Play interactive tour

Edit tour

Analysis Report shipping documents for PO#813-25319 192-463-56-265-3327.exe

Overview

General Information

Sample Name:	shipping documents for PO#813-25319 192-463-56-265-3327.exe
Analysis ID:	433447
MD5:	1b323fcf40192afd8c2d85acca658e7c
SHA1:	57b9c62162a645602e8eb059272bbb8bfcff8d67
SHA256:	2ebf28b25bd92fcb406458cae714c8740a3fa162e664ec66b404c06990bb5d5f
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

.NET source code contains very large strings

Executable has a suspicious name (potential lure to open the executable)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

shipping documents for PO#813-25319 192-463-56-265-3327.exe (PID: 6452 cmdline: 'C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe' MD5: 1B323FCF40192AFD8C2D85ACCA658E7C)

schtasks.exe (PID: 4908 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NkYArXVCGCJ' /XML 'C:\Users\user\AppData\Local\Temp\tmp4F70.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

shipping documents for PO#813-25319 192-463-56-265-3327.exe (PID: 5568 cmdline: {path} MD5: 1B323FCF40192AFD8C2D85ACCA658E7C)

shipping documents for PO#813-25319 192-463-56-265-3327.exe (PID: 5736 cmdline: {path} MD5: 1B323FCF40192AFD8C2D85ACCA658E7C)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "sales1@ashtavinayaka.com123456789smtpout.secureserver.net"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.288101589.000000000404D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.288101589.000000000404D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 5736	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 5736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 6452	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 6452	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.41347e0.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.41347e0.5.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 5 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "sales1@ashtavinayaka.com123456789smtpout.secureserver.net"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\NkYArXVCGCJ.exe

ReversingLabs: Detection: 23%

Multi AV Scanner detection for submitted file

Show sources

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe

ReversingLabs: Detection: 23%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\NkYArXVCGCJ.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe

Joe Sandbox ML: detected

Source: 11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack	Avira: Label: TR/Spy.Gen8

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://kqfOpU.com
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286861757.0000000002EB1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b92C625F0u002dCB9Cu002d42BAu002d9B29u002d09C40FFF2B0Bu007d/C9292A3Cu002d0320u002d42D4u002d932Fu002d56A5FC9F4AD5.cs	Large array initialization: .cctor: array initializer size 11943
Source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007b92C625F0u002dCB9Cu002d42BAu002d9B29u002d09C40FFF2B0Bu007d/C9292A3Cu002d0320u002d42D4u002d932Fu002d56A5FC9F4AD5.cs	Large array initialization: .cctor: array initializer size 11943

.NET source code contains very large strings

Show sources

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, TopdownDll/Form1.cs	Long String: Length: 11840
Source: NkYArXVCGCJ.exe.0.dr, TopdownDll/Form1.cs	Long String: Length: 11840
Source: 0.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.900000.0.unpack, TopdownDll/Form1.cs	Long String: Length: 11840
Source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.900000.0.unpack, TopdownDll/Form1.cs	Long String: Length: 11840
Source: 9.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.150000.0.unpack, TopdownDll/Form1.cs	Long String: Length: 11840
Source: 9.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.150000.0.unpack, TopdownDll/Form1.cs	Long String: Length: 11840
Source: 11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.650000.1.unpack, TopdownDll/Form1.cs	Long String: Length: 11840
Source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.650000.0.unpack, TopdownDll/Form1.cs	Long String: Length: 11840
Source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.650000.2.unpack, TopdownDll/Form1.cs	Long String: Length: 11840

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample	Static PE information: Filename: shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: initial sample	Static PE information: Filename: shipping documents for PO#813-25319 192-463-56-265-3327.exe

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Code function: 0_2_07AD07B0	0_2_07AD07B0
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Code function: 0_2_07AD1680	0_2_07AD1680
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Code function: 0_2_07A809C3	0_2_07A809C3
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Code function: 0_2_07AD37C0	0_2_07AD37C0
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Code function: 0_2_07AD25D8	0_2_07AD25D8
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Code function: 0_2_07AD3150	0_2_07AD3150
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Code function: 0_2_07AD3C90	0_2_07AD3C90
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Code function: 0_2_07AD3A30	0_2_07AD3A30
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Code function: 0_2_07AD3E70	0_2_07AD3E70
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Code function: 0_2_07AD3450	0_2_07AD3450
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Code function: 0_2_02C8C1D4	0_2_02C8C1D4
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Code function: 0_2_02C8E620	0_2_02C8E620
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Code function: 0_2_02C8E630	0_2_02C8E630

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: NkYArXVCGCJ.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, TopdownDll/Form1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: NkYArXVCGCJ.exe.0.dr, TopdownDll/Form1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.900000.0.unpack, TopdownDll/Form1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.900000.0.unpack, TopdownDll/Form1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 9.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.150000.0.unpack, TopdownDll/Form1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 9.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.150000.0.unpack, TopdownDll/Form1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/3@0/0

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

File created: C:\Users\user\AppData\Roaming\NkYArXVCGCJ.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5092:120:WilError_01
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Mutant created: \Sessions\1\BaseNamedObjects\dOyOVVv

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

File created: C:\Users\user\AppData\Local\Temp\tmp4F70.tmp

Jump to behavior

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe

ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

File read: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe 'C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe'
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NkYArXVCGCJ' /XML 'C:\Users\user\AppData\Local\Temp\tmp4F70.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process created: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe {path}
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process created: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe {path}
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NkYArXVCGCJ' /XML 'C:\Users\user\AppData\Local\Temp\tmp4F70.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process created: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process created: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

Code function: 0_2_02C87F48 pushfd ; retf

0_2_02C87F55

Source: initial sample	Static PE information: section name: .text entropy: 7.77523245185
Source: initial sample	Static PE information: section name: .text entropy: 7.77523245185

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

File created: C:\Users\user\AppData\Roaming\NkYArXVCGCJ.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NkYArXVCGCJ' /XML 'C:\Users\user\AppData\Local\Temp\tmp4F70.tmp'

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 6452, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Window / User API: threadDelayed 5074			Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Window / User API: threadDelayed 4743			Jump to behavior

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe TID: 6488	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe TID: 6108	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe TID: 6128	Thread sleep count: 5074 > 30	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe TID: 6128	Thread sleep count: 4743 > 30	Jump to behavior

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

Memory written: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NkYArXVCGCJ' /XML 'C:\Users\user\AppData\Local\Temp\tmp4F70.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process created: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Process created: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe {path}	Jump to behavior

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469142924.00000000014C0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469142924.00000000014C0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469142924.00000000014C0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469142924.00000000014C0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.288101589.000000000404D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.41347e0.5.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.288101589.000000000404D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 5736, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 6452, type: MEMORY
Source: Yara match	File source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.41347e0.5.raw.unpack, type: UNPACKEDPE

Source: Yara match	File source: 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 5736, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.288101589.000000000404D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.41347e0.5.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.288101589.000000000404D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 5736, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 6452, type: MEMORY
Source: Yara match	File source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.41347e0.5.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Scheduled Task/Job1	Process Injection112	Masquerading1	OS Credential Dumping	Security Software Discovery321	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion141	Security Account Manager	Virtualization/Sandbox Evasion141	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	System Information Discovery113	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing3	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
shipping documents for PO#813-25319 192-463-56-265-3327.exe	24%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
shipping documents for PO#813-25319 192-463-56-265-3327.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\NkYArXVCGCJ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\NkYArXVCGCJ.exe	24%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File
11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://kqfOpU.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false		high
http://DynDns.comDynDNS	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false		high
http://www.tiro.com	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false		high
http://www.fonts.com	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286861757.0000000002EB1000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://kqfOpU.com	shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	433447
Start date:	11.06.2021
Start time:	21:11:13
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	shipping documents for PO#813-25319 192-463-56-265-3327.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/3@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.2% (good quality ratio 0.1%) Quality average: 61.6% Quality standard deviation: 33.1%
HCA Information:	Successful, ratio: 97% Number of executed functions: 22 Number of non-executed functions: 11
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:12:50	API Interceptor	571x Sleep call for process: shipping documents for PO#813-25319 192-463-56-265-3327.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\shipping documents for PO#813-25319 192-463-56-265-3327.exe.log Download File
Process:	C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Temp\tmp4F70.tmp Download File
Process:	C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1644
Entropy (8bit):	5.206057226052344
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBto0tn:cbh47TlNQ//rydbz9I3YODOLNdq3j
MD5:	7B73EF087D2C095531D38AC617ECE4A4
SHA1:	D7B8B661A43DDF2681E31E5C999661D9FB80C0B8
SHA-256:	DC475B27B0F42A49B627BCF66ED7A933B2BAA4198F312AE041DF234FB10C6F4E
SHA-512:	6B5C89EB068C9915CCDEC28C1A69867830EB91A83CA1919FED96C2A885BF202B50B95DEF577EC6D792ACC03EB4384FA4FFF11806ED3CC185897A5C32D9618D67
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Roaming\NkYArXVCGCJ.exe Download File
Process:	C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	452096
Entropy (8bit):	7.761846193878433
Encrypted:	false
SSDEEP:	6144:zq0f9rlcph/61jE7pGczlztrJ4ZU/yJq8EIGNv7kZ1G/G1b68anUtAMH+3ZrqP:zqu9Gph/61k/zlNHZIgv7kq8yUJHmS
MD5:	1B323FCF40192AFD8C2D85ACCA658E7C
SHA1:	57B9C62162A645602E8EB059272BBB8BFCFF8D67
SHA-256:	2EBF28B25BD92FCB406458CAE714C8740A3FA162E664EC66B404C06990BB5D5F
SHA-512:	B9B731DE239467D7593FD20954F07AA028C7E2AEA8EF0E88891C309EEE70D35E3EEF15C05D8EDB92ED2F6573F36E210AB4070A7FAB80BDE8E21C831CACEF8E84
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............0.............v.... ........@.. .......................@............@.................................$...O............................ ....................................................... ............... ..H............text...\|.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................X.......H.................._....r...............................................0............{.....+....".(.....".(.........0.................,.s....z&..(.............s................s................s...........0..]........~..............,?.~..........(......~..............,..(...+..........,..(.......~......+..............E.......s..........0...........~.....+....0..P........~..........(......~.........,..s............ .~....r...po..........,..(...............:C......

