Play interactive tour

Edit tour

Analysis Report shipping document -813-25319 192-463-56-265-3327.exe

Overview

General Information

Sample Name:	shipping document -813-25319 192-463-56-265-3327.exe
Analysis ID:	433208
MD5:	4feedf906175f2357dcc2abbfcdb5ec0
SHA1:	77678c78e2d226fe55be6927436899129e47967e
SHA256:	f4888e1ee79c601d42020575ce5b79958c4c62e308d970f4a4f4c17b51ebc6e9
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

.NET source code contains very large strings

Executable has a suspicious name (potential lure to open the executable)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

shipping document -813-25319 192-463-56-265-3327.exe (PID: 4160 cmdline: 'C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe' MD5: 4FEEDF906175F2357DCC2ABBFCDB5EC0)

schtasks.exe (PID: 4684 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmpD653.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 3880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

shipping document -813-25319 192-463-56-265-3327.exe (PID: 3680 cmdline: {path} MD5: 4FEEDF906175F2357DCC2ABBFCDB5EC0)

vaklXcs.exe (PID: 5732 cmdline: 'C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe' MD5: 4FEEDF906175F2357DCC2ABBFCDB5EC0)

schtasks.exe (PID: 5176 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmpF02F.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vaklXcs.exe (PID: 1784 cmdline: {path} MD5: 4FEEDF906175F2357DCC2ABBFCDB5EC0)

vaklXcs.exe (PID: 3144 cmdline: {path} MD5: 4FEEDF906175F2357DCC2ABBFCDB5EC0)

vaklXcs.exe (PID: 4552 cmdline: {path} MD5: 4FEEDF906175F2357DCC2ABBFCDB5EC0)

vaklXcs.exe (PID: 1332 cmdline: 'C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe' MD5: 4FEEDF906175F2357DCC2ABBFCDB5EC0)

schtasks.exe (PID: 476 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmp150D.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vaklXcs.exe (PID: 244 cmdline: {path} MD5: 4FEEDF906175F2357DCC2ABBFCDB5EC0)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "comite.etica@uis.com.mxUIS30012019mail.uis.com.mx"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000021.00000002.478018686.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000002.478018686.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000021.00000000.464650955.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000000.464650955.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000001E.00000000.445729425.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001E.00000000.445729425.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.473675525.0000000003639000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000016.00000002.473675525.0000000003639000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.293199809.0000000004262000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.293199809.0000000004262000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.292688727.00000000040C9000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.292688727.00000000040C9000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000014.00000002.450985230.0000000003709000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000014.00000002.450985230.0000000003709000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000D.00000000.288112439.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000000.288112439.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000016.00000002.471880084.0000000002684000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000014.00000002.448006469.0000000002701000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: vaklXcs.exe PID: 1332	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vaklXcs.exe PID: 1332	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: shipping document -813-25319 192-463-56-265-3327.exe PID: 4160	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: shipping document -813-25319 192-463-56-265-3327.exe PID: 4160	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: vaklXcs.exe PID: 5732	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vaklXcs.exe PID: 5732	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: shipping document -813-25319 192-463-56-265-3327.exe PID: 3680	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vaklXcs.exe PID: 244	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vaklXcs.exe PID: 244	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vaklXcs.exe PID: 4552	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author
20.2.vaklXcs.exe.37d2b48.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
20.2.vaklXcs.exe.37d2b48.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
13.0.shipping document -813-25319 192-463-56-265-3327.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
13.0.shipping document -813-25319 192-463-56-265-3327.exe.400000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
30.0.vaklXcs.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
30.0.vaklXcs.exe.400000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.shipping document -813-25319 192-463-56-265-3327.exe.4192b48.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.shipping document -813-25319 192-463-56-265-3327.exe.4192b48.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.shipping document -813-25319 192-463-56-265-3327.exe.4192b48.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.shipping document -813-25319 192-463-56-265-3327.exe.4192b48.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
22.2.vaklXcs.exe.3702b48.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
22.2.vaklXcs.exe.3702b48.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
20.2.vaklXcs.exe.37d2b48.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
20.2.vaklXcs.exe.37d2b48.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
33.0.vaklXcs.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
33.0.vaklXcs.exe.400000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
33.2.vaklXcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
33.2.vaklXcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
22.2.vaklXcs.exe.3702b48.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
22.2.vaklXcs.exe.3702b48.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.shipping document -813-25319 192-463-56-265-3327.exe.4355028.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.shipping document -813-25319 192-463-56-265-3327.exe.4355028.5.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
20.2.vaklXcs.exe.2739cf0.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 18 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "comite.etica@uis.com.mxUIS30012019mail.uis.com.mx"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Roaming\ncIvXUThk.exe	ReversingLabs: Detection: 26%

Multi AV Scanner detection for submitted file

Show sources

Source: shipping document -813-25319 192-463-56-265-3327.exe

ReversingLabs: Detection: 26%

Source: 13.0.shipping document -813-25319 192-463-56-265-3327.exe.400000.1.unpack	Avira: Label: TR/Spy.Gen8
Source: 30.0.vaklXcs.exe.400000.1.unpack	Avira: Label: TR/Spy.Gen8
Source: 33.0.vaklXcs.exe.400000.1.unpack	Avira: Label: TR/Spy.Gen8
Source: 33.2.vaklXcs.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8

Source: shipping document -813-25319 192-463-56-265-3327.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: shipping document -813-25319 192-463-56-265-3327.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49743 -> 204.44.192.31:587

Source: vaklXcs.exe, 00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: vaklXcs.exe, 00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.290119792.00000000030C1000.00000004.00000001.sdmp, vaklXcs.exe, 00000014.00000002.448006469.0000000002701000.00000004.00000001.sdmp, vaklXcs.exe, 00000016.00000002.471662766.0000000002631000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205521411.00000000061CF000.00000004.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205608510.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206984683.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com.i
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205628682.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comC
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205831175.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTC
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205819388.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTCW
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comThB
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.207192862.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comW
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comc=f
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205608510.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comdnl
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205642371.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comlf
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comvi$
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comwdth
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comwf
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comzh
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com~f
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.208890096.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers-n
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.207742384.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.207811300.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers2
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.208327098.00000000061D0000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.207775966.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers:
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.208945523.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersSn
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.207811300.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersXn
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.208890096.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designerss
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.208649000.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersyn
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296658788.00000000061AB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296658788.00000000061AB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comce:
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296658788.00000000061AB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comgrita
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205288259.00000000061CE000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205225901.00000000061CE000.00000004.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205225901.00000000061CE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn(
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205225901.00000000061CE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnl-p
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206848442.00000000061AB000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206273355.00000000061A3000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206619421.00000000061AA000.00000004.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206429794.00000000061AB000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206619421.00000000061AA000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/2
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206273355.00000000061A3000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/:
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206848442.00000000061AB000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/F
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206273355.00000000061A3000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/P
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206619421.00000000061AA000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0X4
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206619421.00000000061AA000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/_
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206848442.00000000061AB000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/b
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206273355.00000000061A3000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206524923.00000000061AA000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206429794.00000000061AB000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/ew
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206848442.00000000061AB000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/i
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206848442.00000000061AB000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206848442.00000000061AB000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/(
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206619421.00000000061AA000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/:
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206619421.00000000061AA000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/W:
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.211627463.00000000061AF000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.212270362.00000000061A3000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205642371.00000000061D0000.00000004.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205573545.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnii
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205573545.00000000061D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cntan
Source: vaklXcs.exe, 00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp	String found in binary or memory: http://xdqqbS.com
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.293199809.0000000004262000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 0000000D.00000000.288112439.0000000000402000.00000040.00000001.sdmp, vaklXcs.exe, 00000014.00000002.450985230.0000000003709000.00000004.00000001.sdmp, vaklXcs.exe, 00000016.00000002.473675525.0000000003639000.00000004.00000001.sdmp, vaklXcs.exe, 0000001E.00000000.445729425.0000000000402000.00000040.00000001.sdmp, vaklXcs.exe, 00000021.00000002.478018686.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: vaklXcs.exe, 00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 13.0.shipping document -813-25319 192-463-56-265-3327.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007b61A865C8u002dDECAu002d45DAu002dA938u002dA8B21633D3A0u007d/u00387699A4Eu002d8507u002d44FBu002d9594u002d0F08283F99DD.cs

Large array initialization: .cctor: array initializer size 12008

.NET source code contains very large strings

Show sources

Source: shipping document -813-25319 192-463-56-265-3327.exe, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: ncIvXUThk.exe.0.dr, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 0.0.shipping document -813-25319 192-463-56-265-3327.exe.dc0000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 0.2.shipping document -813-25319 192-463-56-265-3327.exe.dc0000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: vaklXcs.exe.13.dr, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 13.0.shipping document -813-25319 192-463-56-265-3327.exe.760000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 13.0.shipping document -813-25319 192-463-56-265-3327.exe.760000.2.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 20.0.vaklXcs.exe.340000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 20.2.vaklXcs.exe.340000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 22.2.vaklXcs.exe.a0000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 28.0.vaklXcs.exe.40000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 28.2.vaklXcs.exe.40000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: shipping document -813-25319 192-463-56-265-3327.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: shipping document -813-25319 192-463-56-265-3327.exe

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07C00100	0_2_07C00100
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07C03110	0_2_07C03110
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07C00AC0	0_2_07C00AC0
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07C005E8	0_2_07C005E8
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07C01130	0_2_07C01130
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_055AE690	0_2_055AE690
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_055AE682	0_2_055AE682
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_055AC234	0_2_055AC234
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C8DFD8	0_2_05C8DFD8
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C8DDE0	0_2_05C8DDE0
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C8BCE8	0_2_05C8BCE8
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C88748	0_2_05C88748
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C88741	0_2_05C88741
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C85F58	0_2_05C85F58
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C85F55	0_2_05C85F55
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C89F00	0_2_05C89F00
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C89F10	0_2_05C89F10
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C8C738	0_2_05C8C738
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C8A6F9	0_2_05C8A6F9
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C816F0	0_2_05C816F0
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C8D998	0_2_05C8D998
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C8A890	0_2_05C8A890
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C8A8A0	0_2_05C8A8A0
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C8F078	0_2_05C8F078
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C8B810	0_2_05C8B810
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C87387	0_2_05C87387
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C87398	0_2_05C87398
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C8DBB8	0_2_05C8DBB8
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C882D0	0_2_05C882D0
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C892B8	0_2_05C892B8
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C892B7	0_2_05C892B7
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06BA3088	20_2_06BA3088
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06BA0100	20_2_06BA0100
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06BA0AC0	20_2_06BA0AC0
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06BA05E8	20_2_06BA05E8
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06BA1130	20_2_06BA1130
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_025AE690	20_2_025AE690
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_025AC234	20_2_025AC234
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_025AE682	20_2_025AE682
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 22_2_007BE690	22_2_007BE690
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 22_2_007BC234	22_2_007BC234
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 22_2_007BE682	22_2_007BE682
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 33_2_01084927	33_2_01084927

Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000000.200717266.0000000000E3A000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename1Bu5.exeF vs shipping document -813-25319 192-463-56-265-3327.exe
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.293481299.0000000005140000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs shipping document -813-25319 192-463-56-265-3327.exe
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.293481299.0000000005140000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs shipping document -813-25319 192-463-56-265-3327.exe
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.298321207.0000000007AF0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs shipping document -813-25319 192-463-56-265-3327.exe
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.290119792.00000000030C1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameWindowsNetwork.dll> vs shipping document -813-25319 192-463-56-265-3327.exe
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.292688727.00000000040C9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameHhWhuxDpGAjJSBfQAWvlJIjIHrTvD.exe4 vs shipping document -813-25319 192-463-56-265-3327.exe
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.298217183.00000000078D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs shipping document -813-25319 192-463-56-265-3327.exe
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.298472339.0000000007C10000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs shipping document -813-25319 192-463-56-265-3327.exe
Source: shipping document -813-25319 192-463-56-265-3327.exe, 0000000D.00000000.288242500.00000000007DA000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename1Bu5.exeF vs shipping document -813-25319 192-463-56-265-3327.exe
Source: shipping document -813-25319 192-463-56-265-3327.exe	Binary or memory string: OriginalFilename1Bu5.exeF vs shipping document -813-25319 192-463-56-265-3327.exe

Source: shipping document -813-25319 192-463-56-265-3327.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: shipping document -813-25319 192-463-56-265-3327.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ncIvXUThk.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: vaklXcs.exe.13.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: shipping document -813-25319 192-463-56-265-3327.exe, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: ncIvXUThk.exe.0.dr, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.shipping document -813-25319 192-463-56-265-3327.exe.dc0000.0.unpack, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.shipping document -813-25319 192-463-56-265-3327.exe.dc0000.0.unpack, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: vaklXcs.exe.13.dr, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 13.0.shipping document -813-25319 192-463-56-265-3327.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 13.0.shipping document -813-25319 192-463-56-265-3327.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@22/8@0/0

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

File created: C:\Users\user\AppData\Roaming\ncIvXUThk.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\fxDxalpFXoWDHvYCOmufBkfP
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5540:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3880:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5548:120:WilError_01

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

File created: C:\Users\user\AppData\Local\Temp\tmpD653.tmp

Jump to behavior

Source: shipping document -813-25319 192-463-56-265-3327.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: shipping document -813-25319 192-463-56-265-3327.exe

ReversingLabs: Detection: 26%

Source: shipping document -813-25319 192-463-56-265-3327.exe	String found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
Source: shipping document -813-25319 192-463-56-265-3327.exe	String found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
Source: shipping document -813-25319 192-463-56-265-3327.exe	String found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail
Source: shipping document -813-25319 192-463-56-265-3327.exe	String found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail
Source: vaklXcs.exe	String found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
Source: vaklXcs.exe	String found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
Source: vaklXcs.exe	String found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail
Source: vaklXcs.exe	String found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

