, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9fac1db960d11dc8df6971b027834357633d0b50c0ee73c9e807c44ef8caf5
Instruction ID: d8816d3ea76d160458d198dfd88becc5442af826743a2931c4a7f52e7f14a975
Opcode Fuzzy Hash: cb9fac1db960d11dc8df6971b027834357633d0b50c0ee73c9e807c44ef8caf5
Instruction Fuzzy Hash: 6D31EE31F002048FDB58ABB4D5182AEB7E6AF88314B158478D006EB384EF35DD05CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F949AF, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3347a04bf8a9475bbd17aaf30759c2a0edb9733e1f9250e9e27901b3dd00e4
Instruction ID: bf617cfd3eb7810c2dcae23891086c32fcaddf30cc2b64a404300c6d212ed644
Opcode Fuzzy Hash: bc3347a04bf8a9475bbd17aaf30759c2a0edb9733e1f9250e9e27901b3dd00e4
Instruction Fuzzy Hash: 0831D131B002049FDB189B74C854BAEBBF6AF8C224F148869E506EB384CF359C16CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F93D08, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c0bb871505faacde217627d9bc8813eabce6e5e0b81575dfd2eab3395f59f4
Instruction ID: da46eb6d1fc174defd66ba032dce3e298d48df09b0001cc99417d987970a0400
Opcode Fuzzy Hash: 90c0bb871505faacde217627d9bc8813eabce6e5e0b81575dfd2eab3395f59f4
Instruction Fuzzy Hash: E3212531B082094BEF26273598A863E3BABDFD5728714407AD502CBB95DF35CE06B781

Uniqueness

Uniqueness Score: -1.00%

Function 00F93D18, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694cb8fc024849a54eb48d81588d6cb5e710bdb2421f04bd44226a6011a61613
Instruction ID: 648071f565de92fc80385463c7500b9f8f2d8c4541ac1c332679d97e6dd5483f
Opcode Fuzzy Hash: 694cb8fc024849a54eb48d81588d6cb5e710bdb2421f04bd44226a6011a61613
Instruction Fuzzy Hash: A121C231B042084BEF25263598A877E369BDFD4768F24803AD502CBB94DF35CD46B781

Uniqueness

Uniqueness Score: -1.00%

Function 00F9A710, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e9a449ad4e92f13cb9ecaebe790f3605631ebd42f526e4caeffaba0c38392a
Instruction ID: ac1de4dcd2143c294a3001b88808bb064f152e0418d7df63173d949337196702
Opcode Fuzzy Hash: f3e9a449ad4e92f13cb9ecaebe790f3605631ebd42f526e4caeffaba0c38392a
Instruction Fuzzy Hash: AB31AD30A093449FDB05CBA8D9946DEBFF2EF89314F1580AAD444EB245E7359886CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F914F0, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc19cab7dd411d178957e0d27338bf7c222bdcf2e842d91905afb59919c8ae42
Instruction ID: 19daa7722b0a5a638b9d366eee1d5c8b8a87a3cacf59599f1d9ee9d51fd80e8e
Opcode Fuzzy Hash: bc19cab7dd411d178957e0d27338bf7c222bdcf2e842d91905afb59919c8ae42
Instruction Fuzzy Hash: 6E315E3260020A9FDF06AF65D854AAE7BA6FB88320F154429FD1AC7254CB35CD71EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F93C10, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c14b912c09400ce700e42ded309f12af7c8b8d93f69400245210385d2a3bfe0
Instruction ID: 15c4ba953ba8108015051b7a16dc8062dd7b0cd957a7be0818b5feb9c837f02f
Opcode Fuzzy Hash: 2c14b912c09400ce700e42ded309f12af7c8b8d93f69400245210385d2a3bfe0
Instruction Fuzzy Hash: F521FE31B086159FEF11DE26D880BAB7BEAEB85350F154426F812E7340DB30CE40EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F94B67, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3f71fe8b703e765d0e1f50821167d28f2e7fd4f21f6b27247ee40893a89ea38
Instruction ID: f6ac9ff488078998670c20238eddc228d523a806822aa09461dffba8cdbb1d69
Opcode Fuzzy Hash: a3f71fe8b703e765d0e1f50821167d28f2e7fd4f21f6b27247ee40893a89ea38
Instruction Fuzzy Hash: D1317170E005058FDF08CF68C884DAEBBB2FF94364B158155E526973A5DB30EC42DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D8EC, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0261e354ca04e019418b4e9d3ef6de3e2bfe86433f82afb757f8a44b1dcc2b80
Instruction ID: 6b2dcbd61d1d8ad7dbf54fb08ddad844eeab15a5103b6961a068003b4f55767b
Opcode Fuzzy Hash: 0261e354ca04e019418b4e9d3ef6de3e2bfe86433f82afb757f8a44b1dcc2b80
Instruction Fuzzy Hash: 6831A270E0A2848FDF02DBA8D9546DCBFB2AB49314F6544AAD045EB392DB748C45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F919F0, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ea8698be2b18b0b91a34b09e58187075633856fa6363e16ef3f2f0bb5441c5
Instruction ID: b904ffac1e683c39737586388ffbbdbe98f50be7d9b4380ddc1560b6026765b3
Opcode Fuzzy Hash: 33ea8698be2b18b0b91a34b09e58187075633856fa6363e16ef3f2f0bb5441c5
Instruction Fuzzy Hash: 61213A31B026128BDB299A25D49462FB3A6FFC8775B144579E907CB744CF34EC4297C0