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.761846193878433
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	shipping documents for PO#813-25319 192-463-56-265-3327.exe
File size:	452096
MD5:	1b323fcf40192afd8c2d85acca658e7c
SHA1:	57b9c62162a645602e8eb059272bbb8bfcff8d67
SHA256:	2ebf28b25bd92fcb406458cae714c8740a3fa162e664ec66b404c06990bb5d5f
SHA512:	b9b731de239467d7593fd20954f07aa028c7e2aea8ef0e88891c309eee70d35e3eef15c05d8edb92ed2f6573f36e210ab4070a7fab80bde8e21c831cacef8e84
SSDEEP:	6144:zq0f9rlcph/61jE7pGczlztrJ4ZU/yJq8EIGNv7kZ1G/G1b68anUtAMH+3ZrqP:zqu9Gph/61k/zlNHZIgv7kq8yUJHmS
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............0.............v.... ........@.. .......................@............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x46fa76
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60C39E04 [Fri Jun 11 17:31:48 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6fa24	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x5a4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x72000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6da7c	0x6dc00	False	0.889724071042	data	7.77523245185	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x5a4	0x600	False	0.419921875	data	4.071391437	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x72000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x70090	0x314	data
RT_MANIFEST	0x703b4	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2018
Assembly Version	1.0.0.0
InternalName	vJdJ.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	TopdownDll
ProductVersion	1.0.0.0
FileDescription	TopdownDll
OriginalFilename	vJdJ.exe

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 6452 Parent PID: 5900

General

Start time:	21:11:59
Start date:	11/06/2021
Path:	C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe'
Imagebase:	0x900000
File size:	452096 bytes
MD5 hash:	1B323FCF40192AFD8C2D85ACCA658E7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.288101589.000000000404D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.288101589.000000000404D000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: schtasks.exe PID: 4908 Parent PID: 6452

General

Start time:	21:12:37
Start date:	11/06/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NkYArXVCGCJ' /XML 'C:\Users\user\AppData\Local\Temp\tmp4F70.tmp'
Imagebase:	0x300000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 5092 Parent PID: 4908

General

Start time:	21:12:38
Start date:	11/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 5568 Parent PID: 6452

General

Start time:	21:12:38
Start date:	11/06/2021
Path:	C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x150000
File size:	452096 bytes
MD5 hash:	1B323FCF40192AFD8C2D85ACCA658E7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 5736 Parent PID: 6452

General

Start time:	21:12:39
Start date:	11/06/2021
Path:	C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x650000
File size:	452096 bytes
MD5 hash:	1B323FCF40192AFD8C2D85ACCA658E7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 6452 Parent PID: 5900 shipping documents for PO#813-25319 192-463-56-265-3327.exeCOMMON

Executed Functions

Function 07AD1680, Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.295668449.0000000007AD0000.00000040.00000001.sdmp, Offset: 07A50000, based on PE: true

Associated: 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027f29ca5a84d9b9c33e680703d62e06db5b0969e3871e18c81f657224e16ff8
Instruction ID: 4d257025a6fa549251ce43afbbc2cd9855aab3f5b6f323818a59cc26abaa0831
Opcode Fuzzy Hash: 027f29ca5a84d9b9c33e680703d62e06db5b0969e3871e18c81f657224e16ff8
Instruction Fuzzy Hash: 66D15EB4E1520EDFCB04CF96C4858AEFBB6FF89300F199915D426AB254D734AA42CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07AD07B0, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.295668449.0000000007AD0000.00000040.00000001.sdmp, Offset: 07A50000, based on PE: true

Associated: 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ac7096f86f285011bfcd711ed12f3a8c667b256a44abc177d79e4a83540df5
Instruction ID: 6c3fcfaab83889f89f87b831765c57c2f4e1705228724d6da4244b2cd1c26632
Opcode Fuzzy Hash: e1ac7096f86f285011bfcd711ed12f3a8c667b256a44abc177d79e4a83540df5
Instruction Fuzzy Hash: 5C21D4B1E016189BDB18CFABD8443DEFBF6AFC8310F14C16AD419AA258DB741955CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02C8B740, Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 02C8B7B0
GetCurrentThread.KERNEL32 ref: 02C8B7ED
GetCurrentProcess.KERNEL32 ref: 02C8B82A
GetCurrentThreadId.KERNEL32 ref: 02C8B883

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9759571ea742951e662a5fc2c40105c6630888891ce0a190c8caa9c793ce0c37
Instruction ID: f1c397cbd7b8dcdcc1296694b9ebe8a41c6ea9b5938dd212be2f635002716169
Opcode Fuzzy Hash: 9759571ea742951e662a5fc2c40105c6630888891ce0a190c8caa9c793ce0c37
Instruction Fuzzy Hash: BD5137B09007498FDB14DFAAD948BDEBBF1AF88308F248499E009A7361D7745944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02C8B750, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 02C8B7B0
GetCurrentThread.KERNEL32 ref: 02C8B7ED
GetCurrentProcess.KERNEL32 ref: 02C8B82A
GetCurrentThreadId.KERNEL32 ref: 02C8B883

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2a59bf1b88aac1f14e3d11ca7443aff99a31d442cd91ae372016cf5841996ac1
Instruction ID: f14a99cd456060ab2071a72a76af8f346e874d3d33b678f19cf1f8c172160a52
Opcode Fuzzy Hash: 2a59bf1b88aac1f14e3d11ca7443aff99a31d442cd91ae372016cf5841996ac1
Instruction Fuzzy Hash: 7E5126B4D007498FDB14DFAADA48B9EBBF0EF48318F248499E409A7350D7749944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02C89450, Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02C89696

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ee599177d791567e11a5fee63f711358176d1fccd6e687b77cba290e3bca066a
Instruction ID: a25a164285ac4901509e1eeab7ec13d0f5ac823fd15de555bab4d4c336d1de8a
Opcode Fuzzy Hash: ee599177d791567e11a5fee63f711358176d1fccd6e687b77cba290e3bca066a
Instruction Fuzzy Hash: E37113B0A00B058FD724EF2AD45076ABBF1BF88318F108A29E58AD7B40D735E945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02C8FDAC, Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02C8FECA

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d40fb0e6373dad24a43371f54a5baa88141cae3422849c7c124ab5651c49a813
Instruction ID: 068ad0dd8874fdfe6d3b734a48af0117ac7e1d4d62c63cc83a76d91ad6d11974
Opcode Fuzzy Hash: d40fb0e6373dad24a43371f54a5baa88141cae3422849c7c124ab5651c49a813
Instruction Fuzzy Hash: 9B51F0B1D002489FDB14DFA9D884ADEBBB1BF88314F64826EE419AB650D7709945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02C8FDB8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02C8FECA

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d3295fe1eec850280eb36d74ef2d0305750b7e23ee31205501f2f16938d0dce0
Instruction ID: ede05e3b697731dc76a3acbff78972801aeefdc7ba92ae8852dca616abca7ace
Opcode Fuzzy Hash: d3295fe1eec850280eb36d74ef2d0305750b7e23ee31205501f2f16938d0dce0
Instruction Fuzzy Hash: EF41D0B1D003089FDB14DFAAD984ADEBBB5BF88314F64822AE419AB210D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02C85365, Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02C85421

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 79beb6b29997cb2703f261a5c1caaeccff96f9b04608dc21942d10c2bd994d82
Instruction ID: a6b64437b3daa7d8fd4085cc9553b066e205ebfa254ca87b2c2ac08fd7ae56f7
Opcode Fuzzy Hash: 79beb6b29997cb2703f261a5c1caaeccff96f9b04608dc21942d10c2bd994d82
Instruction Fuzzy Hash: FE4115B1C00218CFDB24DFA9C9447DEBBB5BF88308F618069D419BB251DBB5694ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 02C83E2C, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02C85421