File read: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe 'C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe'
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmpD653.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process created: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe {path}
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe 'C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe 'C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe'
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmpF02F.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe {path}
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe {path}
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe {path}
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmp150D.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe {path}
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmpD653.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process created: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmpF02F.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmp150D.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: shipping document -813-25319 192-463-56-265-3327.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: shipping document -813-25319 192-463-56-265-3327.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC3B9C push edx; iretd	0_2_07BC3BB1
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC23E6 push edi; ret	0_2_07BC2406
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC2BDB push cs; retf	0_2_07BC2BDC
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC2BC7 push ecx; iretd	0_2_07BC2BCC
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC3B3D push edx; iretd	0_2_07BC3B41
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC42AA pushfd ; iretd	0_2_07BC4339
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC2291 push ds; iretd	0_2_07BC227C
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC3ACD push edx; iretd	0_2_07BC3AD1
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC1EC3 push ebx; ret	0_2_07BC1ECC
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC1E7E push edx; iretd	0_2_07BC1E80
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC2278 push ds; iretd	0_2_07BC227C
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC3A5D push edx; iretd	0_2_07BC3A61
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC39E8 push edx; iretd	0_2_07BC39F1
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC3DE2 push esi; retf	0_2_07BC3DF2
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC3978 push edx; iretd	0_2_07BC3981
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_07BC2874 push ecx; iretd	0_2_07BC2876
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_055A7CD2 push ecx; ret	0_2_055A7D3E
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Code function: 0_2_05C832AE push es; ret	0_2_05C832C7
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06B642AA pushfd ; iretd	20_2_06B64339
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06B62291 push ds; iretd	20_2_06B6227C
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06B61EC3 push ebx; ret	20_2_06B61ECC
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06B63ACD push edx; iretd	20_2_06B63AD1
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06B61E7E push edx; iretd	20_2_06B61E80
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06B62278 push ds; iretd	20_2_06B6227C
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06B63A5D push edx; iretd	20_2_06B63A61
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06B63B9C push edx; iretd	20_2_06B63BB1
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06B623E6 push edi; ret	20_2_06B62406
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06B62BDB push cs; retf	20_2_06B62BDC
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06B62BC7 push ecx; iretd	20_2_06B62BCC
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06B63B3D push edx; iretd	20_2_06B63B41
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Code function: 20_2_06B62874 push ecx; iretd	20_2_06B62876

Source: initial sample	Static PE information: section name: .text entropy: 7.69114169634
Source: initial sample	Static PE information: section name: .text entropy: 7.69114169634
Source: initial sample	Static PE information: section name: .text entropy: 7.69114169634

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	File created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe			Jump to dropped file
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	File created: C:\Users\user\AppData\Roaming\ncIvXUThk.exe			Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmpD653.tmp'

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vaklXcs			Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vaklXcs			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

File opened: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000016.00000002.471880084.0000000002684000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.448006469.0000000002701000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vaklXcs.exe PID: 1332, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping document -813-25319 192-463-56-265-3327.exe PID: 4160, type: MEMORY
Source: Yara match	File source: Process Memory Space: vaklXcs.exe PID: 5732, type: MEMORY
Source: Yara match	File source: 20.2.vaklXcs.exe.2739cf0.2.raw.unpack, type: UNPACKEDPE

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.290224599.0000000003115000.00000004.00000001.sdmp, vaklXcs.exe, 00000014.00000002.448006469.0000000002701000.00000004.00000001.sdmp, vaklXcs.exe, 00000016.00000002.471880084.0000000002684000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.290224599.0000000003115000.00000004.00000001.sdmp, vaklXcs.exe, 00000014.00000002.448006469.0000000002701000.00000004.00000001.sdmp, vaklXcs.exe, 00000016.00000002.471880084.0000000002684000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Window / User API: threadDelayed 8047			Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Window / User API: threadDelayed 1805			Jump to behavior

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe TID: 2996	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe TID: 5400	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe TID: 2212	Thread sleep count: 8047 > 30	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe TID: 2212	Thread sleep count: 1805 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe TID: 5872	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe TID: 2172	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: vaklXcs.exe, 00000016.00000002.471880084.0000000002684000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: vaklXcs.exe, 00000016.00000002.471880084.0000000002684000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: vaklXcs.exe, 00000016.00000002.471880084.0000000002684000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: vaklXcs.exe, 00000016.00000002.471880084.0000000002684000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: vaklXcs.exe, 00000016.00000002.471880084.0000000002684000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: vaklXcs.exe, 00000016.00000002.471880084.0000000002684000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: vaklXcs.exe, 00000016.00000002.471880084.0000000002684000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: vaklXcs.exe, 00000016.00000002.471880084.0000000002684000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: vaklXcs.exe, 00000016.00000002.471880084.0000000002684000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Memory written: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Memory written: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmpD653.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Process created: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmpF02F.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmp150D.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Process created: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe {path}	Jump to behavior

Source: vaklXcs.exe, 00000021.00000002.481313794.00000000015D0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: vaklXcs.exe, 00000021.00000002.481313794.00000000015D0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: vaklXcs.exe, 00000021.00000002.481313794.00000000015D0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: vaklXcs.exe, 00000021.00000002.481313794.00000000015D0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000021.00000002.478018686.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.464650955.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.445729425.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.473675525.0000000003639000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.293199809.0000000004262000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.292688727.00000000040C9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.450985230.0000000003709000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.288112439.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 20.2.vaklXcs.exe.37d2b48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.shipping document -813-25319 192-463-56-265-3327.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.vaklXcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping document -813-25319 192-463-56-265-3327.exe.4192b48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping document -813-25319 192-463-56-265-3327.exe.4192b48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.vaklXcs.exe.3702b48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.vaklXcs.exe.37d2b48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.vaklXcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.vaklXcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.vaklXcs.exe.3702b48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping document -813-25319 192-463-56-265-3327.exe.4355028.5.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000021.00000002.478018686.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.464650955.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.445729425.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.473675525.0000000003639000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.293199809.0000000004262000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.292688727.00000000040C9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.450985230.0000000003709000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.288112439.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vaklXcs.exe PID: 1332, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping document -813-25319 192-463-56-265-3327.exe PID: 4160, type: MEMORY
Source: Yara match	File source: Process Memory Space: vaklXcs.exe PID: 5732, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping document -813-25319 192-463-56-265-3327.exe PID: 3680, type: MEMORY
Source: Yara match	File source: Process Memory Space: vaklXcs.exe PID: 244, type: MEMORY
Source: Yara match	File source: Process Memory Space: vaklXcs.exe PID: 4552, type: MEMORY
Source: Yara match	File source: 20.2.vaklXcs.exe.37d2b48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.shipping document -813-25319 192-463-56-265-3327.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.vaklXcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping document -813-25319 192-463-56-265-3327.exe.4192b48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping document -813-25319 192-463-56-265-3327.exe.4192b48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.vaklXcs.exe.3702b48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.vaklXcs.exe.37d2b48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.vaklXcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.vaklXcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.vaklXcs.exe.3702b48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping document -813-25319 192-463-56-265-3327.exe.4355028.5.raw.unpack, type: UNPACKEDPE

Source: Yara match	File source: 00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vaklXcs.exe PID: 244, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000021.00000002.478018686.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.464650955.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.445729425.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.473675525.0000000003639000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.293199809.0000000004262000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.292688727.00000000040C9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.450985230.0000000003709000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.288112439.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 20.2.vaklXcs.exe.37d2b48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.shipping document -813-25319 192-463-56-265-3327.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.vaklXcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping document -813-25319 192-463-56-265-3327.exe.4192b48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping document -813-25319 192-463-56-265-3327.exe.4192b48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.vaklXcs.exe.3702b48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.vaklXcs.exe.37d2b48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.vaklXcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.vaklXcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.vaklXcs.exe.3702b48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping document -813-25319 192-463-56-265-3327.exe.4355028.5.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000021.00000002.478018686.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.464650955.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.445729425.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.473675525.0000000003639000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.293199809.0000000004262000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.292688727.00000000040C9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.450985230.0000000003709000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.288112439.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vaklXcs.exe PID: 1332, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping document -813-25319 192-463-56-265-3327.exe PID: 4160, type: MEMORY
Source: Yara match	File source: Process Memory Space: vaklXcs.exe PID: 5732, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping document -813-25319 192-463-56-265-3327.exe PID: 3680, type: MEMORY
Source: Yara match	File source: Process Memory Space: vaklXcs.exe PID: 244, type: MEMORY
Source: Yara match	File source: Process Memory Space: vaklXcs.exe PID: 4552, type: MEMORY
Source: Yara match	File source: 20.2.vaklXcs.exe.37d2b48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.shipping document -813-25319 192-463-56-265-3327.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.vaklXcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping document -813-25319 192-463-56-265-3327.exe.4192b48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping document -813-25319 192-463-56-265-3327.exe.4192b48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.vaklXcs.exe.3702b48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.vaklXcs.exe.37d2b48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.vaklXcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.vaklXcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.vaklXcs.exe.3702b48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping document -813-25319 192-463-56-265-3327.exe.4355028.5.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Scheduled Task/Job1	Process Injection112	Masquerading1	OS Credential Dumping	Security Software Discovery321	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Registry Run Keys / Startup Folder1	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scheduled Task/Job1	Logon Script (Windows)	Registry Run Keys / Startup Folder1	Virtualization/Sandbox Evasion141	Security Account Manager	Virtualization/Sandbox Evasion141	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	System Information Discovery113	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing3	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
shipping document -813-25319 192-463-56-265-3327.exe	26%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe	26%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\ncIvXUThk.exe	26%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Download
13.0.shipping document -813-25319 192-463-56-265-3327.exe.400000.1.unpack	100%	Avira	TR/Spy.Gen8	Download File
30.0.vaklXcs.exe.400000.1.unpack	100%	Avira	TR/Spy.Gen8	Download File
33.0.vaklXcs.exe.400000.1.unpack	100%	Avira	TR/Spy.Gen8	Download File
33.2.vaklXcs.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.carterandcone.comvi$	0%	Avira URL Cloud	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.carterandcone.comTCW	0%	Avira URL Cloud	safe
http://www.carterandcone.comzh	0%	Avira URL Cloud	safe
http://xdqqbS.com	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/:	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/:	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/:	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/:	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.fontbureau.comgrita	0%	URL Reputation	safe
http://www.fontbureau.comgrita	0%	URL Reputation	safe
http://www.fontbureau.comgrita	0%	URL Reputation	safe
http://www.carterandcone.comC	0%	URL Reputation	safe
http://www.carterandcone.comC	0%	URL Reputation	safe
http://www.carterandcone.comC	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/2	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/2	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/2	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.carterandcone.comThB	0%	Avira URL Cloud	safe
http://www.carterandcone.comdnl	0%	Avira URL Cloud	safe
http://www.carterandcone.com~f	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.founder.com.cn/cnl-p	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.fontbureau.comce:	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cntan	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://www.carterandcone.comW	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/P	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/P	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/P	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/W:	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/F	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/F	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/F	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.carterandcone.com.i	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.carterandcone.comvi$	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://127.0.0.1:HTTP/1.1	vaklXcs.exe, 00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comTCW	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205819388.00000000061D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comzh	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false		high
http://xdqqbS.com	vaklXcs.exe, 00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersSn	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.208945523.00000000061D0000.00000004.00000001.sdmp	false		high
http://www.tiro.com	vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205608510.00000000061D0000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/:	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206619421.00000000061AA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/:	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206273355.00000000061A3000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comgrita	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296658788.00000000061AB000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comC	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205628682.00000000061D0000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/2	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206619421.00000000061AA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp//	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206429794.00000000061AB000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comThB	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comdnl	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205608510.00000000061D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.com~f	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.galapagosdesign.com/DPlease	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers-n	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.208890096.00000000061D0000.00000004.00000001.sdmp	false		high
http://www.fonts.com	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205642371.00000000061D0000.00000004.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.290119792.00000000030C1000.00000004.00000001.sdmp, vaklXcs.exe, 00000014.00000002.448006469.0000000002701000.00000004.00000001.sdmp, vaklXcs.exe, 00000016.00000002.471662766.0000000002631000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cnl-p	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205225901.00000000061CE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.293199809.0000000004262000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 0000000D.00000000.288112439.0000000000402000.00000040.00000001.sdmp, vaklXcs.exe, 00000014.00000002.450985230.0000000003709000.00000004.00000001.sdmp, vaklXcs.exe, 00000016.00000002.473675525.0000000003639000.00000004.00000001.sdmp, vaklXcs.exe, 0000001E.00000000.445729425.0000000000402000.00000040.00000001.sdmp, vaklXcs.exe, 00000021.00000002.478018686.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designerss	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.208890096.00000000061D0000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205521411.00000000061CF000.00000004.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false		high
http://DynDns.comDynDNS	vaklXcs.exe, 00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comce:	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296658788.00000000061AB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cntan	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205573545.00000000061D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	vaklXcs.exe, 00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comTC	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205831175.00000000061D0000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comW	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.207192862.00000000061D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/P	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206273355.00000000061A3000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/W:	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206619421.00000000061AA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/F	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206848442.00000000061AB000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206848442.00000000061AB000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.coma	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296658788.00000000061AB000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com.i	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206984683.00000000061D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comlf	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205642371.00000000061D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205288259.00000000061CE000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205225901.00000000061CE000.00000004.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false		high
http://www.carterandcone.comwf	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/Y0X4	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206619421.00000000061AA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.monotype.	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.211627463.00000000061AF000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.212270362.00000000061A3000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/(	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206848442.00000000061AB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206848442.00000000061AB000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206273355.00000000061A3000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206619421.00000000061AA000.00000004.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comc=f	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.jiyu-kobo.co.jp/ew	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206273355.00000000061A3000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206524923.00000000061AA000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206429794.00000000061AB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/i	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206848442.00000000061AB000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.208327098.00000000061D0000.00000004.00000001.sdmp, shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000002.296805936.0000000006290000.00000002.00000001.sdmp, vaklXcs.exe, 00000014.00000002.454200722.0000000005670000.00000002.00000001.sdmp, vaklXcs.exe, 00000016.00000002.475238056.0000000005520000.00000002.00000001.sdmp	false		high
http://www.zhongyicts.com.cnii	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205573545.00000000061D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers:	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.207775966.00000000061D0000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersyn	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.208649000.00000000061D0000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/b	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206848442.00000000061AB000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.207742384.00000000061D0000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/_	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.206619421.00000000061AA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comwdth	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205946574.00000000061D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn(	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.205225901.00000000061CE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers2	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.207811300.00000000061D0000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersXn	shipping document -813-25319 192-463-56-265-3327.exe, 00000000.00000003.207811300.00000000061D0000.00000004.00000001.sdmp	false		high