Uniqueness

Uniqueness Score: -1.00%

Function 013CD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499655768.00000000013CD000.00000040.00000001.sdmp, Offset: 013CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cabeef609b2b949c09f1747cf3dd507a0987a78b595179131517bd149098b74
Instruction ID: 70cb93f474eb58f276d34a92fed292f0e9c77f0feb0787357b211010a4818ea4
Opcode Fuzzy Hash: 7cabeef609b2b949c09f1747cf3dd507a0987a78b595179131517bd149098b74
Instruction Fuzzy Hash: 54210071608244DFCB11CF58D9C0B26BBA5FB88668F24C5BDE90A4B646C336D846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F9B710, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbbca6bffb7b9f4af7c11326c376bbc72f2306ff5d9569cefee9d89a2f1be303
Instruction ID: fac0e0e3e032ed3d4974b1f7f3743b6811c6c9e68f8d0cd6551bda4c2e37da9c
Opcode Fuzzy Hash: cbbca6bffb7b9f4af7c11326c376bbc72f2306ff5d9569cefee9d89a2f1be303
Instruction Fuzzy Hash: A511B232B002159BCF14ABB8991C6AE76E6AFC8758B058678D902E7384DF359C018BD2

Uniqueness

Uniqueness Score: -1.00%

Function 013CD006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499655768.00000000013CD000.00000040.00000001.sdmp, Offset: 013CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8d7ec2e63c899f474b31783bd2207cdbcb12394988a1a2371babf083e6a49d
Instruction ID: a9c7ec517b661569a2029f3154c10660133c2481fcf620b84ec9c86980375fc7
Opcode Fuzzy Hash: db8d7ec2e63c899f474b31783bd2207cdbcb12394988a1a2371babf083e6a49d
Instruction Fuzzy Hash: 6D2162755083809FCB03CF58D994B11BF71EB46614F28C5EAD8458F657C33AD85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F9F967, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 771ea208a1036329eba238f2326733aed07b667173d533826cc88d38e6e52198
Instruction ID: ddb5555bd5b865a2a33555d5a647281c3088eb992deeb172eb892b5b39ac11a9
Opcode Fuzzy Hash: 771ea208a1036329eba238f2326733aed07b667173d533826cc88d38e6e52198
Instruction Fuzzy Hash: E401F932B092901FC71546395C147FE7BDA8FC622171984B7E045C7252CE55CC0BD351

Uniqueness

Uniqueness Score: -1.00%

Function 00F9F9C0, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19345b01dd1822f5ec30b9beb3408a7ce6d198ee2cc570bfa945a70c6383ca75
Instruction ID: 15c7f45b2931368342877bdedbfc736763fe51c1251564fd5f2e195042bb6333
Opcode Fuzzy Hash: 19345b01dd1822f5ec30b9beb3408a7ce6d198ee2cc570bfa945a70c6383ca75
Instruction Fuzzy Hash: 5D110831F087404FCB299B75881866ABBE69FC1316B4588BFD05AC7292DA78DC4AC311