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7ecc71045ed21d68e7fc74ba5cce2a70800921a041b87e1bd2752f2455ee1186
Instruction ID: e7b93c0c27a148b3292758165c4c3d92286012986b783f20a938bbf745ca5710
Opcode Fuzzy Hash: 7ecc71045ed21d68e7fc74ba5cce2a70800921a041b87e1bd2752f2455ee1186
Instruction Fuzzy Hash: C541F5B1C04218CFDB24DFA9C94478EBBB5BF88308F618169D409BB251DBB55949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02E923E0, Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02E924A1

Memory Dump Source

Source File: 00000000.00000002.286835064.0000000002E90000.00000040.00000001.sdmp, Offset: 02E90000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: d4c96d26cf5742cd86305781cf5e3b19ff683efe56c0cc90717ac4ba0e7a7921
Instruction ID: 5e6bd19fb5f63cb1218eddc6bad6c99f7bdecd6f892e63cd66fef126a0115477
Opcode Fuzzy Hash: d4c96d26cf5742cd86305781cf5e3b19ff683efe56c0cc90717ac4ba0e7a7921
Instruction Fuzzy Hash: 424149B4A002059FDB14CF99C588BAABBF5FF89318F25C499E519A7321D374A845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02C8B970, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02C8B9FF

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e3779eb46615003164cd26743a9881c2d020c90e73458b145cc964c680f60332
Instruction ID: 935c5731bc9d7ea2b7fa4b494b8cf71672656c320e2e9c017f8b86c38fa51564
Opcode Fuzzy Hash: e3779eb46615003164cd26743a9881c2d020c90e73458b145cc964c680f60332
Instruction Fuzzy Hash: 992117B5900348DFDB10DFAAD984ADEBFF4AB49318F14805AE914E7311D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C8B978, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02C8B9FF

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6f7c9b391a9c7c62078718640c5b2b4d4ed219a720a993a68f121b211d8bf3eb
Instruction ID: 9c7cd1bf07063acd78f6743dfd66cb20128eb057910e474294d1f5437eb77895
Opcode Fuzzy Hash: 6f7c9b391a9c7c62078718640c5b2b4d4ed219a720a993a68f121b211d8bf3eb
Instruction Fuzzy Hash: 1721B3B59002489FDB10DFAAD984ADEBBF8EB48324F14845AE915A3310D375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C887C0, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02C89711,00000800,00000000,00000000), ref: 02C89922

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2f83db1a339cfaedefc9415582e3a8cf64c050db643d40ccd44e0e441fc2c512
Instruction ID: c6be0be2624a1844d4f9fee2a4c3f8657f24e42f62e67ed0af91d5c8296e29d2
Opcode Fuzzy Hash: 2f83db1a339cfaedefc9415582e3a8cf64c050db643d40ccd44e0e441fc2c512
Instruction Fuzzy Hash: A51114B6D002099FDB10DF9AD544AEEFBF4EB88328F14846AE419B7300C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C898B3, Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02C89711,00000800,00000000,00000000), ref: 02C89922

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7baa276ed2c796dceb5a6165516d197fcdcad9575a8951f1c4d042f8a224d60b
Instruction ID: b15c4b18f17649138489546496698ce85da3a63fafa2cfa99317da200f68756b
Opcode Fuzzy Hash: 7baa276ed2c796dceb5a6165516d197fcdcad9575a8951f1c4d042f8a224d60b
Instruction Fuzzy Hash: DE1129B6D002498FCB10DFAAD544BEEFBF4AB88324F14845EE459A7300C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C89630, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02C89696

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a031a73d9c638a33398e701879307b5ee91998f1c1d47e39f4d62edf1c09801d
Instruction ID: a54172c65bc246a77fa5a1aeb256ff6c2e0e8632aeff5ee22449be5e58fef9da
Opcode Fuzzy Hash: a031a73d9c638a33398e701879307b5ee91998f1c1d47e39f4d62edf1c09801d
Instruction Fuzzy Hash: 0E1110B6C002498FCB20DF9AD944BDEFBF4AB88228F10856AD419B7700D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02E90069, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 02E900CD

Memory Dump Source

Source File: 00000000.00000002.286835064.0000000002E90000.00000040.00000001.sdmp, Offset: 02E90000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 723f3c5df2a5dcffc7f54faa5210d9ca773beed1ba8f321fcbcf8b509b8aac0c
Instruction ID: 36086df2b52a1b35fa6e617bbd9c04d6ec1022381119d5c9437130f24b31dfea
Opcode Fuzzy Hash: 723f3c5df2a5dcffc7f54faa5210d9ca773beed1ba8f321fcbcf8b509b8aac0c
Instruction Fuzzy Hash: 6D1115B58002488FDB20DF99D588BEEBBF4EB88324F14855AE855B3700D375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02E90070, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 02E900CD

Memory Dump Source

Source File: 00000000.00000002.286835064.0000000002E90000.00000040.00000001.sdmp, Offset: 02E90000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 69c383663554f97f07cda9af7a2b9ee7ce088a7fb19f3e6e8c335c2d08735bcf
Instruction ID: 9506b82d73f6e7c4d953047fe4eddf0099a400b761e2f2e1ea17356f2cd2c707
Opcode Fuzzy Hash: 69c383663554f97f07cda9af7a2b9ee7ce088a7fb19f3e6e8c335c2d08735bcf
Instruction Fuzzy Hash: 1E1115B58002088FDB20DF9AD584BDEBBF8EB48324F10855AE815B3300C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07AD1CD0, Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

gwX, xrefs: 07AD1DA2

Memory Dump Source

Source File: 00000000.00000002.295668449.0000000007AD0000.00000040.00000001.sdmp, Offset: 07A50000, based on PE: true

Associated: 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID: gwX
API String ID: 0-2600748014
Opcode ID: b390ee16cdb465c039fccc6bd1a07b3327531ae0f6ed7297d924e9357d162a53
Instruction ID: 021beeece6c1a8ce4e786f03b405b3c467123a2d19f3062a33aee1745c472f8a
Opcode Fuzzy Hash: b390ee16cdb465c039fccc6bd1a07b3327531ae0f6ed7297d924e9357d162a53
Instruction Fuzzy Hash: C0216BB0E1520DDFCB44CFA5D5815AEFBF5AF89300F61C4AAD41AA7314E7308A418F91

Uniqueness

Uniqueness Score: -1.00%

Function 07AD2D88, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.295668449.0000000007AD0000.00000040.00000001.sdmp, Offset: 07A50000, based on PE: true

Associated: 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb98b62adae94a9da8291b7589a0783e31eedde7d6964816d1771726c3e188f0
Instruction ID: 6607e550b992a144e3fba5bdeb2da745466b6c64e0733471124bb0c0c3930f8e
Opcode Fuzzy Hash: cb98b62adae94a9da8291b7589a0783e31eedde7d6964816d1771726c3e188f0
Instruction Fuzzy Hash: B251E2B5E11219DFCB04CF99D894AEEFBB1FF88310F10852AD516A7250DB349A45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 07AD1DE0, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.295668449.0000000007AD0000.00000040.00000001.sdmp, Offset: 07A50000, based on PE: true

Associated: 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b9f631bbf6380f7eacab713a476ccaa7687201fb7fdabc7fe9075cfc0262c6
Instruction ID: 65ecd455b8fd4d91c565904bab0e6b81d42a54dd50a7f0678ebd89432f509d6f
Opcode Fuzzy Hash: 00b9f631bbf6380f7eacab713a476ccaa7687201fb7fdabc7fe9075cfc0262c6
Instruction Fuzzy Hash: B3110774E11208EFCB44CFA9D585AADFBF6EF89300F15C5A6D519A7354DB309E508B40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07AD3450, Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

~03$, xrefs: 07AD3605
~03$, xrefs: 07AD35FE

Memory Dump Source

Source File: 00000000.00000002.295668449.0000000007AD0000.00000040.00000001.sdmp, Offset: 07A50000, based on PE: true

Associated: 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID: ~03$$~03$
API String ID: 0-229743969
Opcode ID: 2a20be384baa190cffc8df06c5c0c01012a5b9ef4525db64f0aa59e9648f4509
Instruction ID: 5f5ca694d2cf530aa8b9629ba2f57dab33335019ee03c4e6034fa5b40e19b2d4
Opcode Fuzzy Hash: 2a20be384baa190cffc8df06c5c0c01012a5b9ef4525db64f0aa59e9648f4509
Instruction Fuzzy Hash: 4661F8B4D14209DBCF04CF96C8855AEFBB1FF89301F14852AD526A7354D7389A82CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07AD3C90, Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

aG<, xrefs: 07AD3CEC

Memory Dump Source

Source File: 00000000.00000002.295668449.0000000007AD0000.00000040.00000001.sdmp, Offset: 07A50000, based on PE: true

Associated: 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID: aG<
API String ID: 0-1450661063
Opcode ID: 2e34adbb7340d0266936602659898f558c9f3b8385b4a40ed2ec25a52b14db4d
Instruction ID: 5fd42f0becd9a6fb0430189bbfa3decaa330726cddbe79ca41d8a3d3c5017ad0
Opcode Fuzzy Hash: 2e34adbb7340d0266936602659898f558c9f3b8385b4a40ed2ec25a52b14db4d
Instruction Fuzzy Hash: D941E4B4E0560ADBCB04CFAAC5815AEFBF2FF89200F24C46AC415B7254D7349A42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07A809C3, Relevance: .5, Instructions: 532
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E07A809C3(signed int __eax, signed int __ebx, signed int __ecx, intOrPtr* __edi, intOrPtr* __esi) {
				signed int _t43;
				signed int _t44;
				signed char _t45;
				signed char _t46;
				signed char _t47;
				intOrPtr* _t49;
				signed char _t51;
				intOrPtr* _t52;
				signed char _t53;
				intOrPtr* _t55;
				signed char _t57;
				signed char _t58;
				signed char _t59;
				intOrPtr* _t60;
				intOrPtr* _t61;
				intOrPtr* _t62;
				signed char _t63;
				signed char _t64;
				signed char _t65;
				signed char _t66;
				signed char _t67;
				signed char _t68;
				signed char _t69;
				signed char _t70;
				signed char _t71;
				signed char _t72;
				signed char _t73;
				signed char _t74;
				signed char _t75;
				signed char _t76;
				signed char _t78;
				signed char _t79;
				signed char _t80;
				intOrPtr* _t81;
				intOrPtr* _t82;
				signed char _t84;
				signed char _t85;
				intOrPtr* _t87;
				signed char _t88;
				intOrPtr* _t90;
				signed char _t92;
				signed char _t93;
				signed char _t94;
				signed char _t95;
				signed char _t96;
				signed char _t98;
				signed char _t99;
				intOrPtr* _t100;
				signed char _t102;
				signed char _t104;
				signed char _t105;
				signed char _t107;
				signed char _t108;
				signed char _t109;
				signed char _t110;
				signed char _t111;
				signed char _t112;
				signed char _t113;
				signed char _t114;
				signed int _t117;
				signed char _t118;
				signed char _t119;
				signed char _t120;
				signed char _t121;
				signed char _t122;
				signed char _t123;
				signed char _t124;
				signed int _t126;
				signed int* _t127;
				intOrPtr* _t128;
				intOrPtr* _t129;
				intOrPtr* _t130;
				intOrPtr* _t131;
				intOrPtr* _t132;
				intOrPtr* _t133;
				intOrPtr* _t134;
				intOrPtr* _t135;
				intOrPtr* _t136;
				intOrPtr* _t137;
				intOrPtr* _t138;
				signed int* _t139;
				intOrPtr* _t140;
				intOrPtr* _t141;
				intOrPtr* _t142;
				intOrPtr* _t143;
				signed int _t145;

				_t143 = __esi;
				_t142 = __edi;
				_t103 = __ecx;
				 *__eax =  *__eax & __ebx;
				_t43 = __eax ^ 0x386177ff;
				asm("aaa");
				_t44 = _t43 / __ebx;
				_t126 = _t43 % __ebx;
				 *_t44 =  *_t44 + 1;
				_t102 = __ebx +  *((intOrPtr*)(__ebx + 0x3e));
				 *_t44 =  *_t44 + _t44;
				_t45 = _t44 + 2;
				 *((char*)(__esi)) =  *((char*)(__esi)) + 1;
				if ( *((char*)(__esi)) != 0) goto L1;
				 *__esi =  *__esi + _t45;
				if( *__esi < 0) {
					 *_t45 =  *_t45 + _t45;
					_t123 = __ecx |  *_t45;
					asm("lahf");
					 *_t45 =  *_t45 + _t45;
					_push(es);
					_push(es);
					 *(__esi - 0x2e) =  *(__esi - 0x2e) & _t123;
					_t99 = _t102;
					_t102 = _t45;
					_t100 = _t99 + 0x1be2205a;
					asm("loop 0x6c");
					asm("popad");
					 *_t100 =  *_t100 + _t100;
					asm("adc esi, [eax]");
					_t45 = _t100 +  *_t100;
					_pop(es);
					 *_t45 =  *_t45 + _t45;
					 *_t123 =  *_t123 + _t45;
					 *_t45 =  *_t45 + _t45;
					asm("adc [edx], eax");
					asm("outsd");
					_push(_t145);
					 *_t45 =  *_t45 + _t45;
					_t124 = _t123 |  *_t126;
					 *_t102 =  *_t102 + _t126;
					 *_t102 =  *_t102 ^ _t45;
					 *__edi =  *__edi + _t45;
					 *_t45 =  *_t45 + _t45;
					 *_t124 =  *_t124 + _t45;
					 *_t45 =  *_t45 + _t45;
					asm("adc [edx], eax");
					asm("outsd");
					_push(__esi);
					 *_t45 =  *_t45 + _t45;
					_t103 = _t124 |  *_t126;
					 *_t102 =  *_t102 + _t126;
					 *_t102 =  *_t102 ^ _t45;
					 *__esi =  *__esi + _t45;
					 *_t45 =  *_t45 + _t45;
					 *_t103 =  *_t103 + _t45;
					 *_t45 =  *_t45 + _t45;
					asm("adc [eax], ebp");
					_push(__edi);
					 *_t45 =  *_t45 + _t45;
				}
				 *_t126 =  *_t126 + _t103;
				_t46 = _t45 -  *_t45;
				 *_t102 =  *_t102 + _t126;
				 *_t102 =  *_t102 ^ _t46;
				 *_t142 =  *_t142 + _t46;
				 *_t46 =  *_t46 + _t46;
				 *_t103 =  *_t103 + _t46;
				 *_t46 =  *_t46 + _t46;
				asm("adc [edx], eax");
				asm("outsd");
				_pop(_t47);
				 *_t47 =  *_t47 + _t47;
				_t104 = _t103 |  *_t126;
				 *_t102 =  *_t102 + _t126;
				 *_t102 =  *_t102 ^ _t47;
				 *_t142 =  *_t142 + _t47;
				 *_t47 =  *_t47 + _t47;
				 *_t104 =  *_t104 + _t47;
				 *_t47 =  *_t47 + _t47;
				asm("adc [edx], eax");
				 *_t104 =  *_t104 - _t102;
				 *_t126 =  *_t126 + _t104;
				asm("adc esi, [eax]");
				_t49 = _t47 -  *_t47 +  *((intOrPtr*)(_t47 -  *_t47));
				_pop(es);
				 *_t49 =  *_t49 + _t49;
				 *_t104 =  *_t104 + _t49;
				 *_t49 =  *_t49 + _t49;
				asm("adc [edx], eax");
				 *_t126 =  *_t126 - _t102;
				 *_t126 =  *_t126 + _t104;
				asm("adc esi, [eax]");
				_t51 = _t49 -  *_t49;
				 *_t51 =  *_t51 | _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t104 =  *_t104 + _t126;
				_t52 = _t51 +  *_t102;
				 *_t142 =  *_t142 - _t52;
				 *_t52 =  *_t52 + _t52;
				_t105 = _t104 |  *_t126;
				asm("adc esi, [eax]");
				_t53 = _t52 +  *_t52;
				_pop(es);
				 *_t53 =  *_t53 + _t53;
				 *_t105 =  *_t105 + _t53;
				 *_t53 =  *_t53 + _t53;
				asm("adc [edx], eax");
				if( *_t53 >= 0) {
					L6:
					 *_t53 =  *_t53 + _t53;
					 *_t53 =  *_t53 + _t53;
					 *_t105 =  *_t105 + _t126;
					 *_t53 =  *_t53 + _t53;
					_t107 = _t105 +  *((intOrPtr*)(_t142 + 0x60)) |  *_t126;
					 *_t102 =  *_t102 + _t126;
					 *_t102 =  *_t102 ^ _t53;
					 *_t142 =  *_t142 + _t53;
					 *_t53 =  *_t53 + _t53;
					 *_t107 =  *_t107 + _t53;
					 *_t53 =  *_t53 + _t53;
					asm("adc [edx], eax");
					 *_t107 =  *_t107 - _t53;
					 *_t126 =  *_t126 + _t107;
					asm("adc esi, [eax]");
					_t55 = _t53 -  *_t53 +  *(_t53 -  *_t53);
					_pop(es);
					 *_t55 =  *_t55 + _t55;
					 *_t107 =  *_t107 + _t55;
					 *_t55 =  *_t55 + _t55;
					asm("adc [edx], eax");
					 *_t126 =  *_t126 - _t55;
					 *_t126 =  *_t126 + _t107;
					asm("adc esi, [eax]");
					_t57 = _t55 -  *_t55;
					 *_t57 =  *_t57 | _t57;
					 *_t57 =  *_t57 + _t57;
					 *_t57 =  *_t57 + _t57;
				} else {
					 *_t53 =  *_t53 + _t53;
					_t121 = _t105 |  *_t126;
					 *_t102 =  *_t102 + _t126;
					 *_t102 =  *_t102 ^ _t53;
					 *_t142 =  *_t142 + _t53;
					 *_t53 =  *_t53 + _t53;
					 *_t121 =  *_t121 + _t53;
					 *_t53 =  *_t53 + _t53;
					asm("adc [edx], eax");
					asm("outsd");
					 *_t53 =  *_t53 + _t53;
					_t107 = _t121 |  *_t126;
					 *_t102 =  *_t102 + _t126;
					 *_t102 =  *_t102 ^ _t53;
					 *_t142 =  *_t142 + _t53;
					 *_t53 =  *_t53 + _t53;
					 *_t107 =  *_t107 + _t53;
					 *_t53 =  *_t53 + _t53;
					asm("adc [edx], eax");
					 *_t145 =  *_t145 - _t102;
					 *_t126 =  *_t126 + _t107;
					asm("adc esi, [eax]");
					_t98 = _t53 -  *_t53;
					 *_t98 =  *_t98 | _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t107 =  *_t107 + _t126;
					_t57 = _t98 +  *_t102;
					if(_t57 < 0) {
						 *_t57 =  *_t57 + _t57;
						_t122 = _t107 |  *_t126;
						asm("adc esi, [eax]");
						_t53 = _t57 +  *_t57;
						_pop(es);
						 *_t53 =  *_t53 + _t53;
						 *_t122 =  *_t122 + _t53;
						 *_t53 =  *_t53 + _t53;
						asm("adc [edx], eax");
						asm("outsd");
						_pop(_t142);
						 *_t53 =  *_t53 + _t53;
						_t105 = _t122 |  *_t126;
						 *_t102 =  *_t102 + _t126;
						 *_t102 =  *_t102 ^ _t53;
						 *_t142 =  *_t142 + _t53;
						 *_t53 =  *_t53 + _t53;
						goto L6;
					}
				}
				 *_t107 =  *_t107 + _t126;
				_t58 = _t57 +  *_t102;
				asm("outsd");
				asm("arpl [eax], ax");
				 *_t126 =  *_t126 + _t107;
				_t127 = _t126 -  *_t102;
				 *0x900 =  *0x900 ^ _t58;
				 *_t107 =  *_t107 + _t58;
				 *_t58 =  *_t58 + _t58;
				asm("adc [edx], eax");
				_t59 = _t58 +  *((intOrPtr*)(_t142 + _t145 * 2));
				 *[fs:eax] =  *[fs:eax] + _t59;
				_t108 = _t107 |  *_t127;
				 *_t59 =  *_t59 + _t59;
				 *_t102 = _t127 +  *_t102;
				 *_t102 =  *_t102 ^ _t59;
				 *_t143 =  *_t143 + _t59;
				 *_t59 =  *_t59 + _t59;
				 *_t108 =  *_t108 + _t59;
				 *_t59 =  *_t59 + _t59;
				asm("adc [ebx+0x65], esi");
				 *_t59 =  *_t59 + _t59;
				_t109 = _t108 |  *_t127;
				 *_t59 =  *_t59 + _t59;
				asm("adc esi, [eax]");
				_t60 = _t59 +  *_t59;
				_push(es);
				 *_t60 =  *_t60 + _t60;
				 *_t109 =  *_t109 + _t60;
				 *_t60 =  *_t60 + _t60;
				asm("adc [ebx+0x66], esi");
				 *_t60 =  *_t60 + _t60;
				_t110 = _t109 |  *_t127;
				 *_t60 =  *_t60 + _t60;
				asm("adc esi, [eax]");
				_t61 = _t60 +  *_t60;
				_push(es);
				 *_t61 =  *_t61 + _t61;
				 *_t110 =  *_t110 + _t61;
				 *_t61 =  *_t61 + _t61;
				asm("adc [ebx+0x67], esi");
				 *_t61 =  *_t61 + _t61;
				_t111 = _t110 |  *_t127;
				 *_t61 =  *_t61 + _t61;
				asm("adc esi, [eax]");
				_t62 = _t61 +  *_t61;
				 *_t62 =  *_t62 + _t62;
				 *_t111 =  *_t111 + _t62;
				 *_t62 =  *_t62 + _t62;
				asm("adc [ebx+0x68], esi");
				 *_t62 =  *_t62 + _t62;
				_t112 = _t111 |  *_t127;
				 *_t62 =  *_t62 + _t62;
				asm("adc esi, [eax]");
				_t63 = _t62 +  *_t62;
				es = es;
				 *_t63 =  *_t63 + _t63;
				 *_t112 =  *_t112 + _t63;
				 *_t63 =  *_t63 + _t63;
				asm("adc [edx], eax");
				if( *_t63 < 0) {
					 *_t63 =  *_t63 + _t63;
					_t118 = _t112 |  *_t127;
					 *_t102 = _t127 +  *_t102;
					 *_t102 =  *_t102 ^ _t63;
					 *_t142 =  *_t142 + _t63;
					 *_t63 =  *_t63 + _t63;
					 *_t118 =  *_t118 + _t63;
					 *_t63 =  *_t63 + _t63;
					asm("adc [edx], eax");
					asm("outsd");
					 *_t127 =  *_t127 + _t118;
					asm("adc esi, [eax]");
					_t90 = _t63 -  *_t63 +  *((intOrPtr*)(_t63 -  *_t63));
					es = 0;
					 *_t90 =  *_t90 + _t90;
					 *_t118 =  *_t118 + _t90;
					 *_t90 =  *_t90 + _t90;
					asm("adc [edx], eax");
					 *_t102 =  *_t102 - _t118;
					 *_t127 =  *_t127 + _t118;
					asm("adc esi, [eax]");
					_t92 = _t90 -  *_t90;
					 *_t92 =  *_t92 | _t92;
					 *_t92 =  *_t92 + _t92;
					 *_t92 =  *_t92 + _t92;
					 *_t118 =  *_t118 + _t127;
					_t93 = _t92 +  *_t102;
					asm("outsd");
					asm("insb");
					 *_t93 =  *_t93 + _t93;
					_t119 = _t118 |  *_t127;
					asm("adc esi, [eax]");
					_t94 = _t93;
					 *_t94 =  *_t94 | _t94;
					 *_t94 =  *_t94 + _t94;
					 *_t94 =  *_t94 + _t94;
					 *_t119 =  *_t119 + _t127;
					_t95 = _t94 +  *_t102;
					asm("outsd");
					asm("insd");
					 *_t95 =  *_t95 + _t95;
					_t120 = _t119 |  *_t127;
					asm("adc esi, [eax]");
					_t96 = _t95;
					 *_t96 =  *_t96 | _t96;
					 *_t96 =  *_t96 + _t96;
					 *_t96 =  *_t96 + _t96;
					 *_t120 =  *_t120 + _t127;
					_t63 = _t96 +  *_t102;
					asm("outsd");
					asm("outsb");
					 *_t63 =  *_t63 + _t63;
					_t112 = _t120 |  *_t127;
				}
				asm("adc esi, [eax]");
				_t64 = _t63;
				 *_t64 =  *_t64 | _t64;
				 *_t64 =  *_t64 + _t64;
				 *_t64 =  *_t64 + _t64;
				 *_t112 =  *_t112 + _t127;
				_t65 = _t64 +  *_t102;
				asm("outsd");
				asm("outsd");
				 *_t65 =  *_t65 + _t65;
				_t113 = _t112 |  *_t127;
				asm("adc esi, [eax]");
				_t66 = _t65;
				 *_t66 =  *_t66 | _t66;
				 *_t66 =  *_t66 + _t66;
				 *_t66 =  *_t66 + _t66;
				 *_t113 =  *_t113 + _t127;
				_t67 = _t66 +  *_t102;
				asm("outsd");
				if (_t67 < 0) goto L10;
				 *_t127 =  *_t127 + _t113;
				_t128 = _t127 -  *_t102;
				 *(_t67 + _t67) =  *(_t67 + _t67) ^ _t67;
				 *_t67 =  *_t67 | _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t113 =  *_t113 + _t128;
				_t68 = _t67 +  *_t102;
				asm("outsd");
				if (_t68 >= 0) goto L11;
				 *_t128 =  *_t128 + _t113;
				_t129 = _t128 -  *_t102;
				 *(_t68 + _t68) =  *(_t68 + _t68) ^ _t68;
				 *_t68 =  *_t68 | _t68;
				 *_t68 =  *_t68 + _t68;
				 *_t68 =  *_t68 + _t68;
				 *_t113 =  *_t113 + _t129;
				_t69 = _t68 +  *_t102;
				asm("outsd");
				if (_t69 < 0) goto L12;
				 *_t129 =  *_t129 + _t113;
				_t130 = _t129 -  *_t102;
				 *(_t69 + _t69) =  *(_t69 + _t69) ^ _t69;
				 *_t69 =  *_t69 | _t69;
				 *_t69 =  *_t69 + _t69;
				 *_t69 =  *_t69 + _t69;
				 *_t113 =  *_t113 + _t130;
				_t70 = _t69 +  *_t102;
				asm("outsd");
				if (_t70 >= 0) goto L13;
				 *_t130 =  *_t130 + _t113;
				_t131 = _t130 -  *_t102;
				 *(_t70 + _t70) =  *(_t70 + _t70) ^ _t70;
				 *_t70 =  *_t70 | _t70;
				 *_t70 =  *_t70 + _t70;
				 *_t70 =  *_t70 + _t70;
				 *_t113 =  *_t113 + _t131;
				_t71 = _t70 +  *_t102;
				asm("outsd");
				if (_t71 == 0) goto L14;
				 *_t131 =  *_t131 + _t113;
				_t132 = _t131 -  *_t102;
				 *(_t71 + _t71) =  *(_t71 + _t71) ^ _t71;
				 *_t71 =  *_t71 | _t71;
				 *_t71 =  *_t71 + _t71;
				 *_t71 =  *_t71 + _t71;
				 *_t113 =  *_t113 + _t132;
				_t72 = _t71 +  *_t102;
				asm("outsd");
				if (_t72 != 0) goto L15;
				 *_t132 =  *_t132 + _t113;
				_t133 = _t132 -  *_t102;
				 *(_t72 + _t72) =  *(_t72 + _t72) ^ _t72;
				 *_t72 =  *_t72 | _t72;
				 *_t72 =  *_t72 + _t72;
				 *_t72 =  *_t72 + _t72;
				 *_t113 =  *_t113 + _t133;
				_t73 = _t72 +  *_t102;
				asm("outsd");
				if (_t73 <= 0) goto L16;
				 *_t133 =  *_t133 + _t113;
				_t134 = _t133 -  *_t102;
				 *(_t73 + _t73) =  *(_t73 + _t73) ^ _t73;
				 *_t73 =  *_t73 | _t73;
				 *_t73 =  *_t73 + _t73;
				 *_t73 =  *_t73 + _t73;
				 *_t113 =  *_t113 + _t134;
				_t74 = _t73 +  *_t102;
				 *_t142 =  *_t142 - _t134;
				 *_t134 =  *_t134 + _t113;
				_t135 = _t134 -  *_t102;
				 *(_t74 + _t74) =  *(_t74 + _t74) ^ _t74;
				 *_t74 =  *_t74 | _t74;
				 *_t74 =  *_t74 + _t74;
				 *_t74 =  *_t74 + _t74;
				 *_t113 =  *_t113 + _t135;
				_t75 = _t74 +  *_t102;
				 *_t75 =  *_t75 - _t102;
				 *_t135 =  *_t135 + _t113;
				_t136 = _t135 -  *_t102;
				 *(_t75 + _t75) =  *(_t75 + _t75) ^ _t75;
				 *_t75 =  *_t75 | _t75;
				 *_t75 =  *_t75 + _t75;
				 *_t75 =  *_t75 + _t75;
				 *_t113 =  *_t113 + _t136;
				_t76 = _t75 +  *_t102;
				 *_t113 =  *_t113 - _t102;
				 *_t136 =  *_t136 + _t113;
				_t137 = _t136 -  *_t102;
				 *_t102 =  *_t102 ^ _t76;
				 *_t142 =  *_t142 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t113 =  *_t113 + _t76;
				 *_t76 =  *_t76 + _t76;
				asm("adc [edx], eax");
				 *_t137 =  *_t137 - _t102;
				 *_t137 =  *_t137 + _t113;
				asm("adc esi, [eax]");
				_t78 = _t76 -  *_t76;
				 *_t78 =  *_t78 | _t78;
				 *_t78 =  *_t78 + _t78;
				 *_t78 =  *_t78 + _t78;
				 *_t113 =  *_t113 + _t137;
				_t79 = _t78 +  *_t102;
				asm("outsd");
				if (_t79 != 0) goto L17;
				 *_t137 =  *_t137 + _t113;
				_t138 = _t137 -  *_t102;
				 *(_t79 + _t79) =  *(_t79 + _t79) ^ _t79;
				 *_t79 =  *_t79 | _t79;
				 *_t79 =  *_t79 + _t79;
				 *_t79 =  *_t79 + _t79;
				 *_t113 =  *_t113 + _t138;
				_t80 = _t79 +  *_t102;
				 *_t143 =  *_t143 - _t113;
				 *_t138 =  *_t138 + _t113;
				_t139 = _t138 -  *_t102;
				 *(_t80 + _t80) =  *(_t80 + _t80) ^ _t80;
				 *_t80 =  *_t80 | _t80;
				 *_t80 =  *_t80 + _t80;
				 *_t80 =  *_t80 + _t80;
				 *_t113 =  *_t113 + _t139;
				_t81 = _t80 +  *_t102;
				 *((intOrPtr*)(_t81 + _t81)) =  *((intOrPtr*)(_t81 + _t81)) - _t102;
				_t114 = _t113 |  *_t139;
				asm("adc esi, [eax]");
				_t82 = _t81 +  *_t81;
				_pop(es);
				 *_t82 =  *_t82 + _t82;
				 *_t114 =  *_t114 + _t82;
				 *_t82 =  *_t82 + _t82;
				asm("adc [edx], eax");
				asm("outsd");
				if ( *_t82 >= 0) goto L18;
				 *_t139 =  *_t139 + _t114;
				asm("adc esi, [eax]");
				_t84 = _t82 -  *_t82;
				 *_t84 =  *_t84 | _t84;
				 *_t84 =  *_t84 + _t84;
				 *_t84 =  *_t84 + _t84;
				 *_t114 =  *_t114 + _t139;
				_t85 = _t84 +  *_t102;
				 *_t143 =  *_t143 - _t102;
				 *_t139 =  *_t139 + _t114;
				_t140 = _t139 -  *_t102;
				 *_t102 =  *_t102 ^ _t85;
				 *_t142 =  *_t142 + _t85;
				 *_t85 =  *_t85 + _t85;
				 *_t114 =  *_t114 + _t85;
				 *_t85 =  *_t85 + _t85;
				asm("adc [edx], eax");
				 *_t142 =  *_t142 - _t102;
				 *_t140 =  *_t140 + _t114;
				asm("adc esi, [eax]");
				_t87 = _t85 -  *_t85;
				_pop(ss);
				 *_t87 =  *_t87 + _t87;
				 *_t114 =  *_t114 + _t87;
				 *_t87 =  *_t87 + _t87;
				asm("adc [edx], eax");
				asm("adc al, 0x7d");
				_t141 = _t140 + 1;
				 *_t87 =  *_t87 + _t87;
				_t88 = _t87 + 2;
				 *_t142 =  *_t142 - _t114;
				 *_t141 =  *_t141 + _t114;
				 *_t88 =  *_t88 + _t88;
				 *_t143 =  *_t143 + _t88;
				 *_t141 =  *_t141;
				 *_t102 =  *_t102 + _t141;
				 *_t102 =  *_t102 ^ _t88;
				_t117 = 0 + _t102;
				 *_t88 =  *_t88 + _t88;
				 *_t117 =  *_t117 + _t88;
				 *_t88 =  *_t88 + _t88;
				asm("adc [eax], eax");
				 *(_t88 + 0x4a20003a + _t117 * 8) =  *(_t88 + 0x4a20003a + _t117 * 8) & _t102;
				asm("lds eax, [ebx+0xa256149]");
				_push(ds);
				 *_t88 =  *_t88 | _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 = _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 - _t88;
				 *_t88 =  *_t88 + _t88;
				return _t88;
			}