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	433208
Start date:	11.06.2021
Start time:	13:02:16
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	shipping document -813-25319 192-463-56-265-3327.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@22/8@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 3.2% (good quality ratio 2.1%) Quality average: 31.7% Quality standard deviation: 26.3%
HCA Information:	Successful, ratio: 95% Number of executed functions: 83 Number of non-executed functions: 26
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:03:56	API Interceptor	510x Sleep call for process: shipping document -813-25319 192-463-56-265-3327.exe modified
13:04:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run vaklXcs C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe
13:04:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run vaklXcs C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\shipping document -813-25319 192-463-56-265-3327.exe.log Download File
Process:	C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vaklXcs.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Temp\tmp150D.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.189154204067787
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBu0tn:cbh47TlNQ//rydbz9I3YODOLNdq3b
MD5:	2CBB4E8E4660BB0E8CFB114D958EF15E
SHA1:	AD0DB5DE2F1194FC78B0DD3100D1CA5C4B5DF061
SHA-256:	0938E885DCD7EEDD10975EBDDF8AC3CC0B420146C36A2DE1E5365A0F883A3425
SHA-512:	8E2C788FC02EAF5DD1AA31B5EB37D9FEA0C3C126FB155363C98E9F3A141CC34A329D55022ADF105B80EE31CE5862BFB9CFDC661391CC53C5D955940743DA4392
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\tmpD653.tmp Download File
Process:	C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.189154204067787
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBu0tn:cbh47TlNQ//rydbz9I3YODOLNdq3b
MD5:	2CBB4E8E4660BB0E8CFB114D958EF15E
SHA1:	AD0DB5DE2F1194FC78B0DD3100D1CA5C4B5DF061
SHA-256:	0938E885DCD7EEDD10975EBDDF8AC3CC0B420146C36A2DE1E5365A0F883A3425
SHA-512:	8E2C788FC02EAF5DD1AA31B5EB37D9FEA0C3C126FB155363C98E9F3A141CC34A329D55022ADF105B80EE31CE5862BFB9CFDC661391CC53C5D955940743DA4392
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\tmpF02F.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.189154204067787
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBu0tn:cbh47TlNQ//rydbz9I3YODOLNdq3b
MD5:	2CBB4E8E4660BB0E8CFB114D958EF15E
SHA1:	AD0DB5DE2F1194FC78B0DD3100D1CA5C4B5DF061
SHA-256:	0938E885DCD7EEDD10975EBDDF8AC3CC0B420146C36A2DE1E5365A0F883A3425
SHA-512:	8E2C788FC02EAF5DD1AA31B5EB37D9FEA0C3C126FB155363C98E9F3A141CC34A329D55022ADF105B80EE31CE5862BFB9CFDC661391CC53C5D955940743DA4392
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe Download File
Process:	C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	491520
Entropy (8bit):	7.657455226599555
Encrypted:	false
SSDEEP:	12288:AL5Mzm8gHdafEpNqBDfC4JoTmKU2pC5j9:AL5o0a6NKDfjoFvC5h
MD5:	4FEEDF906175F2357DCC2ABBFCDB5EC0
SHA1:	77678C78E2D226FE55BE6927436899129E47967E
SHA-256:	F4888E1EE79C601D42020575CE5B79958C4C62E308D970F4A4F4C17B51EBC6E9
SHA-512:	438599FE3604A9737FFFB37E685847A612A5C9D409E9C7A96F12B2679F0A1844B3A7A011C5A31C8AF0AF39D88DB4A96A57C6C7C5AAEE6BD32F4E72B8F3D49041
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............0..j............... ........@.. ....................................@.................................\...O.......\............................................................................ ............... ..H............text....h... ...j.................. ..`.rsrc...\............l..............@..@.reloc...............~..............@..B........................H.......@...........?....w..@...........................................^.(........}......}.....0............t......t......o.....{....o....o......o.....{....o....o......o.....{....o....o.....o.....{....o....o.....(.......{........,....e..+......+.....0............}.....(.......(......r...p.(....(....o......{.....(....o......{....r...po......{.....(....o......{.....(....o......{.....(....o.....*..0.._........(.........(.....o............,)....t......o....r!..p( .....,..o....

C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\ncIvXUThk.exe Download File
Process:	C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	491520
Entropy (8bit):	7.657455226599555
Encrypted:	false
SSDEEP:	12288:AL5Mzm8gHdafEpNqBDfC4JoTmKU2pC5j9:AL5o0a6NKDfjoFvC5h
MD5:	4FEEDF906175F2357DCC2ABBFCDB5EC0
SHA1:	77678C78E2D226FE55BE6927436899129E47967E
SHA-256:	F4888E1EE79C601D42020575CE5B79958C4C62E308D970F4A4F4C17B51EBC6E9
SHA-512:	438599FE3604A9737FFFB37E685847A612A5C9D409E9C7A96F12B2679F0A1844B3A7A011C5A31C8AF0AF39D88DB4A96A57C6C7C5AAEE6BD32F4E72B8F3D49041
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............0..j............... ........@.. ....................................@.................................\...O.......\............................................................................ ............... ..H............text....h... ...j.................. ..`.rsrc...\............l..............@..@.reloc...............~..............@..B........................H.......@...........?....w..@...........................................^.(........}......}.....0............t......t......o.....{....o....o......o.....{....o....o......o.....{....o....o.....o.....{....o....o.....(.......{........,....e..+......+.....0............}.....(.......(......r...p.(....(....o......{.....(....o......{....r...po......{.....(....o......{.....(....o......{.....(....o.....*..0.._........(.........(.....o............,)....t......o....r!..p( .....,..o....

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.657455226599555
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	shipping document -813-25319 192-463-56-265-3327.exe
File size:	491520
MD5:	4feedf906175f2357dcc2abbfcdb5ec0
SHA1:	77678c78e2d226fe55be6927436899129e47967e
SHA256:	f4888e1ee79c601d42020575ce5b79958c4c62e308d970f4a4f4c17b51ebc6e9
SHA512:	438599fe3604a9737fffb37e685847a612a5c9d409e9c7a96f12b2679f0a1844b3a7a011c5a31c8af0af39d88db4a96a57c6c7c5aaee6bd32f4e72b8f3d49041
SSDEEP:	12288:AL5Mzm8gHdafEpNqBDfC4JoTmKU2pC5j9:AL5o0a6NKDfjoFvC5h
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............0..j............... ........@.. ....................................@................................

File Icon


Icon Hash:	18da1abcb2d2d2b0

Static PE Info

General
Entrypoint:	0x4788ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60C315DF [Fri Jun 11 07:50:55 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7885c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7a000	0x105c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x768b4	0x76a00	False	0.865322872761	data	7.69114169634	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x7a000	0x105c	0x1200	False	0.270616319444	data	2.85467003783	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7c000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x7a100	0x8a8	dBase III DBT, version number 0, next free block index 40
RT_GROUP_ICON	0x7a9b8	0x14	data
RT_VERSION	0x7a9dc	0x480	data
RT_MANIFEST	0x7ae6c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	December 19th, 2006
Assembly Version	1.0.7.8
InternalName	1Bu5.exe
FileVersion	1.0.7.8
CompanyName	Coded by James O'Cull
LegalTrademarks
Comments	Contact management is a solution for anyone who needs to be able to access their list of contacts from removable media without any installation.
ProductName	Contact Management
ProductVersion	1.0.7.8
FileDescription	Contact Management
OriginalFilename	1Bu5.exe

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: shipping document -813-25319 192-463-56-265-3327.exe PID: 4160 Parent PID: 5780

General

Start time:	13:03:02
Start date:	11/06/2021
Path:	C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe'
Imagebase:	0xdc0000
File size:	491520 bytes
MD5 hash:	4FEEDF906175F2357DCC2ABBFCDB5EC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.293199809.0000000004262000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.293199809.0000000004262000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.292688727.00000000040C9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.292688727.00000000040C9000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 4684 Parent PID: 4160

General

Start time:	13:03:41
Start date:	11/06/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmpD653.tmp'
Imagebase:	0xbe0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 3880 Parent PID: 4684

General

Start time:	13:03:42
Start date:	11/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: shipping document -813-25319 192-463-56-265-3327.exe PID: 3680 Parent PID: 4160

General

Start time:	13:03:43
Start date:	11/06/2021
Path:	C:\Users\user\Desktop\shipping document -813-25319 192-463-56-265-3327.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x760000
File size:	491520 bytes
MD5 hash:	4FEEDF906175F2357DCC2ABBFCDB5EC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000000.288112439.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000D.00000000.288112439.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: vaklXcs.exe PID: 5732 Parent PID: 3388

General

Start time:	13:04:18
Start date:	11/06/2021
Path:	C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe'
Imagebase:	0x340000
File size:	491520 bytes
MD5 hash:	4FEEDF906175F2357DCC2ABBFCDB5EC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000014.00000002.450985230.0000000003709000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000014.00000002.450985230.0000000003709000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000014.00000002.448006469.0000000002701000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 26%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: vaklXcs.exe PID: 1332 Parent PID: 3388

General

Start time:	13:04:26
Start date:	11/06/2021
Path:	C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe'
Imagebase:	0xa0000
File size:	491520 bytes
MD5 hash:	4FEEDF906175F2357DCC2ABBFCDB5EC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000016.00000002.473675525.0000000003639000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000016.00000002.473675525.0000000003639000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000016.00000002.471880084.0000000002684000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 5176 Parent PID: 5732

General

Start time:	13:04:54
Start date:	11/06/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmpF02F.tmp'
Imagebase:	0x190000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5548 Parent PID: 5176

General

Start time:	13:04:54
Start date:	11/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: vaklXcs.exe PID: 1784 Parent PID: 5732

General

Start time:	13:04:55
Start date:	11/06/2021
Path:	C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x40000
File size:	491520 bytes
MD5 hash:	4FEEDF906175F2357DCC2ABBFCDB5EC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: vaklXcs.exe PID: 3144 Parent PID: 5732

General

Start time:	13:04:55
Start date:	11/06/2021
Path:	C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x140000
File size:	491520 bytes
MD5 hash:	4FEEDF906175F2357DCC2ABBFCDB5EC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: vaklXcs.exe PID: 4552 Parent PID: 5732

General

Start time:	13:04:56
Start date:	11/06/2021
Path:	C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xa10000
File size:	491520 bytes
MD5 hash:	4FEEDF906175F2357DCC2ABBFCDB5EC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001E.00000000.445729425.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000001E.00000000.445729425.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 476 Parent PID: 1332

General

Start time:	13:05:03
Start date:	11/06/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncIvXUThk' /XML 'C:\Users\user\AppData\Local\Temp\tmp150D.tmp'
Imagebase:	0x190000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5540 Parent PID: 476

General

Start time:	13:05:04
Start date:	11/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: vaklXcs.exe PID: 244 Parent PID: 1332

General

Start time:	13:05:04
Start date:	11/06/2021
Path:	C:\Users\user\AppData\Local\Temp\vaklXcs\vaklXcs.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x7f0000
File size:	491520 bytes
MD5 hash:	4FEEDF906175F2357DCC2ABBFCDB5EC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000021.00000002.478018686.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000021.00000002.478018686.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000021.00000000.464650955.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000021.00000000.464650955.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000021.00000002.481631193.0000000002BD1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: shipping document -813-25319 192-463-56-265-3327.exe PID: 4160 Parent PID: 5780 shipping document -813-25319 192-463-56-265-3327.exeCOMMON

Executed Functions

Function 07C00100, Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

8GpP, xrefs: 07C002F1

Memory Dump Source

Source File: 00000000.00000002.298451844.0000000007C00000.00000040.00000001.sdmp, Offset: 07BC0000, based on PE: true

Associated: 00000000.00000002.298409808.0000000007BC0000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID: 8GpP
API String ID: 0-626703381
Opcode ID: a07b2a64060676e4bbe83888e06b25ef3a27b7d5550354c410707f243066b93e
Instruction ID: e1a49b659cbe52824f922889b59be3ca11bbd7af7c55e5d030c41bef528b3ea7
Opcode Fuzzy Hash: a07b2a64060676e4bbe83888e06b25ef3a27b7d5550354c410707f243066b93e
Instruction Fuzzy Hash: D8B128B4E052198BCB04CFEAC9856DEFBF6BF89304F15816AD414BB254E7349A81CB94

Uniqueness

Uniqueness Score: -1.00%

Function 055AE690, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.294080851.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8712a2a69332cfb99d4db1df1f7b8dd979ff2f5266ce3a3c43ddbe8e68de03d
Instruction ID: 6260b66c1601a93a1b86a8906ed9482b212ecdcabad1ea7a7392168a70bfc828
Opcode Fuzzy Hash: d8712a2a69332cfb99d4db1df1f7b8dd979ff2f5266ce3a3c43ddbe8e68de03d
Instruction Fuzzy Hash: 4712C9F142175E8BD710DF55E99A18A3FA0B765328B907308F2631BAD1DFB8154ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 055AE682, Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.294080851.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e43a4ac7998f972189fdd08604ca1a263c7a4618c43181f48d70c06b55dc67
Instruction ID: 3ce82ab04214b48d984a639835c6a9b499d4bbf3bd2eb34a9a1bfc6a6baf15ee
Opcode Fuzzy Hash: 70e43a4ac7998f972189fdd08604ca1a263c7a4618c43181f48d70c06b55dc67
Instruction Fuzzy Hash: 6CC1FBB182175E8AD710DF65E89A18A7FB1BBA5328F507309E1632B6D0DFB8144ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 07C03110, Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298451844.0000000007C00000.00000040.00000001.sdmp, Offset: 07BC0000, based on PE: true