Uniqueness

Uniqueness Score: -1.00%

Function 00F95449, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2225876dc7c8801a45617a2952870819b95fd56155c3fe4f43bfa27b8f4af116
Instruction ID: f0fec86b144df0a3a6e322660332a435f30de1808f54957a93229a4db165f60b
Opcode Fuzzy Hash: 2225876dc7c8801a45617a2952870819b95fd56155c3fe4f43bfa27b8f4af116
Instruction Fuzzy Hash: 1D119A71E0121A9FCB01DFA9C8106AEBBB5EB48320F00882AE915E3241D2749A05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F914EF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 749c172ca2c7224579df7c096549f973a1b7fd3ea0e284829c29515cedff5ed9
Instruction ID: fb040468ab79e441784fda6578f3a7f2243d793beae06d94540d5dcc6b934285
Opcode Fuzzy Hash: 749c172ca2c7224579df7c096549f973a1b7fd3ea0e284829c29515cedff5ed9
Instruction Fuzzy Hash: C8118631A002169FDF159F28D444BAA7BA1FB84320F164435F90AD7254CB71CDA1EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F91628, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92d7dd3f7c2edfb2598945fd258869ba47de12a877bf241cc7076bdba6d5ef19
Instruction ID: 94d65dc5d994329b81a69d5334b8635d470d3767dc3880b58dc8cb178d715bc6
Opcode Fuzzy Hash: 92d7dd3f7c2edfb2598945fd258869ba47de12a877bf241cc7076bdba6d5ef19
Instruction Fuzzy Hash: AE012472B002156FCF069E699810BAF3FABEBC97A0B08846AF514C7290DA71CC119B90

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D870, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45fb694119b03dfd2b4f0e3a8ed022e3c38c16c0047ddd174ef2452ee93fecd6
Instruction ID: 3631da280c06fbb9d4b917af76f0f73c58ccebdca9c6c96e57f915de53d2c5f2
Opcode Fuzzy Hash: 45fb694119b03dfd2b4f0e3a8ed022e3c38c16c0047ddd174ef2452ee93fecd6
Instruction Fuzzy Hash: E8014B71E01218AFDF14DFA8E548BDDBBB6AF49314F200069E505BB350CBB59D48CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F9A698, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca5ce46d6729e23e9f9b695e8b3a92d9eec03e3bf52b2e7ca786c29493eaec26
Instruction ID: 70b2428af5363678d328c885a87f2894a81099fde03577a6cbeaa05654057037
Opcode Fuzzy Hash: ca5ce46d6729e23e9f9b695e8b3a92d9eec03e3bf52b2e7ca786c29493eaec26
Instruction Fuzzy Hash: F2F0E573F001159FCB449FB898045EE3FF5DAC8260B1681B6D91DE3600EA3849038BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F9A6A8, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b547bb1c1777c84e007b0384536656b629a61f0299186275b2911dc26db28b1
Instruction ID: 534aab95d309f84670db47e26058783dd9215a15d62f52dc45feda4da99658c7
Opcode Fuzzy Hash: 4b547bb1c1777c84e007b0384536656b629a61f0299186275b2911dc26db28b1
Instruction Fuzzy Hash: A9E01276E001159F8B509BAD98055AF7BF8EA88251B114476E909E3200EA7059118BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F9B4C8, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a8191eee2cbc0d4790f5dcae090428aaa235937bd3d0481053419af588e31d
Instruction ID: a11f6275cab444c721bfdbaedc9673a693602331a51f159b26030940c082a488
Opcode Fuzzy Hash: c3a8191eee2cbc0d4790f5dcae090428aaa235937bd3d0481053419af588e31d
Instruction Fuzzy Hash: D8E0DF3190D3C98FDB138B3869626A43F309F03214B1804DBC094CB4A3C6198886D712

Uniqueness

Uniqueness Score: -1.00%

Function 00F9EB64, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd91dd52d101cac0c643d9c01b25bf6cd3a3147b3e778be6b5b7efb894c7529d
Instruction ID: 48d0f271ec1c2d7c1fb35b9224b5687d6f6dcc607c6be1a133e48db7e648f528
Opcode Fuzzy Hash: bd91dd52d101cac0c643d9c01b25bf6cd3a3147b3e778be6b5b7efb894c7529d
Instruction Fuzzy Hash: E7D0220070821A8A2F085AF3162023E00C30AC019FB528CB66A17CE2E0FE2CCD843366

Uniqueness

Uniqueness Score: -1.00%

Function 00F9B4D8, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fba395e49eadc6daa23bf7020a55f22f2e389e58291db9181401455d9adc304
Instruction ID: f93376351a87cc0d6ab3132e4059e96773b3b90cac9d6c853bdc1c2d46882fa3
Opcode Fuzzy Hash: 9fba395e49eadc6daa23bf7020a55f22f2e389e58291db9181401455d9adc304
Instruction Fuzzy Hash: FDD0C930A042488BEF21AD6ABA597263359E791369F604875E40ACB642D726DC80EA40