0x07a809c3
0x07a809c3
0x07a809c3
0x07a809c4
0x07a809c6
0x07a809cb
0x07a809cc
0x07a809cc
0x07a809ce
0x07a809d0
0x07a809d3
0x07a809d5
0x07a809d7
0x07a809d9
0x07a809db
0x07a809dd
0x07a809df
0x07a809e1
0x07a809e3
0x07a809e4
0x07a809e6
0x07a809e7
0x07a809e8
0x07a809eb
0x07a809eb
0x07a809ec
0x07a809f1
0x07a809f3
0x07a809fa
0x07a809fc
0x07a809fe
0x07a80a00
0x07a80a01
0x07a80a03
0x07a80a05
0x07a80a07
0x07a80a09
0x07a80a0a
0x07a80a0b
0x07a80a0d
0x07a80a0f
0x07a80a11
0x07a80a13
0x07a80a15
0x07a80a17
0x07a80a19
0x07a80a1b
0x07a80a1d
0x07a80a1e
0x07a80a1f
0x07a80a21
0x07a80a23
0x07a80a25
0x07a80a27
0x07a80a29
0x07a80a2b
0x07a80a2d
0x07a80a2f
0x07a80a31
0x07a80a32
0x07a80a32
0x07a80a33
0x07a80a35
0x07a80a37
0x07a80a39
0x07a80a3b
0x07a80a3d
0x07a80a3f
0x07a80a41
0x07a80a43
0x07a80a45
0x07a80a46
0x07a80a47
0x07a80a49
0x07a80a4b
0x07a80a4d
0x07a80a4f
0x07a80a51
0x07a80a53
0x07a80a55
0x07a80a57
0x07a80a59
0x07a80a5c
0x07a80a60
0x07a80a62
0x07a80a64
0x07a80a65
0x07a80a67
0x07a80a69
0x07a80a6b
0x07a80a6d
0x07a80a70
0x07a80a74
0x07a80a76
0x07a80a78
0x07a80a7a
0x07a80a7c
0x07a80a7e
0x07a80a80
0x07a80a82
0x07a80a84
0x07a80a86
0x07a80a88
0x07a80a8a
0x07a80a8c
0x07a80a8d
0x07a80a8f
0x07a80a91
0x07a80a93
0x07a80a95
0x07a80af2
0x07a80af2
0x07a80af4
0x07a80af6
0x07a80afb
0x07a80afd
0x07a80aff
0x07a80b01
0x07a80b03
0x07a80b05
0x07a80b07
0x07a80b09
0x07a80b0b
0x07a80b0d
0x07a80b10
0x07a80b14
0x07a80b16
0x07a80b18
0x07a80b19
0x07a80b1b
0x07a80b1d
0x07a80b1f
0x07a80b21
0x07a80b24
0x07a80b28
0x07a80b2a
0x07a80b2c
0x07a80b2e
0x07a80b30
0x07a80a97
0x07a80a97
0x07a80a99
0x07a80a9b
0x07a80a9d
0x07a80a9f
0x07a80aa1
0x07a80aa3
0x07a80aa5
0x07a80aa7
0x07a80aa9
0x07a80aab
0x07a80aad
0x07a80aaf
0x07a80ab1
0x07a80ab3
0x07a80ab5
0x07a80ab7
0x07a80ab9
0x07a80abb
0x07a80abd
0x07a80ac0
0x07a80ac4
0x07a80ac6
0x07a80ac8
0x07a80aca
0x07a80acc
0x07a80ace
0x07a80ad0
0x07a80ad2
0x07a80ad4
0x07a80ad6
0x07a80ad8
0x07a80ada
0x07a80adc
0x07a80add
0x07a80adf
0x07a80ae1
0x07a80ae3
0x07a80ae5
0x07a80ae6
0x07a80ae7
0x07a80ae9
0x07a80aeb
0x07a80aed
0x07a80aef
0x07a80af1
0x00000000
0x07a80af1
0x07a80ad2
0x07a80b32
0x07a80b34
0x07a80b36
0x07a80b37
0x07a80b39
0x07a80b3b
0x07a80b3d
0x07a80b43
0x07a80b45
0x07a80b47
0x07a80b49
0x07a80b4c
0x07a80b4f
0x07a80b51
0x07a80b53
0x07a80b55
0x07a80b57
0x07a80b59
0x07a80b5b
0x07a80b5d
0x07a80b5f
0x07a80b62
0x07a80b64
0x07a80b66
0x07a80b68
0x07a80b6a
0x07a80b6c
0x07a80b6d
0x07a80b6f
0x07a80b71
0x07a80b73
0x07a80b76
0x07a80b78
0x07a80b7a
0x07a80b7c
0x07a80b7e
0x07a80b80
0x07a80b81
0x07a80b83
0x07a80b85
0x07a80b87
0x07a80b8a
0x07a80b8c
0x07a80b8e
0x07a80b90
0x07a80b92
0x07a80b95
0x07a80b97
0x07a80b99
0x07a80b9b
0x07a80b9e
0x07a80ba0
0x07a80ba2
0x07a80ba4
0x07a80ba6
0x07a80ba8
0x07a80ba9
0x07a80bab
0x07a80bad
0x07a80baf
0x07a80bb1
0x07a80bb3
0x07a80bb5
0x07a80bb7
0x07a80bb9
0x07a80bbb
0x07a80bbd
0x07a80bbf
0x07a80bc1
0x07a80bc3
0x07a80bc5
0x07a80bc8
0x07a80bcc
0x07a80bce
0x07a80bd0
0x07a80bd1
0x07a80bd3
0x07a80bd5
0x07a80bd7
0x07a80bd9
0x07a80bdc
0x07a80be0
0x07a80be2
0x07a80be4
0x07a80be6
0x07a80be8
0x07a80bea
0x07a80bec
0x07a80bee
0x07a80bef
0x07a80bf0
0x07a80bf2
0x07a80bf4
0x07a80bf6
0x07a80bf8
0x07a80bfa
0x07a80bfc
0x07a80bfe
0x07a80c00
0x07a80c02
0x07a80c03
0x07a80c04
0x07a80c06
0x07a80c08
0x07a80c0a
0x07a80c0c
0x07a80c0e
0x07a80c10
0x07a80c12
0x07a80c14
0x07a80c16
0x07a80c17
0x07a80c18
0x07a80c1a
0x07a80c1a
0x07a80c1c
0x07a80c1e
0x07a80c20
0x07a80c22
0x07a80c24
0x07a80c26
0x07a80c28
0x07a80c2a
0x07a80c2b
0x07a80c2c
0x07a80c2e
0x07a80c30
0x07a80c32
0x07a80c34
0x07a80c36
0x07a80c38
0x07a80c3a
0x07a80c3c
0x07a80c3e
0x07a80c3f
0x07a80c41
0x07a80c43
0x07a80c45
0x07a80c48
0x07a80c4a
0x07a80c4c
0x07a80c4e
0x07a80c50
0x07a80c52
0x07a80c53
0x07a80c55
0x07a80c57
0x07a80c59
0x07a80c5c
0x07a80c5e
0x07a80c60
0x07a80c62
0x07a80c64
0x07a80c66
0x07a80c67
0x07a80c69
0x07a80c6b
0x07a80c6d
0x07a80c70
0x07a80c72
0x07a80c74
0x07a80c76
0x07a80c78
0x07a80c7a
0x07a80c7b
0x07a80c7d
0x07a80c7f
0x07a80c81
0x07a80c84
0x07a80c86
0x07a80c88
0x07a80c8a
0x07a80c8c
0x07a80c8e
0x07a80c8f
0x07a80c91
0x07a80c93
0x07a80c95
0x07a80c98
0x07a80c9a
0x07a80c9c
0x07a80c9e
0x07a80ca0
0x07a80ca2
0x07a80ca3
0x07a80ca5
0x07a80ca7
0x07a80ca9
0x07a80cac
0x07a80cae
0x07a80cb0
0x07a80cb2
0x07a80cb4
0x07a80cb6
0x07a80cb7
0x07a80cb9
0x07a80cbb
0x07a80cbd
0x07a80cc0
0x07a80cc2
0x07a80cc4
0x07a80cc6
0x07a80cc8
0x07a80cca
0x07a80ccd
0x07a80ccf
0x07a80cd1
0x07a80cd4
0x07a80cd6
0x07a80cd8
0x07a80cda
0x07a80cdc
0x07a80cde
0x07a80ce1
0x07a80ce3
0x07a80ce5
0x07a80ce8
0x07a80cea
0x07a80cec
0x07a80cee
0x07a80cf0
0x07a80cf2
0x07a80cf5
0x07a80cf7
0x07a80cf9
0x07a80cfb
0x07a80cfd
0x07a80cff
0x07a80d01
0x07a80d03
0x07a80d05
0x07a80d08
0x07a80d0c
0x07a80d0e
0x07a80d10
0x07a80d12
0x07a80d14
0x07a80d16
0x07a80d18
0x07a80d1a
0x07a80d1b
0x07a80d1d
0x07a80d1f
0x07a80d21
0x07a80d24
0x07a80d26
0x07a80d28
0x07a80d2a
0x07a80d2c
0x07a80d2e
0x07a80d31
0x07a80d33
0x07a80d35
0x07a80d38
0x07a80d3a
0x07a80d3c
0x07a80d3e
0x07a80d40
0x07a80d42
0x07a80d46
0x07a80d48
0x07a80d4a
0x07a80d4c
0x07a80d4d
0x07a80d4f
0x07a80d51
0x07a80d53
0x07a80d55
0x07a80d56
0x07a80d58
0x07a80d5c
0x07a80d5e
0x07a80d60
0x07a80d62
0x07a80d64
0x07a80d66
0x07a80d68
0x07a80d6a
0x07a80d6d
0x07a80d6f
0x07a80d71
0x07a80d73
0x07a80d75
0x07a80d77
0x07a80d79
0x07a80d7b
0x07a80d7d
0x07a80d80
0x07a80d84
0x07a80d86
0x07a80d88
0x07a80d89
0x07a80d8b
0x07a80d8d
0x07a80d8f
0x07a80d91
0x07a80d93
0x07a80d94
0x07a80d96
0x07a80d98
0x07a80d9b
0x07a80d9d
0x07a80da3
0x07a80da5
0x07a80da7
0x07a80da9
0x07a80dab
0x07a80dad
0x07a80daf
0x07a80db1
0x07a80db3
0x07a80db5
0x07a80dbc
0x07a80dc2
0x07a80dc5
0x07a80dc7
0x07a80dc9
0x07a80dcb
0x07a80dcd
0x07a80dcf
0x07a80dd1

Memory Dump Source

Source File: 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmp, Offset: 07A50000, based on PE: true

Associated: 00000000.00000002.295668449.0000000007AD0000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db558259fc98b2fd97f9bd2fcb72bf0b86216fb1f2585279ed7f4bea26786dc2
Instruction ID: bac5ca9ea52ba2866a4cf2b212172b5dd4b8fe0551faea9e539b8dd2115844ab
Opcode Fuzzy Hash: db558259fc98b2fd97f9bd2fcb72bf0b86216fb1f2585279ed7f4bea26786dc2
Instruction Fuzzy Hash: 8122572540F3D28FCB434B7889B4291BFB1AE4B22431E45DBC4D0CF1A7D65A295ADB63

Uniqueness

Uniqueness Score: -1.00%

Function 02C8E630, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ca6b04d28bc33d9c5c8170a2e0edafe754e205128eeb19987b2ecfff836dd5
Instruction ID: 56defa3bfb3a8613041f72cbfcb89c38a509874ef974b4e20b707e9e8668feba
Opcode Fuzzy Hash: 49ca6b04d28bc33d9c5c8170a2e0edafe754e205128eeb19987b2ecfff836dd5
Instruction Fuzzy Hash: B012A2F1ED17469AD310CF65E8883A93BA1B7443ADBD0CB08D2621BAD1D7B4196ECF44

Uniqueness

Uniqueness Score: -1.00%

Function 02C8C1D4, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb1ecbbeaaaaa740a8f973cedb19ddbdbdaf03bb9568ac5422d63f9f7691113
Instruction ID: d850bf9c1c6517895c5bc049b461367e380faaddc2b3a04e2820eb33936fd582
Opcode Fuzzy Hash: aeb1ecbbeaaaaa740a8f973cedb19ddbdbdaf03bb9568ac5422d63f9f7691113
Instruction Fuzzy Hash: F4A16132E002198FCF15EFB5C8445DEB7B2FF85308B15856AE806BB261DB71AA55CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02C8E620, Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.286512339.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2529455b0902a08b0e5f765c53ad0ffeaf83c87df064bcd3bbebb94f3d8b3784
Instruction ID: f1ddc0d45e1dacbca12a5e7c373cfc65a559edf36ad447b0b8d18df3af1ddd52
Opcode Fuzzy Hash: 2529455b0902a08b0e5f765c53ad0ffeaf83c87df064bcd3bbebb94f3d8b3784
Instruction Fuzzy Hash: DDC14AF1E917458AD310DF65E8883993B71BB843ACF91CB08D2622FAD1D7B4186ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 07AD25D8, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.295668449.0000000007AD0000.00000040.00000001.sdmp, Offset: 07A50000, based on PE: true

Associated: 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22dd33b60be31592b0b1bece94faf3804955b06251cbf536a3f9a321a41b6c1f
Instruction ID: fda60a9cd793d7b4c29d36a73ec41e03a6ee55ed3b7b3061a3048b70a54e7f31
Opcode Fuzzy Hash: 22dd33b60be31592b0b1bece94faf3804955b06251cbf536a3f9a321a41b6c1f
Instruction Fuzzy Hash: 5A71D0B4E10219DFCB04CFA9C58499EFBF1FF89210F149169E41AAB364D330AA42CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07AD3150, Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.295668449.0000000007AD0000.00000040.00000001.sdmp, Offset: 07A50000, based on PE: true

Associated: 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848f6c1dd87141d7363ab7da497883dc90bed4f1edf525625f7fd6df8697a456
Instruction ID: 4c2fdc62ca9403e172bcc611cd328fffccec4f3fc5a4008fda59bce8a9575047
Opcode Fuzzy Hash: 848f6c1dd87141d7363ab7da497883dc90bed4f1edf525625f7fd6df8697a456
Instruction Fuzzy Hash: A571F3B4E1520ADFCF04CF99D5849AEFBB2FF89210F148519D426AB350D7349982CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07AD3A30, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.295668449.0000000007AD0000.00000040.00000001.sdmp, Offset: 07A50000, based on PE: true

Associated: 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651ef31e90d2feb85be370393d2ddfee829a4187df8f25f9820769392fac5d61
Instruction ID: 582d4effb1a27a794397afc75c76a8b565b600c0dc23a52f2d90e1fea5c553c2
Opcode Fuzzy Hash: 651ef31e90d2feb85be370393d2ddfee829a4187df8f25f9820769392fac5d61
Instruction Fuzzy Hash: 9F61F2B0E15609CFCF48CF99D5805DEBBF2BB89210F24902AD416BB224D7749A428F65

Uniqueness

Uniqueness Score: -1.00%

Function 07AD37C0, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.295668449.0000000007AD0000.00000040.00000001.sdmp, Offset: 07A50000, based on PE: true

Associated: 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57541d3110184e00ade53c0dd969b498b23792fc931fa5c03866db950773c768
Instruction ID: 90dd741b9497ea2f700f5fd6c6a6d7821e445133b8bd77da3f4051f0ef089880
Opcode Fuzzy Hash: 57541d3110184e00ade53c0dd969b498b23792fc931fa5c03866db950773c768
Instruction Fuzzy Hash: 5C51E7B4E1520ADBCF08CFAAC4815AEFBB6EF89300F24D429C416B7254D7349A428F95

Uniqueness

Uniqueness Score: -1.00%

Function 07AD3E70, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.295668449.0000000007AD0000.00000040.00000001.sdmp, Offset: 07A50000, based on PE: true

Associated: 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600cb338871abbc558129aa1b4b8c283b8fcc6835da146bc7fcda1c788977016
Instruction ID: 6c8944e5ae5b5014899b953c545d5405b9b8d5ac10744de9aed7fdc1c4f9472b
Opcode Fuzzy Hash: 600cb338871abbc558129aa1b4b8c283b8fcc6835da146bc7fcda1c788977016
Instruction Fuzzy Hash: D631C6B1E056189BEB58CFABD84469EFAF3AFC9300F14C0BAD419A7258DB344A418F51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 5736 Parent PID: 6452 shipping documents for PO#813-25319 192-463-56-265-3327.exeCOMMON

Executed Functions

Function 00BAD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.467111962.0000000000BAD000.00000040.00000001.sdmp, Offset: 00BAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09873e336cbfd91ccb488f62c551b373dffe5a06de22d5b23e1db78f2e03ff4b
Instruction ID: 1e7484b9628dac6b7d4fa9e24bb846b6c6e35c7b63d8f015c6fa442b993d2274
Opcode Fuzzy Hash: 09873e336cbfd91ccb488f62c551b373dffe5a06de22d5b23e1db78f2e03ff4b
Instruction Fuzzy Hash: F021F5B1508240DFCB24DF24D9D0B26BBA5FB85314F24C5A9E84A4BA46C736D847CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BAD006, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.467111962.0000000000BAD000.00000040.00000001.sdmp, Offset: 00BAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186ac234d366b28520567bceef9c565bf0aee682e3e7e43a08ccec6e0cd6cca0
Instruction ID: 05a5738f96b25fac317cba01366d14bbd59b09cc2373f6b595e2d40385db3676
Opcode Fuzzy Hash: 186ac234d366b28520567bceef9c565bf0aee682e3e7e43a08ccec6e0cd6cca0
Instruction Fuzzy Hash: 0C2184755093808FCB12CF24D5A4B15BFB1EB46314F28C5DAD8498BA57C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe	Binary or memory string: OriginalFilename vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameNpXVsfKmoYCvTOuLtBSSAxQUjXePN.exe4 vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.285511609.0000000000902000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamevJdJ.exe6 vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286471938.0000000002C00000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286471938.0000000002C00000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286861757.0000000002EB1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameWindowsNetwork.dll> vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.295893809.000000000D260000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.295043203.0000000007880000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe	Binary or memory string: OriginalFilename vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000009.00000002.283414812.0000000000152000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamevJdJ.exe6 vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe	Binary or memory string: OriginalFilename vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000000.284386569.0000000000652000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamevJdJ.exe6 vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameNpXVsfKmoYCvTOuLtBSSAxQUjXePN.exe4 vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe	Binary or memory string: OriginalFilenamevJdJ.exe6 vs shipping documents for PO#813-25319 192-463-56-265-3327.exe

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report shipping documents for PO#813-25319 192-463-56-265-3327.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 6452 Parent PID: 5900

Function 07A809C3, Relevance: .5, Instructions: 532
COMMONCrypto