Associated: 00000000.00000002.298409808.0000000007BC0000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 353cf7e48e5c7267c517cc4d175b539fa959d94c01cb521b55a37996c4203c23
Instruction ID: a1f3e7a5a86197f6e969ff7ba96f7f30a372f673c81970c985fc1aa3cd0ec8c6
Opcode Fuzzy Hash: 353cf7e48e5c7267c517cc4d175b539fa959d94c01cb521b55a37996c4203c23
Instruction Fuzzy Hash: 0E71A3B4E1024DDBCB04DFE5D8856AEBBB2FF89300F10842AD816AB754DB345905CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C8DFD8, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e15cc3b8ddbf9ac0b8decf359acaa78878458ec70438a4942987c417173975f4
Instruction ID: fe8c38d3dd6bead4a4a96e72b78ded99ec9cabfedc4b575629d237a61c4fdaa7
Opcode Fuzzy Hash: e15cc3b8ddbf9ac0b8decf359acaa78878458ec70438a4942987c417173975f4
Instruction Fuzzy Hash: 8821D871E056189BEB58CFABD8406AEFBF7BFC9204F14C5B6C508A6224EB341A458F51

Uniqueness

Uniqueness Score: -1.00%

Function 055AFE0C, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 055AFF2A

Memory Dump Source

Source File: 00000000.00000002.294080851.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 49fac3f0692986d2eb581f7d05461765d60878697cb3694c38e513ed3719645d
Instruction ID: 634e265ae98268fcafcdd829074c989683995d43edc4765445a1f575491bd184
Opcode Fuzzy Hash: 49fac3f0692986d2eb581f7d05461765d60878697cb3694c38e513ed3719645d
Instruction Fuzzy Hash: DD51D0B5D00348DFDB14CFA9D884ADEBBF1BF48310F24852AE819AB210D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 055ADEDC, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 055AFF2A

Memory Dump Source

Source File: 00000000.00000002.294080851.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 21a75f955fa646df24ac9b443660f68bab2f5933fe34a8b1bb56f8873079ec4c
Instruction ID: 6e961ec654a9d567ca7815206a48e56a8a74e52fa8d9be280c43a6ac67149e1c
Opcode Fuzzy Hash: 21a75f955fa646df24ac9b443660f68bab2f5933fe34a8b1bb56f8873079ec4c
Instruction Fuzzy Hash: 5C51CFB5D00349AFDB14CFA9D884ADEFBB5BF48314F24852AE819AB210D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 055A3E4C, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 055A5421

Memory Dump Source

Source File: 00000000.00000002.294080851.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a24ade17811529328df30819b6087d018c3015f821f5bf75c88eb16badcf1f29
Instruction ID: d92d7de0d6ca734115d352e28a8d8769d1f4f67795d73eeed8b7765d54ea94bd
Opcode Fuzzy Hash: a24ade17811529328df30819b6087d018c3015f821f5bf75c88eb16badcf1f29
Instruction Fuzzy Hash: 1141E271C0461CDBDB24DFA9C884BCEBBB5BF48304F208469D509AB251EBB56949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 055A5364, Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 055A5421

Memory Dump Source

Source File: 00000000.00000002.294080851.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e9cc980488b8a2d403ff12f05313c8c2c064b1a52c43c83da715fbf022603ba8
Instruction ID: c0fb2802dbfba8783c19ccd040f8a2ce4591694243333a86d6a65643165b4a08
Opcode Fuzzy Hash: e9cc980488b8a2d403ff12f05313c8c2c064b1a52c43c83da715fbf022603ba8
Instruction Fuzzy Hash: 9341E071C04619CFDB24DFA9D885BDDBBB1BF48308F20816AD409AB251DB75594ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 055AA1D4, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,055AB99E,?,?,?,?,?), ref: 055ABA5F

Memory Dump Source

Source File: 00000000.00000002.294080851.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2d6fe87edbfa7d5691830bc4aae5bc28fbe1e7d20529d1eb5845c5d1f797bfc2
Instruction ID: 7c315d00ddff71d8611219d16d92248adb98ca19ae41afbf914b9cdcf541da68
Opcode Fuzzy Hash: 2d6fe87edbfa7d5691830bc4aae5bc28fbe1e7d20529d1eb5845c5d1f797bfc2
Instruction Fuzzy Hash: BA21E3B5904208AFDB10CFAAD484AEEBBF4FB48320F14841AE915A7710D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 055A972A, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 055A96F6

Part of subcall function 055A8820: LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,055A9771,00000800,00000000,00000000), ref: 055A9982

Memory Dump Source

Source File: 00000000.00000002.294080851.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID: HandleLibraryLoadModule
String ID:
API String ID: 4133054770-0
Opcode ID: ea883132becc3757c768839270ac44b2a65b2efb73d61698b2c487a74d315fab
Instruction ID: 363ead21289e72ebd238bba7968c57f5bf3bd5feed8fe76a46e49164802668b8
Opcode Fuzzy Hash: ea883132becc3757c768839270ac44b2a65b2efb73d61698b2c487a74d315fab
Instruction Fuzzy Hash: FB11E677A082099FDB10CF6AE8847AEB7F5FFC5350F04846AD515E7251CA349805CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 055AB9D0, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,055AB99E,?,?,?,?,?), ref: 055ABA5F

Memory Dump Source

Source File: 00000000.00000002.294080851.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9dcb2fe3d3d1e3b15bbf50f1faedfc96826d40b384b9601bb8d7f8188971a8e5
Instruction ID: 97490f290ae1f1c681a57064c37c277b3abce9c7de2811bc77556760995e4999
Opcode Fuzzy Hash: 9dcb2fe3d3d1e3b15bbf50f1faedfc96826d40b384b9601bb8d7f8188971a8e5
Instruction Fuzzy Hash: 5D21E2B5D00249EFDB00CFA9D584AEEBBF4FB48320F14842AE915A7710D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 055A8820, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,055A9771,00000800,00000000,00000000), ref: 055A9982

Memory Dump Source

Source File: 00000000.00000002.294080851.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0eb2ba468104cf5c73ab186309bf38e80d502fe54ebbcdad7998bf9ba5a522a6
Instruction ID: 4e9d9ad17c927a8eb6cbce35079aba117ff9982573c26283f3d3ba241f4a2704
Opcode Fuzzy Hash: 0eb2ba468104cf5c73ab186309bf38e80d502fe54ebbcdad7998bf9ba5a522a6
Instruction Fuzzy Hash: C11114B2D042499FDB10CF9AC484ADEFBF4FB98314F14842EE516A7610C775A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 055A9910, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,055A9771,00000800,00000000,00000000), ref: 055A9982

Memory Dump Source

Source File: 00000000.00000002.294080851.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d0ae9b559fe780d84134dbb3914b0d7ba66d36bd80656662ca7f8efedf558536
Instruction ID: 29251ea982bdc984943e7e05dbded09c4a3d97fd3d3c97f1cef0079533aec651
Opcode Fuzzy Hash: d0ae9b559fe780d84134dbb3914b0d7ba66d36bd80656662ca7f8efedf558536
Instruction Fuzzy Hash: E81103B29042499FDB10CF9AD484ADEFBF8BB88314F04842EE519A7600C775A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 055A968A, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 055A96F6

Memory Dump Source

Source File: 00000000.00000002.294080851.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ae8a416e93d4052eb04c69b89aa59c12a1179b53b11da8cfa8f1c00ae40dac67
Instruction ID: 74bb4cb27282f4fd5ae92e9db03ecd0a7ec508b94e4bd0535bb9b24ca45dfa79
Opcode Fuzzy Hash: ae8a416e93d4052eb04c69b89aa59c12a1179b53b11da8cfa8f1c00ae40dac67
Instruction Fuzzy Hash: EF1102B2D046598FDB10CF9AD484BDEFBF4BF89324F18841AD429A7600C775A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 055A9690, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 055A96F6

Memory Dump Source

Source File: 00000000.00000002.294080851.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 357fe4ea08fce5d4ace9a7a43f5bd20a80f0e9cefd3b80a9cf5d96816c2b9df6
Instruction ID: ff701726dd7e73a8721074990002159b56f3a858642ac71ae1fbe6a69d444f1f
Opcode Fuzzy Hash: 357fe4ea08fce5d4ace9a7a43f5bd20a80f0e9cefd3b80a9cf5d96816c2b9df6
Instruction Fuzzy Hash: E911DFB6D006598FDB10CF9AD488ADEFBF4BF89224F14841AD42AAB600C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05C8FD70, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f16784b25466d1a02402583598b27ebd9d1db34018788b2048e0cefab9290d8
Instruction ID: f2dbc17dafd9909d6cdf85938aa976424e8fb1a42661ee617ee0e6e994173447
Opcode Fuzzy Hash: 6f16784b25466d1a02402583598b27ebd9d1db34018788b2048e0cefab9290d8
Instruction Fuzzy Hash: 5A3107B5E14219DBCB48CFAAC4455EEBBF2AB89314F14D82AD515B7704EB349A018F90

Uniqueness

Uniqueness Score: -1.00%

Function 07C01DC8, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298451844.0000000007C00000.00000040.00000001.sdmp, Offset: 07BC0000, based on PE: true

Associated: 00000000.00000002.298409808.0000000007BC0000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febbb192554c7989875b9adb1b5a6d046db22a5478dfb91741241facdb1cc25b
Instruction ID: 24261f11a462a57639c9d807e714d26d24ec07aa37e9fe8f859515978f3efcd6
Opcode Fuzzy Hash: febbb192554c7989875b9adb1b5a6d046db22a5478dfb91741241facdb1cc25b
Instruction Fuzzy Hash: 6A218070A1010C9FDB14DBE4D899BEEBBB6EF88314F144429E512A7680DF305D41CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 05C8EB28, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a50845f8d8e7fd0891fa82b4855614c2784a7125a6d1f93791be1ad370d2e60
Instruction ID: 0271b2b7c2f7723950443fb10bc971f379edf82b8898e374890cb7ee2a602064
Opcode Fuzzy Hash: 8a50845f8d8e7fd0891fa82b4855614c2784a7125a6d1f93791be1ad370d2e60
Instruction Fuzzy Hash: AA01D134A1020CDBDB44DFA9D8406ADBBBAEBC8308F548879D509A3314EB305E45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 07C02DD8, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298451844.0000000007C00000.00000040.00000001.sdmp, Offset: 07BC0000, based on PE: true

Associated: 00000000.00000002.298409808.0000000007BC0000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff3e210c9ef49771f6174ac12921643d3af29cb5349986e80bb59e2584adeb5a
Instruction ID: f86c7c9eab1f5cf6ff0384624b9f99923c80d9d9eca8b8bd1bcc26606674ed49
Opcode Fuzzy Hash: ff3e210c9ef49771f6174ac12921643d3af29cb5349986e80bb59e2584adeb5a
Instruction Fuzzy Hash: E9F03075D1021C9BDB049EA6D4096EDBBB9AB8A311F049026D41573650DB3014458AD4

Uniqueness

Uniqueness Score: -1.00%

Function 07C005A0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298451844.0000000007C00000.00000040.00000001.sdmp, Offset: 07BC0000, based on PE: true

Associated: 00000000.00000002.298409808.0000000007BC0000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33281032b526a72348a4e000d79faf5312e4218c846513c65b69b3c558f9046
Instruction ID: 23ec493eb5f77b4d14ed0b1c943ffb6c14ade908a5daec1ea435f44ceea2ccb8
Opcode Fuzzy Hash: f33281032b526a72348a4e000d79faf5312e4218c846513c65b69b3c558f9046
Instruction Fuzzy Hash: FEE0E5B4D0121D9FCB44EFE8D9456ADBBF4FB48304F0085AA9818A3380E7701A41CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 07C037B0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298451844.0000000007C00000.00000040.00000001.sdmp, Offset: 07BC0000, based on PE: true

Associated: 00000000.00000002.298409808.0000000007BC0000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2359a9c41a75365e59c9c2ce71b4ea6dd83f84ce21cc411ca66138e3018112ae
Instruction ID: 89817c635c1a0b406433f05827219b648e8ae636dcb06449dc1592e7976035ed
Opcode Fuzzy Hash: 2359a9c41a75365e59c9c2ce71b4ea6dd83f84ce21cc411ca66138e3018112ae
Instruction Fuzzy Hash: 01E092B4E1120CAFCB84EFA8D54969CBBF4EB49604F1081AAD818D7360E735AA44CF81

Uniqueness

Uniqueness Score: -1.00%

Function 07C01D80, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298451844.0000000007C00000.00000040.00000001.sdmp, Offset: 07BC0000, based on PE: true

Associated: 00000000.00000002.298409808.0000000007BC0000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d740ff3d8e4082abc4f0525a80ca4817043f0d6f8d7d1ac375955b352330fdf
Instruction ID: 5454222358726b1e56fe26832f90454462bbc84622a758cdd5daebc49134bb85
Opcode Fuzzy Hash: 0d740ff3d8e4082abc4f0525a80ca4817043f0d6f8d7d1ac375955b352330fdf
Instruction Fuzzy Hash: 3DE0BDB4D1120CAFCB94EFE8E5493ACBFF4AB48204F1081AA9818E3640EA315A40CB81

Uniqueness

Uniqueness Score: -1.00%

Function 07C02F60, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298451844.0000000007C00000.00000040.00000001.sdmp, Offset: 07BC0000, based on PE: true

Associated: 00000000.00000002.298409808.0000000007BC0000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b06ab490589a3aac27340a7aa22ecc867862c58f4e2d6e50145e5ec2c31115a0
Instruction ID: fb3308ce37fcfc7025bb420aa1cbb08837e8add3ce1855a13d6bd6b30205451b
Opcode Fuzzy Hash: b06ab490589a3aac27340a7aa22ecc867862c58f4e2d6e50145e5ec2c31115a0
Instruction Fuzzy Hash: 9FE0E2B0E1120CAFCB84EFE8D5453ADBBF8AB44204F1081AA9828E3740EB355B05CFC1

Uniqueness

Uniqueness Score: -1.00%

Function 07C030D0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298451844.0000000007C00000.00000040.00000001.sdmp, Offset: 07BC0000, based on PE: true

Associated: 00000000.00000002.298409808.0000000007BC0000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c09a5147219ce35785a242db8d9d1d7b268752702e76cab0cdfad679a1626986
Instruction ID: 12a77d3b52d5d9014d119164ea1130c031f72348b36bdf7d43444dcffaf97f19
Opcode Fuzzy Hash: c09a5147219ce35785a242db8d9d1d7b268752702e76cab0cdfad679a1626986
Instruction Fuzzy Hash: 45D01274D0620C9BC754DFE9E4456ADBBB4AB44208F5081A9941853240D7715A55CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 07C03888, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298451844.0000000007C00000.00000040.00000001.sdmp, Offset: 07BC0000, based on PE: true

Associated: 00000000.00000002.298409808.0000000007BC0000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256b8f3633a7ca42166a043932b7e75f74f11d8cd6841b905a1ff67412373ed7
Instruction ID: e71514a077e4005aea1d1f0fe34da5c27aa08a8d315a581399dc01aaa4722bbd
Opcode Fuzzy Hash: 256b8f3633a7ca42166a043932b7e75f74f11d8cd6841b905a1ff67412373ed7
Instruction Fuzzy Hash: B9D01270D0520C9FC704DFE8E4456ADBBB4AB44204F1081A9940853740D7311A45CBC1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05C8B810, Relevance: 4.1, Strings: 3, Instructions: 308COMMON

Download Yara Rule

Strings

a, xrefs: 05C8B94A
>{il, xrefs: 05C8B90A
a, xrefs: 05C8B951

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID: >{il$a$a
API String ID: 0-3635123122
Opcode ID: fe1afccee9b65e28a117d1d70098bcae8fc24779a324f21911e78285223e3018
Instruction ID: 6a76339ccce40cd817d7c27752caa1eb712de54142473bbe369e18775b1be284
Opcode Fuzzy Hash: fe1afccee9b65e28a117d1d70098bcae8fc24779a324f21911e78285223e3018
Instruction Fuzzy Hash: 3DD15A70D0420ADFCB04DF96C4858AEFBB2FF89308B54D95AD415AB225D734AE42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05C89F10, Relevance: 2.6, Strings: 2, Instructions: 119COMMON

Download Yara Rule

Strings

G>R\, xrefs: 05C8A001
G>R\, xrefs: 05C89FFA

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID: G>R\$G>R\
API String ID: 0-4120643822
Opcode ID: c42f0f3e822e5f422e48427dcdf6477dfdc7c0a307014e6de2eb1f9e4f790361
Instruction ID: 902d33dcc9305e60593adba4942664a9b9a73bd51d02d1f63c029c9aeef66c15
Opcode Fuzzy Hash: c42f0f3e822e5f422e48427dcdf6477dfdc7c0a307014e6de2eb1f9e4f790361
Instruction Fuzzy Hash: 9B4105B4E042199FDB08DFAAC9406AEFBF2BF88305F14C46AD519B7250D7348A01CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05C8BCE8, Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

QRO, xrefs: 05C8BD36
iA+, xrefs: 05C8BDD5

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID: QRO$iA+
API String ID: 0-4058567163
Opcode ID: 5facc45e4c41afc70d168d4658fde8400312246f9f2fd0ae44426f069f22d227
Instruction ID: e5f816c0fd89a2bc5528cdc7cae579e30ed94fbbc18467e0f0d86307404112ae
Opcode Fuzzy Hash: 5facc45e4c41afc70d168d4658fde8400312246f9f2fd0ae44426f069f22d227
Instruction Fuzzy Hash: A1411A70E1521A9FCB04CF9AC5405AEFBF2FF89314F14992AD415B7329E7389A418FA0

Uniqueness

Uniqueness Score: -1.00%

Function 05C892B8, Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

cz, xrefs: 05C894B0

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID: cz
API String ID: 0-2477266049
Opcode ID: 7088fd7176d94f565cb02487e41a397d47fe710cb006be9f4b88d13c58f054a9
Instruction ID: 27c6a61b881944d439a44251a89c867de4dd7f77f1f44a8c75d2ae3473a15cc8
Opcode Fuzzy Hash: 7088fd7176d94f565cb02487e41a397d47fe710cb006be9f4b88d13c58f054a9
Instruction Fuzzy Hash: 4F81BF74E002198FDB08DFEAC984AAEBBB2FF88304F24952AD519BB354D7349905CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05C892B7, Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

cz, xrefs: 05C894B0

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID: cz
API String ID: 0-2477266049
Opcode ID: c02611ab371451f3949ec08a1d894e34604b227f6824547cdf3da216023a79dc
Instruction ID: 1066525f1afc426abcd9859af55bdadd0708c9c439752a3e2ae7d3c41dc70b7c
Opcode Fuzzy Hash: c02611ab371451f3949ec08a1d894e34604b227f6824547cdf3da216023a79dc
Instruction Fuzzy Hash: 6481B074E002198FDB08DFEAC985AAEBBB2BF88304F24952AD515BB354D7349905CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05C8DBB8, Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

N#bh, xrefs: 05C8DCAA

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID: N#bh
API String ID: 0-1948707044
Opcode ID: 993e904b3da6627a298834c898722ce08d63379f67252be5191b8a21730c8063
Instruction ID: 151cf3348c31049abe5869cba0efb4efb9fe94006908255e6e569d9d96799240
Opcode Fuzzy Hash: 993e904b3da6627a298834c898722ce08d63379f67252be5191b8a21730c8063
Instruction Fuzzy Hash: F9511370E15219DFCB08DFAAD9809EEFBF2BF88204F14992AD406A7364D7349A01CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05C8DDE0, Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

9R%I, xrefs: 05C8DF18

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID: 9R%I
API String ID: 0-615299898
Opcode ID: e2a6364375fc11239fa036d18cf298d0ebe4763de624075f1a55274a81b08159
Instruction ID: 378ff18fd778eef64b747748ec0359e7ccd271ea929e9fa59d8747df2ec57977
Opcode Fuzzy Hash: e2a6364375fc11239fa036d18cf298d0ebe4763de624075f1a55274a81b08159
Instruction Fuzzy Hash: 9C4118B4E0560ADFCB44DFAAC5815AEFBF2FF98304F24D46AC416B7254D7309A418BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05C8F078, Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

"1:V, xrefs: 05C8F373

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID: "1:V
API String ID: 0-2843155894
Opcode ID: a4a5e9e4e487629e30d4c124a00d194137e47b0131b5a1e5f3a142c96d9b991d
Instruction ID: 16548e27260f01428b71f0f75eb1feeb6c1ed2066aa4b4472576fb6bb3bf0f54
Opcode Fuzzy Hash: a4a5e9e4e487629e30d4c124a00d194137e47b0131b5a1e5f3a142c96d9b991d
Instruction Fuzzy Hash: B2411974E152199FDB14CFAAD841BAEFBB6BB88300F10C4AAD509A7355DB309A41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05C8D998, Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

,, xrefs: 05C8D9E5

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6c5a64c88f70960ed6a3a2bf8adfadd577fde987aca8507cda526021d1bcbf39
Instruction ID: 25730dcaac4320f120d87af4d2c675bdbac1e127b9f8ad16028209c5ffccd827
Opcode Fuzzy Hash: 6c5a64c88f70960ed6a3a2bf8adfadd577fde987aca8507cda526021d1bcbf39
Instruction Fuzzy Hash: B941D770E0460ADBCB44DFAAC5816EEFBB6AF88204F24C86AD416B7254D7749A41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05C816F0, Relevance: .7, Instructions: 722COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1528d9301325fe25489fc65ce1c9275a6a0b89e9c94b3a66c750afb8aaa6caab
Instruction ID: 6f3ebaa563edcee9342d2d77b4450ef9d81116cf666f5f5a19bf40384726337c
Opcode Fuzzy Hash: 1528d9301325fe25489fc65ce1c9275a6a0b89e9c94b3a66c750afb8aaa6caab
Instruction Fuzzy Hash: 44525175B001199FCB14EF69D488ABDB7F2BF88318B198569E816DB360DB31DD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07C005E8, Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298451844.0000000007C00000.00000040.00000001.sdmp, Offset: 07BC0000, based on PE: true

Associated: 00000000.00000002.298409808.0000000007BC0000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d703f7d3943afc93cd459420c5e717eb969b37ae77b1beb098c4153d9eeef227
Instruction ID: 20017ea8da22bc4835c3a1e8ce6e08e767b4fa948afc0d3598bd014ccfcb1a14
Opcode Fuzzy Hash: d703f7d3943afc93cd459420c5e717eb969b37ae77b1beb098c4153d9eeef227
Instruction Fuzzy Hash: 03C1ACB5E0021A8FCB04DFF9C4957AEBBB6BB89314F158529D415A7390EB349A818FD0

Uniqueness

Uniqueness Score: -1.00%

Function 05C87387, Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de16a2f55973a7ba2ca9d1c919c7079b3625aba8d3caf542c5b88463d306076
Instruction ID: 1e29785ba3064c74282a4f60c9c0ea6b9fbae84f902daaab0e7eb5e66e785092
Opcode Fuzzy Hash: 9de16a2f55973a7ba2ca9d1c919c7079b3625aba8d3caf542c5b88463d306076
Instruction Fuzzy Hash: B0D1C631C2075ACACB10EFA4D994AD9B771FF95300F518B9AD5097B220EB706EC8CB91

Uniqueness

Uniqueness Score: -1.00%

Function 055AC234, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.294080851.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1150c842a9dad2659e29aede832d5280420734cbb25221aeb99e112ea6e3c50
Instruction ID: f4e9a8abb5344015e4b4ab81824f69e1d7e31579bc111ae23546d652c28cbd7f
Opcode Fuzzy Hash: d1150c842a9dad2659e29aede832d5280420734cbb25221aeb99e112ea6e3c50
Instruction Fuzzy Hash: 13A15032E1021A8FCF05DFA5C9449DEBBB2FFC9300B15856AE905BB261EB71A945CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C87398, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afe690fe0e2a3e7fa16f80da3ff0346ae9f11edf666d2cca14d987459ce9d777
Instruction ID: fcae719cf3948a0d2018d2845b60dbcc9de20695376fbcb5f3347502a8cb2020
Opcode Fuzzy Hash: afe690fe0e2a3e7fa16f80da3ff0346ae9f11edf666d2cca14d987459ce9d777
Instruction Fuzzy Hash: 49D1B631C2075ACACB10EFA4D994A9DB771FF95300F618B9AD50977260EB706EC8CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05C85F55, Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58cebc1743cca17aaf4b7c84df5d6b747a333f87176c7f32ad66b0f6d5a8fa46
Instruction ID: 4b76e6eaf68ab444b74d21a45df89a21dfd7c980441ce0171786ce9dd8988723
Opcode Fuzzy Hash: 58cebc1743cca17aaf4b7c84df5d6b747a333f87176c7f32ad66b0f6d5a8fa46
Instruction Fuzzy Hash: 1391B575E002189FDB58DFA9D885BDEBBB2FF88304F208469E519AB354DB309941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05C85F58, Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a0e2cdcf715194430de2cc02f908a3c9991409b3b15f5f235881d092826363
Instruction ID: 1ea917b34c8c1e768796a612f1ab91b7d0bf401ce0f5be4f0188840e6807ebbd
Opcode Fuzzy Hash: d0a0e2cdcf715194430de2cc02f908a3c9991409b3b15f5f235881d092826363
Instruction Fuzzy Hash: 5F91B575E002189FDB58DFA9D885BDEBBB2FF88304F208469E519AB354DB309941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05C8C738, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c5c6891ec059ebae4f06f8b0e6a4406a94326a268f4053978266860fa73675
Instruction ID: 70706419105d846ff5262075b86bcb30f127601d9d43b0d050a6ea47bc601d03
Opcode Fuzzy Hash: 32c5c6891ec059ebae4f06f8b0e6a4406a94326a268f4053978266860fa73675
Instruction Fuzzy Hash: E281C274E15219CFCB04CFA9C5849AEFBF2FF89314B149969E415AB214D334AA41CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05C8A6F9, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb812555fea495d5840d6c3c931257e0f4d02730fcf46351100bd05d31cbfaf
Instruction ID: a85edffb96cda88b7b61d058abf931db1f087ccd91f70845cc6be35e344189f0
Opcode Fuzzy Hash: 0bb812555fea495d5840d6c3c931257e0f4d02730fcf46351100bd05d31cbfaf
Instruction Fuzzy Hash: E8515974E1561ADFCB04DF95D8809AEFBB2FF89314F20895AE405BB214D730AA42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C882D0, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58cce4150622499c38903c002d37bdff1921ad30852f53d755cc55ee76bb07eb
Instruction ID: e28d16c9fd47af1fb7d13c1c5084bd6109b74fc92e0ec1e721eb283bdb6ca5b0
Opcode Fuzzy Hash: 58cce4150622499c38903c002d37bdff1921ad30852f53d755cc55ee76bb07eb
Instruction Fuzzy Hash: 1251E474E042199FCB04DFAAC480AEEFBB2FF89304F54C969D414AB755C7349942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C89F00, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0587dc85025deb963f810791d9e3e8cead3d2b5a02c82f0d690737e7dbd5d30e
Instruction ID: fb8d0b2a72755477174c00abb00c773afcc2e9d08fa8692368dc72c007e94c1c
Opcode Fuzzy Hash: 0587dc85025deb963f810791d9e3e8cead3d2b5a02c82f0d690737e7dbd5d30e
Instruction Fuzzy Hash: 4B410674E046199FDB08DFAAC9416EEFBF2BF89305F14C56AE419A7250D7348A01CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05C88748, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c70734e40273c456e5f635a505a8492270e4849a7cc0d2808265465ad77b467
Instruction ID: 5191e1ef53b64bb06d9cc68e078264677aca5abe7b949136cc9958e0e2884803
Opcode Fuzzy Hash: 7c70734e40273c456e5f635a505a8492270e4849a7cc0d2808265465ad77b467
Instruction Fuzzy Hash: AE41FA74E00618DFDB18DFAAD840B9EFBB7BFC8204F04C4AAD508AB614EB305A418F51

Uniqueness

Uniqueness Score: -1.00%

Function 07C01130, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298451844.0000000007C00000.00000040.00000001.sdmp, Offset: 07BC0000, based on PE: true

Associated: 00000000.00000002.298409808.0000000007BC0000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f2d834b16f0dc58939f535d9aa45245a6fadf41b40ca3a97c96fab37649c2d
Instruction ID: 1596845fcce8a8fb6a5e6ec52e05392e41d1eec10aeef0aa4486696436368ca9
Opcode Fuzzy Hash: 27f2d834b16f0dc58939f535d9aa45245a6fadf41b40ca3a97c96fab37649c2d
Instruction Fuzzy Hash: C141D9B4E116198FDB58CF6AD980B9EFBF2BF89300F14C0A9D509A7354DB305A418F90

Uniqueness

Uniqueness Score: -1.00%

Function 05C88741, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e14d49c393011a839cf2be25baccaa2c1275c82a5aa6913978b9cdfe341d9924
Instruction ID: bd1c3fed5e5dd7f31a7bd4ae2f50261200c03de012916824259f459d21148b42
Opcode Fuzzy Hash: e14d49c393011a839cf2be25baccaa2c1275c82a5aa6913978b9cdfe341d9924
Instruction Fuzzy Hash: C741FEB4E00618CFDB18DFA6C94079EFBB3BFC8204F04C4AAD518AB614DB305A418F51

Uniqueness

Uniqueness Score: -1.00%

Function 07C00AC0, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298451844.0000000007C00000.00000040.00000001.sdmp, Offset: 07BC0000, based on PE: true

Associated: 00000000.00000002.298409808.0000000007BC0000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69d20a43c9303616178aa573ab53f56d8cec7be0db14505ed65a19a9a21861
Instruction ID: 0ee6bfbf1ebef98a5a26cc06707127d29acc0ac3c52105b230cb42b5aa4fbb57
Opcode Fuzzy Hash: 0c69d20a43c9303616178aa573ab53f56d8cec7be0db14505ed65a19a9a21861
Instruction Fuzzy Hash: C4313BB0E15219DBDB08CFAAD941B9EFBB7BFC9214F14C12AD908A7294D7345A41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C8A8A0, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5e284895b06b84341a6cb5a4ac594215b575bb5801b0b18f3788865d4b2e20
Instruction ID: 0dcc3d19990a5536e70e4c0c2c623e5b0f59427cc706ce823454e7711a76206a
Opcode Fuzzy Hash: 5a5e284895b06b84341a6cb5a4ac594215b575bb5801b0b18f3788865d4b2e20
Instruction Fuzzy Hash: FA21E771E016188BEB18CF9BD9402EEFBF7AFC8314F14C16AD409A7258DB741A46CA90

Uniqueness

Uniqueness Score: -1.00%

Function 05C8A890, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296429949.0000000005C80000.00000040.00000001.sdmp, Offset: 05C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f91c835fb77636ecb804b60301103f6a7b2dc86469bb595a49bbb1e6408d77f
Instruction ID: 14c4969063332f6ac622fbec4469da8706e55735738de4ddf11470479b9a649f
Opcode Fuzzy Hash: 6f91c835fb77636ecb804b60301103f6a7b2dc86469bb595a49bbb1e6408d77f
Instruction Fuzzy Hash: 2C21E974E04A588BDB18CF9AC9402DDFBF3AFC8300F14C06AD409A7268DB744A46CF90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vaklXcs.exe PID: 5732 Parent PID: 3388 vaklXcs.exeCOMMON

Executed Functions

Function 06BA0100, Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

8GpP, xrefs: 06BA02F1

Memory Dump Source

Source File: 00000014.00000002.455233926.0000000006BA0000.00000040.00000001.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000014.00000002.455184156.0000000006B60000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID: 8GpP
API String ID: 0-626703381
Opcode ID: a949dba2d1344780ade8389126e3be698b0671c138c603e419c17f91c253022e
Instruction ID: c4a75198317b14804d066b4f6daa1a8a1d07e9cb2c396b7daa702679a784717b
Opcode Fuzzy Hash: a949dba2d1344780ade8389126e3be698b0671c138c603e419c17f91c253022e
Instruction Fuzzy Hash: 32B117B4E092598FDB44DFE9C9855EEFBF2FF88318F1481AAD404AB214D7349941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06BA3088, Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.455233926.0000000006BA0000.00000040.00000001.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000014.00000002.455184156.0000000006B60000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f2336c9fbf06e873e74116178a21ad6fdab12f257894cd60114dfe6f15852a
Instruction ID: 3924c9f2c1a3f88a57c4a336c4579b10cd1936cf31773fd59f0ba2a820b2a606
Opcode Fuzzy Hash: a9f2336c9fbf06e873e74116178a21ad6fdab12f257894cd60114dfe6f15852a
Instruction Fuzzy Hash: CB71E4B4E042089FDB44DFE5D894AAEFBB2FF88301F10946AD916AB358DB346915CF50

Uniqueness

Uniqueness Score: -1.00%

Function 025AFE0C, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 025AFF2A

Memory Dump Source

Source File: 00000014.00000002.447824063.00000000025A0000.00000040.00000001.sdmp, Offset: 025A0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6a4950ba44d5d0b514f9471310baf65ad54a67656f9bb7ae627bc6d9e9ac1b70
Instruction ID: 68f9aa1a22ca4dc2d4b8b12798c235f43bf60dd8776822a762435923b4967007
Opcode Fuzzy Hash: 6a4950ba44d5d0b514f9471310baf65ad54a67656f9bb7ae627bc6d9e9ac1b70
Instruction Fuzzy Hash: A851DFB1D00308DFDB14CFA9D884ADEBFB1BF48314F24862AE819AB250D7759985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 025ADEDC, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 025AFF2A

Memory Dump Source

Source File: 00000014.00000002.447824063.00000000025A0000.00000040.00000001.sdmp, Offset: 025A0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 18026519df910ddacb2093d6b8851a54b49b7f72f681d35d0a8888fe7ef723e0
Instruction ID: 59be554cd253dd6ddb808a91d59179b3f632d1b3d750edf78b9dda41a1185b22
Opcode Fuzzy Hash: 18026519df910ddacb2093d6b8851a54b49b7f72f681d35d0a8888fe7ef723e0
Instruction Fuzzy Hash: 0E51DFB1D003089FDB14CFA9D894ADEFFB5BF48314F24812AE819AB250D7759985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 025A5364, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 025A5421

Memory Dump Source

Source File: 00000014.00000002.447824063.00000000025A0000.00000040.00000001.sdmp, Offset: 025A0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3048b5d8e93fa08061687cb7adefe666259ab3414be2d8f0d25a3164592df04c
Instruction ID: 0294445789790d9d97431168236aaa5fb4ca1925af51483181115a30ed9be736
Opcode Fuzzy Hash: 3048b5d8e93fa08061687cb7adefe666259ab3414be2d8f0d25a3164592df04c
Instruction Fuzzy Hash: AA41E471D04619CFEB14DFA9C985BCEBBB1BF48308F608069D408BB251EB75694ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 025A3E4C, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 025A5421

Memory Dump Source

Source File: 00000014.00000002.447824063.00000000025A0000.00000040.00000001.sdmp, Offset: 025A0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9983291a213ebc03767e729ecc45e5e7f3ab16756946e6c52facec5c2d353906
Instruction ID: 58b3efee26a9fbd185b24cc6c9170c25a9d843ffcb8dce08ccc0fd5e9dfcec1f
Opcode Fuzzy Hash: 9983291a213ebc03767e729ecc45e5e7f3ab16756946e6c52facec5c2d353906
Instruction Fuzzy Hash: 9641F371C0421CCBDB24DFA9C884BCEBBB5BF48308F608069D408BB251DBB56949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 025AA1D4, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,025AB99E,?,?,?,?,?), ref: 025ABA5F

Memory Dump Source

Source File: 00000014.00000002.447824063.00000000025A0000.00000040.00000001.sdmp, Offset: 025A0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c5299d36b7c7a1d072ea3550a0f5776c25ea7c2b9f3494b4dbc4d3ea9027ed0a
Instruction ID: bf921c54046deb020123c16c38fe5159295284368e7f880f67e314463b22bbe5
Opcode Fuzzy Hash: c5299d36b7c7a1d072ea3550a0f5776c25ea7c2b9f3494b4dbc4d3ea9027ed0a
Instruction Fuzzy Hash: 9B2103B5D00208AFDB10CFAAD484AEEBFF4FB58324F14805AE914A7350D374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 025AB9D0, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,025AB99E,?,?,?,?,?), ref: 025ABA5F

Memory Dump Source

Source File: 00000014.00000002.447824063.00000000025A0000.00000040.00000001.sdmp, Offset: 025A0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: af955d936cfc5d0bc9089bb1ea2cebcce5beec61cebf47c4ed3950c9061c409a
Instruction ID: 8470d1d51c3c239f6be289b176164055f8ebedea040d336752061ca54e56a284
Opcode Fuzzy Hash: af955d936cfc5d0bc9089bb1ea2cebcce5beec61cebf47c4ed3950c9061c409a
Instruction Fuzzy Hash: 7221E0B5D00208DFDB10CFA9D584ADEBBF5FB58324F14801AE915A7350D378AA54CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 025A8820, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,025A9771,00000800,00000000,00000000), ref: 025A9982

Memory Dump Source

Source File: 00000014.00000002.447824063.00000000025A0000.00000040.00000001.sdmp, Offset: 025A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 989b959caf5a1a424651d845f44df9dc8d5cf1f167b77254321079332f480ba6
Instruction ID: ac5fa2adbb40c75027701f2572fd7f85c13e2616f8b688ad8fc3eaacc05a8440
Opcode Fuzzy Hash: 989b959caf5a1a424651d845f44df9dc8d5cf1f167b77254321079332f480ba6
Instruction Fuzzy Hash: 9B1133B29002099FDB10CF9AC444ADEFBF4FB88314F00842EE815A7200C374A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 025A9910, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,025A9771,00000800,00000000,00000000), ref: 025A9982

Memory Dump Source

Source File: 00000014.00000002.447824063.00000000025A0000.00000040.00000001.sdmp, Offset: 025A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9b692f8c348e8a188cee6fc63e05691ae9a27c20ac56760898a89b4986c2b250
Instruction ID: 0796d901dd043dad0cbcb02e7f2978689b73d25d9adcbf4441158ac1529671fc
Opcode Fuzzy Hash: 9b692f8c348e8a188cee6fc63e05691ae9a27c20ac56760898a89b4986c2b250
Instruction Fuzzy Hash: 0F1100B6D002499FDB10CF9AD484ADEFBF4FB98324F04842AD919AB600C775A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 025A968A, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 025A96F6

Memory Dump Source

Source File: 00000014.00000002.447824063.00000000025A0000.00000040.00000001.sdmp, Offset: 025A0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7d3cccd373c32e4d9d2a36f59473a0146f77c9583cad3680b7d2202f7af4ba6c
Instruction ID: a356e9e346325305fbf5c4938a4869a0197c0891b326613d58046918a02e70c7
Opcode Fuzzy Hash: 7d3cccd373c32e4d9d2a36f59473a0146f77c9583cad3680b7d2202f7af4ba6c
Instruction Fuzzy Hash: 621102B6D006598FDB10CF9AC484BDEFBF4EF89224F14845AD429AB600C378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 025A9690, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 025A96F6

Memory Dump Source

Source File: 00000014.00000002.447824063.00000000025A0000.00000040.00000001.sdmp, Offset: 025A0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4fc174387f2de02eb507c3a9df119838f85e1111ecbb1afcb6ced85622c3ebed
Instruction ID: 3e3e2a0d791f47e162eef31505f6df15c8612dd1e1365a8e22203e70c70325e7
Opcode Fuzzy Hash: 4fc174387f2de02eb507c3a9df119838f85e1111ecbb1afcb6ced85622c3ebed
Instruction Fuzzy Hash: D211DFB6D006598FDB10CF9AC444ADEFBF4AF89224F14845AD829AB610C378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06BA1DC8, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.455233926.0000000006BA0000.00000040.00000001.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000014.00000002.455184156.0000000006B60000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18a1a0e6379fbb5e875da71e88eacf25e383e3c940be9bf2a61b0e4b73ffd906
Instruction ID: ca62a702e4c253d6e7f949e582fcdd3c194f9c79504c32712807d9733fed8a6f
Opcode Fuzzy Hash: 18a1a0e6379fbb5e875da71e88eacf25e383e3c940be9bf2a61b0e4b73ffd906
Instruction Fuzzy Hash: FD21A070F14208DFDB84DBB8D845AEEBBB6EF88315F008429D402A7684DF345C11CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A7D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.447487281.0000000000A7D000.00000040.00000001.sdmp, Offset: 00A7D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deb9ceef432db4d7a4d9fe64d4ce79905ad391e4d312ce31f55068195674178
Instruction ID: 60fb1926f7cc63893b88d3a21e6b48f34682d46dc76cff3215bf5337ae5a5ef8
Opcode Fuzzy Hash: 5deb9ceef432db4d7a4d9fe64d4ce79905ad391e4d312ce31f55068195674178
Instruction Fuzzy Hash: E62103B1504240EFDB05DF14D9C0B2ABF75FF88328F24C969E8091B246C336D846DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A8D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.447527977.0000000000A8D000.00000040.00000001.sdmp, Offset: 00A8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f73c6042200bf126a5960db7e2884cb032ad87869f58a6b319cfb1b44f9099
Instruction ID: f7c215ff401d53637c99c7b1a82223b220451345d4406de42ae876862896fc0f
Opcode Fuzzy Hash: 57f73c6042200bf126a5960db7e2884cb032ad87869f58a6b319cfb1b44f9099
Instruction Fuzzy Hash: B921D075504244EFDB14EF14D8C4B16BB75FB88328F24C969D84A4B386C73AD846DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A8D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.447527977.0000000000A8D000.00000040.00000001.sdmp, Offset: 00A8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e56c6ee9281902b90ce5008add78cbf531bbbac6f59730cbfa45dc8d8e9ef6
Instruction ID: 6de1f388c6f7430884646fb5d4dd25bd26953c6531e1280dd383507a80bace3a
Opcode Fuzzy Hash: 48e56c6ee9281902b90ce5008add78cbf531bbbac6f59730cbfa45dc8d8e9ef6
Instruction Fuzzy Hash: C82107B1904204EFDB01EF54D5C4B56BB65FB84314F24CA6DD8094F381D736D846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A8D006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.447527977.0000000000A8D000.00000040.00000001.sdmp, Offset: 00A8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e20d2f17b07fc4234b0686f185998d41a0b0ab257e3bb1209649451e6e29fa2
Instruction ID: bdcf809c8b27eb72f0af3e4eb9f658a4affe811bd491602b1bb48efdc9a3bb68
Opcode Fuzzy Hash: 9e20d2f17b07fc4234b0686f185998d41a0b0ab257e3bb1209649451e6e29fa2
Instruction Fuzzy Hash: C0219F75408380DFCB02DF24D994B11BF71EB46314F28C5EAD8498F6A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A7D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.447487281.0000000000A7D000.00000040.00000001.sdmp, Offset: 00A7D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d004d151982520d82b782d4735647871151bc0f40ac205a76a03d9cb8f3c13
Instruction ID: 3ebd93caff25166db4891b76917af23e25fc40bfbf596f61b00db4b822379314
Opcode Fuzzy Hash: 99d004d151982520d82b782d4735647871151bc0f40ac205a76a03d9cb8f3c13
Instruction Fuzzy Hash: B811D376504280CFCB12CF14D9C4B16BF71FF94324F24C6AAD8490B656C336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A8D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.447527977.0000000000A8D000.00000040.00000001.sdmp, Offset: 00A8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10598f41ecae80e3ed7eaa2e4d93e548ce5d2277042f09e11ef5a73a669a8393
Instruction ID: f0d6d014152e715d17c0e512f3f6f35612e28bd3bb78f31f30fb2f0acd8e4550
Opcode Fuzzy Hash: 10598f41ecae80e3ed7eaa2e4d93e548ce5d2277042f09e11ef5a73a669a8393
Instruction Fuzzy Hash: 8611B875904280DFCB02DF14C5C4B55BBA1FB84324F28C6AED8494B696C33AD85ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A7D745, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.447487281.0000000000A7D000.00000040.00000001.sdmp, Offset: 00A7D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84aa9e75d76e9296dbeef6c11be97d0107b622b381c83be037bfd9a9f18fe293
Instruction ID: 34e184ba5c386e5d5ca7b35455cd73a1c07534749f93c891834afe32474bf645
Opcode Fuzzy Hash: 84aa9e75d76e9296dbeef6c11be97d0107b622b381c83be037bfd9a9f18fe293
Instruction Fuzzy Hash: 2C01DF72508244AAE7148B29CD84B67BBA8EF51378F18C55AE9085E282DB799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 06BA2DD8, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.455233926.0000000006BA0000.00000040.00000001.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000014.00000002.455184156.0000000006B60000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e820cdb7f4ecad2f5baa59d9a56e98b56f465960df2dc636d3bee1c52fbb08b
Instruction ID: 6ce3082d132db11862198693def685bfe7b3d970d220db43112fbd924df3a092
Opcode Fuzzy Hash: 1e820cdb7f4ecad2f5baa59d9a56e98b56f465960df2dc636d3bee1c52fbb08b
Instruction Fuzzy Hash: EDF08275D142189BDB08DFBAE4085FEFBBAEFCA312F04A43AD905B3254DB301855CA94

Uniqueness

Uniqueness Score: -1.00%

Function 00A7D744, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.447487281.0000000000A7D000.00000040.00000001.sdmp, Offset: 00A7D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0f70a5b8467062cc707133c117d2f39797f85dcac3f095f6ed3cb6ef2483db
Instruction ID: 9c112329054d2ad36a61fc6f76e0951b4b5a1a5dcfe28097bf6240bfde67da50
Opcode Fuzzy Hash: 5e0f70a5b8467062cc707133c117d2f39797f85dcac3f095f6ed3cb6ef2483db
Instruction Fuzzy Hash: 7BF0AF72404244AAE7148F19CC84B62FFA8EF91334F18C45AED080B686C6799844CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 06BA05A0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.455233926.0000000006BA0000.00000040.00000001.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000014.00000002.455184156.0000000006B60000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e1b0a1ef7381e6a6713ec6cdca4451d67e309ba26ec4ad0cc2ea2c13d48e60
Instruction ID: 0ad174b07ee5679d2e0992fdd060387a0e04250ed6d71202499df1ad13ce0224
Opcode Fuzzy Hash: c2e1b0a1ef7381e6a6713ec6cdca4451d67e309ba26ec4ad0cc2ea2c13d48e60
Instruction Fuzzy Hash: D7E01AB4D0521CAFCB44EFE8D9442ADBBF4FB48305F0085AAD818A3345E7702A15CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06BA3728, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.455233926.0000000006BA0000.00000040.00000001.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000014.00000002.455184156.0000000006B60000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f8bd3b12576a2ac9e7b4e480711f745ec86a637e9a5f9e8ecfb3c6dcf0ab78
Instruction ID: 0c5188135b05e43a6286022e815e2114ef82669cb26b5221e4861ba6740236ad
Opcode Fuzzy Hash: 28f8bd3b12576a2ac9e7b4e480711f745ec86a637e9a5f9e8ecfb3c6dcf0ab78
Instruction Fuzzy Hash: 3FE092B4E15208EFCB84DFA9D545A9CBBF4EB48605F1081EAD818D7360E635AA54CF41

Uniqueness

Uniqueness Score: -1.00%

Function 06BA3800, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.455233926.0000000006BA0000.00000040.00000001.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000014.00000002.455184156.0000000006B60000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3441be8fe5ac3f704d7f4d1246e3ca0c1443c6fdb50d35f017cf3a66b7f3ca52
Instruction ID: 906c384c7b0090ad9f643f44101b7c3850766558598fb715bc970d67bbcd6538
Opcode Fuzzy Hash: 3441be8fe5ac3f704d7f4d1246e3ca0c1443c6fdb50d35f017cf3a66b7f3ca52
Instruction Fuzzy Hash: 22D01270D0520CAFCB44DFE9E4046ADBBF4EB44204F1085BA841893754D7341A55CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06BA3FA0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.455233926.0000000006BA0000.00000040.00000001.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000014.00000002.455184156.0000000006B60000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eae395aac5bbdea2f04cb48f917a4305c34b9d648b21b2d5544260dd4a53f99
Instruction ID: 07ac4508711d1971deef138c84b8d478865d29856cd224080c1af307a7e28333
Opcode Fuzzy Hash: 8eae395aac5bbdea2f04cb48f917a4305c34b9d648b21b2d5544260dd4a53f99
Instruction Fuzzy Hash: ECE0E2B0D1521CAFCB84EFA9D4042ACBBF9EB44204F0084AA8818E3340EB796A55CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06BA1D80, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.455233926.0000000006BA0000.00000040.00000001.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000014.00000002.455184156.0000000006B60000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611733d0ab8d5b6c3ebe347d65ba51f180e321ce157dc12d7570fed9142a3b25
Instruction ID: 7077527948277699a818ee887a68beb570a9629f2978203bc2a59e8cba761a8a
Opcode Fuzzy Hash: 611733d0ab8d5b6c3ebe347d65ba51f180e321ce157dc12d7570fed9142a3b25
Instruction Fuzzy Hash: 17E0EC74D0520CAFCB94DFB9E5482ACBFF4EB44205F1081E98818D3344E7346A50CB41

Uniqueness

Uniqueness Score: -1.00%

Function 06BA2F60, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.455233926.0000000006BA0000.00000040.00000001.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000014.00000002.455184156.0000000006B60000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac1e01a7d665cc097f270b36e58a4d54baa1d6ce4f2dfc65ca67c18c27c8041f
Instruction ID: c4cea156e10fe50d08eee8ea808ed48f2ca6ae014b52d21cecac7871cae23aab
Opcode Fuzzy Hash: ac1e01a7d665cc097f270b36e58a4d54baa1d6ce4f2dfc65ca67c18c27c8041f
Instruction Fuzzy Hash: 00E0EC70E1520CAFCB84DFA9D5053ADBBF4EB44204F1085AA8818D3344E7355A15CF81

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: vaklXcs.exe PID: 1332 Parent PID: 3388 vaklXcs.exeCOMMON

Executed Functions

Function 007BB7A0, Relevance: 6.1, APIs: 4, Instructions: 125threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 007BB810
GetCurrentThread.KERNEL32 ref: 007BB84D
GetCurrentProcess.KERNEL32 ref: 007BB88A
GetCurrentThreadId.KERNEL32 ref: 007BB8E3

Memory Dump Source

Source File: 00000016.00000002.470326605.00000000007B0000.00000040.00000001.sdmp, Offset: 007B0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ed853f5cb37f3011a9a334acd4406829e9c6b8f880e2bd96d915266e15562a7e
Instruction ID: f84ef892cbc531c723c0126dfbbfab7203f538ee6dce5e159008e0ffe63d6db6
Opcode Fuzzy Hash: ed853f5cb37f3011a9a334acd4406829e9c6b8f880e2bd96d915266e15562a7e
Instruction Fuzzy Hash: 755155B0E002498FDB14CFAAD588BDEBBF5EF59314F24885EE419A7350D7786844CB62

Uniqueness

Uniqueness Score: -1.00%

Function 007BB7B0, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 007BB810
GetCurrentThread.KERNEL32 ref: 007BB84D
GetCurrentProcess.KERNEL32 ref: 007BB88A
GetCurrentThreadId.KERNEL32 ref: 007BB8E3

Memory Dump Source

Source File: 00000016.00000002.470326605.00000000007B0000.00000040.00000001.sdmp, Offset: 007B0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 224306c5b79784a5e4542804c706992e84d232a19dee5967a6b92a4259469840
Instruction ID: ae7828acb409882c123bb80a6ac4de333c959f0ee006a30782bcd5b38893f0ee
Opcode Fuzzy Hash: 224306c5b79784a5e4542804c706992e84d232a19dee5967a6b92a4259469840
Instruction Fuzzy Hash: 7F5144B0D002498FDB14CFAAD548BDEBBF5FF49314F20886AE419A7350D7B46844CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 007BFE0C, Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 007BFF2A

Memory Dump Source

Source File: 00000016.00000002.470326605.00000000007B0000.00000040.00000001.sdmp, Offset: 007B0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a4108da17e68bcd30aafe83ff9638df7ffb3c73cd5827c4191010b5d4d6bb76c
Instruction ID: cf604db292e7563930147300f47bdae10ecda717a27cbd1f74fbe22ae714388c
Opcode Fuzzy Hash: a4108da17e68bcd30aafe83ff9638df7ffb3c73cd5827c4191010b5d4d6bb76c
Instruction Fuzzy Hash: A751EFB1D00309DFDB14CFA9C884ADEFBB5BF88714F24852AE819AB250D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 007BFE18, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 007BFF2A

Memory Dump Source

Source File: 00000016.00000002.470326605.00000000007B0000.00000040.00000001.sdmp, Offset: 007B0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f881926a2d5140c406dcdbcf2ac1cc3b88e5d3890e3fbb507a9de8b5d362ee4e
Instruction ID: 12726c06efa88840f54d6d451172eacbc3864836e8f4e22def928d82b0d8e5c1
Opcode Fuzzy Hash: f881926a2d5140c406dcdbcf2ac1cc3b88e5d3890e3fbb507a9de8b5d362ee4e
Instruction Fuzzy Hash: CD41BFB1D00309DFDB14CFA9C884ADEBBB5BF48714F24852AE819AB210D7759985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 007B5364, Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 007B5421

Memory Dump Source

Source File: 00000016.00000002.470326605.00000000007B0000.00000040.00000001.sdmp, Offset: 007B0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1d2ca5051d46204697ca17eaec762829b2e1ea814f57f8d9c6f38bfd564576de
Instruction ID: 17d6786190a78a32ae17c98131b79d50c1d031643037643dd8cf4a8cc61b706d
Opcode Fuzzy Hash: 1d2ca5051d46204697ca17eaec762829b2e1ea814f57f8d9c6f38bfd564576de
Instruction Fuzzy Hash: FE410671C0461DCFDB24CFA9C8447DEBBB5BF49305F20806AD409AB251D7B9594ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 007B3E4C, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 007B5421

Memory Dump Source

Source File: 00000016.00000002.470326605.00000000007B0000.00000040.00000001.sdmp, Offset: 007B0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4a890c66c789ae7fbf55a99aae1cb4ba53812e8ca38c54c89b2c0d018dfef02b
Instruction ID: 4100e610ac8b354d772e69945592871496071c2a309d4e810f44ef56ff546405
Opcode Fuzzy Hash: 4a890c66c789ae7fbf55a99aae1cb4ba53812e8ca38c54c89b2c0d018dfef02b
Instruction Fuzzy Hash: 0B41D471C0461CCFDB24DFA9C844BDEBBB5BF49304F20846AD409AB251DBB95949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 007BB9D0, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 007BBA5F

Memory Dump Source

Source File: 00000016.00000002.470326605.00000000007B0000.00000040.00000001.sdmp, Offset: 007B0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: dc4651f0c43da4977ab7171570b84e3db6038cff8291ee246c6faa87cadb0950
Instruction ID: b0b27e195d75beb1b79b6e8b49ba6693edabdbb27134c87cbc27d19660524132
Opcode Fuzzy Hash: dc4651f0c43da4977ab7171570b84e3db6038cff8291ee246c6faa87cadb0950
Instruction Fuzzy Hash: 892103B5D002089FDB10CFAAD484AEEBFF5FB48320F14841AE954A3310D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 007BB9D8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 007BBA5F

Memory Dump Source

Source File: 00000016.00000002.470326605.00000000007B0000.00000040.00000001.sdmp, Offset: 007B0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: aadf21675246e022353fb5699194c87e5ec463b6f3847352111af62bc5517355
Instruction ID: 45cc1732ffa3d641218ad084aa73dbc5f4876347d2234e334a6830f7d28cdc0d
Opcode Fuzzy Hash: aadf21675246e022353fb5699194c87e5ec463b6f3847352111af62bc5517355
Instruction Fuzzy Hash: DE21C4B5D002099FDB10CFAAD584ADEBBF4FB48324F14841AE915A7310D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 007B8820, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,007B9771,00000800,00000000,00000000), ref: 007B9982

Memory Dump Source

Source File: 00000016.00000002.470326605.00000000007B0000.00000040.00000001.sdmp, Offset: 007B0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c35fea12e2b7c9e0d4955f0591dbd3cfe90f29bee3bfda46d582ffbe437a558d
Instruction ID: 2c71a2e95155dcd8f9477f009c6351a493943429f30d6cb89c0dcdae6971436e
Opcode Fuzzy Hash: c35fea12e2b7c9e0d4955f0591dbd3cfe90f29bee3bfda46d582ffbe437a558d
Instruction Fuzzy Hash: D31106B19002099FDB10CF9AC444BDEFBF4EB88314F14842ED515A7600C379A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 007B9910, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,007B9771,00000800,00000000,00000000), ref: 007B9982

Memory Dump Source

Source File: 00000016.00000002.470326605.00000000007B0000.00000040.00000001.sdmp, Offset: 007B0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 78a09bfce567f013deb5b09ca319fc50d05b5e826f85cb776c1f4355a7c547a4
Instruction ID: 3f38f7d679a2c4f423442688964054fc749d1e760c45121895c9a3a659f6928c
Opcode Fuzzy Hash: 78a09bfce567f013deb5b09ca319fc50d05b5e826f85cb776c1f4355a7c547a4
Instruction Fuzzy Hash: 671106B6D002498FDB10CFAAD484BEEFBF4AB98314F14842ED959A7600C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 007B968A, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 007B96F6

Memory Dump Source

Source File: 00000016.00000002.470326605.00000000007B0000.00000040.00000001.sdmp, Offset: 007B0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 82606d3db608e350b827cbd211c2d3a74648078240e9ba10e9ef116b501569e1
Instruction ID: 86e01ae2b9d5e8994305736ea583aab00b10601fe17b36926eb7c89b5e5cece7
Opcode Fuzzy Hash: 82606d3db608e350b827cbd211c2d3a74648078240e9ba10e9ef116b501569e1
Instruction Fuzzy Hash: 5B1146B1C006498FDB10CF9AD444BDEFBF4AF88314F14845AD529B7600D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 007B9690, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 007B96F6

Memory Dump Source

Source File: 00000016.00000002.470326605.00000000007B0000.00000040.00000001.sdmp, Offset: 007B0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2c81e9c36c62e41e0b05a434ee47f6205951f8dae0ccfd4d881106996a0b4a41
Instruction ID: c70fc331ddf56c7723c90c406323a138bd59d1e50f322f4de84bc33a4ab5b1f2
Opcode Fuzzy Hash: 2c81e9c36c62e41e0b05a434ee47f6205951f8dae0ccfd4d881106996a0b4a41
Instruction Fuzzy Hash: AC11E0B5D006498FDB10CF9AC448BDEFBF4AF88324F14846AD929B7600D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 006CD4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.469954251.00000000006CD000.00000040.00000001.sdmp, Offset: 006CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16df13771796d3376065ca0dbc100f8e18ab70f6594434f9506e14f638bd2193
Instruction ID: cb34eebf63b1065adb819bc46f2b0d4501ede9039f46a2e2ccfdc266cbe45ac1
Opcode Fuzzy Hash: 16df13771796d3376065ca0dbc100f8e18ab70f6594434f9506e14f638bd2193
Instruction Fuzzy Hash: 0E21C1B1504240EFDB05DF14D9C0F6ABB66FB98328F24C57DE9054B346C336D856DAA1

Uniqueness

Uniqueness Score: -1.00%

Function 006ED01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.470095932.00000000006ED000.00000040.00000001.sdmp, Offset: 006ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69af153b97390a4fd95b23a88ddb4e47bcc1fe4ee79f9bea656d5b1b91d47950
Instruction ID: 6175856ae1d74caf6208194a3d9ee71325778e44e6a693eb0aa97fa4b30f3592
Opcode Fuzzy Hash: 69af153b97390a4fd95b23a88ddb4e47bcc1fe4ee79f9bea656d5b1b91d47950
Instruction Fuzzy Hash: 91210475505380DFDB14CF14D8C4B56BB66FB88324F28C969D8094F346C73AD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 006ED1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.470095932.00000000006ED000.00000040.00000001.sdmp, Offset: 006ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe66b44c1f71f794249e41cc589efeb33d257c014feeab5f68db0f1bf1a59e2
Instruction ID: e0c4317d004b8da5c755da2bbf851a646bc70580d6c13da552e199d4083a6258
Opcode Fuzzy Hash: 2fe66b44c1f71f794249e41cc589efeb33d257c014feeab5f68db0f1bf1a59e2
Instruction Fuzzy Hash: 72213775904380EFDB01CF15D5C0B5ABB66FB84314F20C96DDA094F381C336D846DA61

Uniqueness

Uniqueness Score: -1.00%

Function 006ED006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.470095932.00000000006ED000.00000040.00000001.sdmp, Offset: 006ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7db455def9ea9f21d17eac6542eb518ac242f05d5f7d72aed15dd490e1430d0
Instruction ID: 91409b660ee2f729d99ca005ad9b12ee38e0351c89c53545d37b2db304a661bf
Opcode Fuzzy Hash: a7db455def9ea9f21d17eac6542eb518ac242f05d5f7d72aed15dd490e1430d0
Instruction Fuzzy Hash: 6F217F755093C08FCB02CF24D994755BF71AB46214F28C5DAD8498B7A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 006CD4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.469954251.00000000006CD000.00000040.00000001.sdmp, Offset: 006CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d004d151982520d82b782d4735647871151bc0f40ac205a76a03d9cb8f3c13
Instruction ID: 41e768811dc0738d6fafc581e9f9943d16fca113f3803be48961e084ac7fe18d
Opcode Fuzzy Hash: 99d004d151982520d82b782d4735647871151bc0f40ac205a76a03d9cb8f3c13
Instruction Fuzzy Hash: A4119D76404280DFCB12CF14D9C4B66BF62FB94324F2486AED8454B756C336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 006ED1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.470095932.00000000006ED000.00000040.00000001.sdmp, Offset: 006ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10598f41ecae80e3ed7eaa2e4d93e548ce5d2277042f09e11ef5a73a669a8393
Instruction ID: 3c03e7e46e36f57087dca233349b62199e0c56931cbbdaafa1b0b4e924bceaf2
Opcode Fuzzy Hash: 10598f41ecae80e3ed7eaa2e4d93e548ce5d2277042f09e11ef5a73a669a8393
Instruction Fuzzy Hash: 8D118B75904280DFCB12CF14D5C4B55BBA2FB84324F28C6AEDA494B796C33AD94ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 006CD745, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.469954251.00000000006CD000.00000040.00000001.sdmp, Offset: 006CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd87c1d59cfb1ffc2650086b7905fc38ae42240cfe78c4febc14d4e190890a36
Instruction ID: 03ea52fa036bd562ddbfa86ff32a1eda1b4c9777efe382d1e97df8b50580369f
Opcode Fuzzy Hash: cd87c1d59cfb1ffc2650086b7905fc38ae42240cfe78c4febc14d4e190890a36
Instruction Fuzzy Hash: 40014271408344AAE7108E25CC84FB6BB9CEF41338F08886EE9084F382D7389801CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 006CD744, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.469954251.00000000006CD000.00000040.00000001.sdmp, Offset: 006CD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c820eb24d696680eb33ecf2d12f3aec7f488e56c29bc23b4afee0da2fda564
Instruction ID: 20585e65db3dd1bf2b671124aac4d7770e19bbec549ec6a164cdbb23fe416ee9
Opcode Fuzzy Hash: 71c820eb24d696680eb33ecf2d12f3aec7f488e56c29bc23b4afee0da2fda564
Instruction Fuzzy Hash: 6BF06271405344AEEB108E16CCC8BA2FB98EB51734F18C46EED085B786C7799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: vaklXcs.exe PID: 244 Parent PID: 1332 vaklXcs.exeCOMMON

Executed Functions

Function 01086B78, Relevance: 6.1, APIs: 4, Instructions: 133threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01086C00
GetCurrentThread.KERNEL32 ref: 01086C3D
GetCurrentProcess.KERNEL32 ref: 01086C7A
GetCurrentThreadId.KERNEL32 ref: 01086CD3

Memory Dump Source

Source File: 00000021.00000002.480986757.0000000001080000.00000040.00000001.sdmp, Offset: 01080000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 473129d2a589e7e4adf08157403851746056ce96e28ff74b90844737197ad858
Instruction ID: a45c1aeaf81d49f956e4264d1da632d79405793aa38a2c3d61d34c5c3e07ef67
Opcode Fuzzy Hash: 473129d2a589e7e4adf08157403851746056ce96e28ff74b90844737197ad858
Instruction Fuzzy Hash: 895166B0D046498FDB14CFA9D548BEEBFF0EF48314F14849AE089AB350DB755944CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01086BA0, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01086C00
GetCurrentThread.KERNEL32 ref: 01086C3D
GetCurrentProcess.KERNEL32 ref: 01086C7A
GetCurrentThreadId.KERNEL32 ref: 01086CD3

Memory Dump Source

Source File: 00000021.00000002.480986757.0000000001080000.00000040.00000001.sdmp, Offset: 01080000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: eda093b35c367c1468a23a69cc9c9fbd2ed37ac459113eb2e5dd166887929373
Instruction ID: 3057e201d6cbe3049a844cd6b37b02e94b18f135507b2675a47e370ce9815228
Opcode Fuzzy Hash: eda093b35c367c1468a23a69cc9c9fbd2ed37ac459113eb2e5dd166887929373
Instruction Fuzzy Hash: 525153B0D046498FDB54CFAAD548BEEBBF0EF48314F24845AE049A7350CB75A884CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01085270, Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 01085402

Memory Dump Source

Source File: 00000021.00000002.480986757.0000000001080000.00000040.00000001.sdmp, Offset: 01080000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7483230f9d290194b099d8e0be3b660195463b9275be524cc3c92827f573535b
Instruction ID: cae61e35e57cbc9e9e8255568849e4399c716f945ab4646bc318c8cb3cfe24d0
Opcode Fuzzy Hash: 7483230f9d290194b099d8e0be3b660195463b9275be524cc3c92827f573535b
Instruction Fuzzy Hash: A35111B2D04249EFDF01CFA9C984ADDBFB1BF48304F19816AE958AB221D7749855CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010852F0, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 01085402

Memory Dump Source

Source File: 00000021.00000002.480986757.0000000001080000.00000040.00000001.sdmp, Offset: 01080000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 938d9af3d2ce55695fe67f703a0ab9fdd93de6ec2230bb48f5f5ca19f5c7ccbd
Instruction ID: 7ed3abc74e1428ebfa259b5954354d2fb0da27accb8b0568ee1cf01c3cd8d461
Opcode Fuzzy Hash: 938d9af3d2ce55695fe67f703a0ab9fdd93de6ec2230bb48f5f5ca19f5c7ccbd
Instruction Fuzzy Hash: 5B41AFB1D043499FEB14DF99C884ADEBBF5BF48314F24812AE859AB210D7749885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01086ADC, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 01087D51

Memory Dump Source

Source File: 00000021.00000002.480986757.0000000001080000.00000040.00000001.sdmp, Offset: 01080000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: a43700dee49e704482a33a3f84126002d499812ed29c505746ebb8cc6743ade8
Instruction ID: 51edf8bdb66b6d12fcd05692dbea4bb461888d519d736f19da277d6c09875ea3
Opcode Fuzzy Hash: a43700dee49e704482a33a3f84126002d499812ed29c505746ebb8cc6743ade8
Instruction Fuzzy Hash: 984158B5A04305CFDB14DF99C488BAABBF5FF88314F248499E559AB321D730A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01086DC8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01086E4F

Memory Dump Source

Source File: 00000021.00000002.480986757.0000000001080000.00000040.00000001.sdmp, Offset: 01080000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ce2c830039c18c70fd297902f7a201667a957ac78a3fcd332646f609540fa294
Instruction ID: 8fd6fe91bd67b0d1c76b97b954edf4459505b22359f6e60a6d0c172be44b2930
Opcode Fuzzy Hash: ce2c830039c18c70fd297902f7a201667a957ac78a3fcd332646f609540fa294
Instruction Fuzzy Hash: 8421E2B5D002089FDB10CFAAD884ADEFBF8FB48324F14801AE958A7350D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01086DC2, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01086E4F

Memory Dump Source

Source File: 00000021.00000002.480986757.0000000001080000.00000040.00000001.sdmp, Offset: 01080000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6a91c63d796e60518099e3a206a67ca7724607f9631a624a777c2f1d592e754d
Instruction ID: fee9b82fa766cf484816e907e9551bd6e3d4087cbeca219272685a119d2dc3d8
Opcode Fuzzy Hash: 6a91c63d796e60518099e3a206a67ca7724607f9631a624a777c2f1d592e754d
Instruction Fuzzy Hash: C921E0B5D002099FDB00CFA9D584ADEBBF4EB58324F15841AE958A7350D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0102D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.480751522.000000000102D000.00000040.00000001.sdmp, Offset: 0102D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa8490ee317b31e8a7d28b96e966dee007f8605ab84228451e2d340028e517c5
Instruction ID: d3203fe338b4a6e6e9d5ee6c5c5aa76ab4b38cea50c4f1f0282d884d1661f20c
Opcode Fuzzy Hash: aa8490ee317b31e8a7d28b96e966dee007f8605ab84228451e2d340028e517c5
Instruction Fuzzy Hash: 3B210371504240DFDB11CF94D4C4B1ABBA5FB84254F20C9A9E9894B356C73ADC46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0102D006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.480751522.000000000102D000.00000040.00000001.sdmp, Offset: 0102D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6373fa595eb7bd68f6fb7c420bd57e78085557e0aa67444eeb79674e0848d583
Instruction ID: f2dc1a22d0f2a7f6b6ca21b2565b01e238319c0019aa9a15e0eadddca422f628
Opcode Fuzzy Hash: 6373fa595eb7bd68f6fb7c420bd57e78085557e0aa67444eeb79674e0848d583
Instruction Fuzzy Hash: 962180754083809FCB13CF64D9D4B11BFB1EB46214F28C5DAD8858F6A7C33A985ACB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report shipping document -813-25319 192-463-56-265-3327.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: shipping document -813-25319 192-463-56-265-3327.exe PID: 4160 Parent PID: 5780