Uniqueness

Uniqueness Score: -1.00%

Function 00F9DDF8, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9dd3f126b766319f5f3cd7267736df21f013224929e1e2e3c294a665fdf5b41
Instruction ID: 75463bd2712da36694a2b3dfdf55c9ed166980bab5bde60509e8b57ee73edac5
Opcode Fuzzy Hash: b9dd3f126b766319f5f3cd7267736df21f013224929e1e2e3c294a665fdf5b41
Instruction Fuzzy Hash: 5AE0ECB0D402099EDB80EFA8C9157AEBBF0BF04304F208969C015EB241E77456059F91

Uniqueness

Uniqueness Score: -1.00%

Function 00F9DDF7, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600c5ad75065e91e15839accb7963ff4226a24ad22081df39783cc6ca1d74819
Instruction ID: ec463556c797364ec702f0455435f5cd4cc663dd7f50ea41e2b26746308f72e7
Opcode Fuzzy Hash: 600c5ad75065e91e15839accb7963ff4226a24ad22081df39783cc6ca1d74819
Instruction Fuzzy Hash: A8E0B6B0D502099EDB90EFB889557AEBFF0AF08214F208969C015EA241D7754606DF41

Uniqueness

Uniqueness Score: -1.00%

Function 00F9DDA0, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6bbedfc14d7aba8128b1df54bbce8df00725328a6ebd764613d2bfb1e4e20b9
Instruction ID: 60566db252ca212371db0d57a11ee77196ed571a0016ec466695a3005a3ab54e
Opcode Fuzzy Hash: d6bbedfc14d7aba8128b1df54bbce8df00725328a6ebd764613d2bfb1e4e20b9
Instruction Fuzzy Hash: E3E04CB0D44209DEEB40EFA9851579FBAF4AB04300F2089668055E6645E7B546459B91

Uniqueness

Uniqueness Score: -1.00%

Function 00F9DD9F, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e30da0113c82f4677f56bc640b91b62d90ed62d6c56d7f695c93b4456716ce
Instruction ID: 21ca84325b119a9f3d863e52fd9d20a37b44a18bc85d1038284414cbaa3af012
Opcode Fuzzy Hash: 37e30da0113c82f4677f56bc640b91b62d90ed62d6c56d7f695c93b4456716ce
Instruction Fuzzy Hash: ABE0ECB0D00209DEEF90EFB884153EFBFF0AB08300F20896AC055E2641E7B542059F91

Uniqueness

Uniqueness Score: -1.00%

Function 00F91D80, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5676de94b323a7e5e5502fcbd862591a082c13478044d1967092f3b7dec9a3d
Instruction ID: 2127208ee633db81ddc04c67db56bf5ca00d819881955736554c8129f80466e0
Opcode Fuzzy Hash: f5676de94b323a7e5e5502fcbd862591a082c13478044d1967092f3b7dec9a3d
Instruction Fuzzy Hash: F6C01231258305868544FB60F851915736E5AD11083448D2191059962D9FB1AD854795

Uniqueness

Uniqueness Score: -1.00%

Function 00F91D7F, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c96778e94e4948a7e53500a0a5d2a012e6acb13245223c9d2f907329eed3cbc
Instruction ID: 9f170d8f411aaac73e01dca71bc5ea57c018b89e3b66f36a585c4db44d905ae2
Opcode Fuzzy Hash: 2c96778e94e4948a7e53500a0a5d2a012e6acb13245223c9d2f907329eed3cbc
Instruction Fuzzy Hash: 88D0123165830586CA44FB70F8919A977379AE11183048E6590459962ECFB29D868B40

Uniqueness

Uniqueness Score: -1.00%

Function 00F9921B, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.499093650.0000000000F90000.00000040.00000001.sdmp, Offset: 00F90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78838c041e76afee723e77eb14470bab5ab6b3b1f2a230250a4c47ba63a65e6d
Instruction ID: 8d03c0a99e83590cc5e989d28318257c84ed74ad687e235e643816177a441fdc
Opcode Fuzzy Hash: 78838c041e76afee723e77eb14470bab5ab6b3b1f2a230250a4c47ba63a65e6d
Instruction Fuzzy Hash: BBC08C3AE48008CBEB00CB88FC617CDF330FB84321F2006A2C61C839109331AA2D9F41

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report New Order Request_0232147.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Statistics

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre