Play interactive tour

Edit tour

Windows Analysis Report shipping documents approval.exe

Overview

General Information

Sample Name:	shipping documents approval.exe
Analysis ID:	452548
MD5:	2cc7d328527b05a048f9a8386102420c
SHA1:	e02b77a99a315dcb7b7f961a2a7adb285f96a58c
SHA256:	d9c12ca57571d19bea0f509e1f3b02b4a6022b5e82f8241756ab12909009542a
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Potentially malicious time measurement code found

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Antivirus or Machine Learning detection for unpacked file

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

shipping documents approval.exe (PID: 5640 cmdline: 'C:\Users\user\Desktop\shipping documents approval.exe' MD5: 2CC7D328527B05A048F9A8386102420C)

shipping documents approval.exe (PID: 4276 cmdline: {path} MD5: 2CC7D328527B05A048F9A8386102420C)

shipping documents approval.exe (PID: 4280 cmdline: {path} MD5: 2CC7D328527B05A048F9A8386102420C)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "akibapen@saisianket-tech.com", "Password": "oluwagozie123", "Host": "smtp.saisianket-tech.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.478904402.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.478904402.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.309550378.0000000004331000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.309550378.0000000004331000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000E.00000002.481715251.0000000002FC1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.306725374.0000000003398000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: shipping documents approval.exe PID: 5640	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: shipping documents approval.exe PID: 5640	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: shipping documents approval.exe PID: 4280	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: shipping documents approval.exe PID: 4280	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.shipping documents approval.exe.4428f88.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.shipping documents approval.exe.4428f88.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
14.2.shipping documents approval.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
14.2.shipping documents approval.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.shipping documents approval.exe.4428f88.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.shipping documents approval.exe.4428f88.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.shipping documents approval.exe.4428f88.2.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "akibapen@saisianket-tech.com", "Password": "oluwagozie123", "Host": "smtp.saisianket-tech.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: shipping documents approval.exe	Virustotal: Detection: 28%			Perma Link
Source: shipping documents approval.exe	ReversingLabs: Detection: 34%

Machine Learning detection for sample

Show sources

Source: shipping documents approval.exe

Joe Sandbox ML: detected

Source: 14.2.shipping documents approval.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: shipping documents approval.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: shipping documents approval.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: shipping documents approval.exe, 0000000E.00000002.481715251.0000000002FC1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: shipping documents approval.exe, 0000000E.00000002.481715251.0000000002FC1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: shipping documents approval.exe, 0000000E.00000002.481715251.0000000002FC1000.00000004.00000001.sdmp	String found in binary or memory: http://EoZDnS.com
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: shipping documents approval.exe, 00000000.00000003.222567942.0000000005E65000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: shipping documents approval.exe, 00000000.00000003.222826336.0000000005E65000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comMi
Source: shipping documents approval.exe, 00000000.00000003.222567942.0000000005E65000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comd
Source: shipping documents approval.exe, 00000000.00000003.222567942.0000000005E65000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.come
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: shipping documents approval.exe, 00000000.00000003.221993345.0000000005E65000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.como.q
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: shipping documents approval.exe, 00000000.00000003.226264644.0000000005E64000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comX
Source: shipping documents approval.exe, 00000000.00000003.305157842.0000000005E50000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: shipping documents approval.exe, 00000000.00000003.225572352.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comals/
Source: shipping documents approval.exe, 00000000.00000003.225572352.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalsFj
Source: shipping documents approval.exe, 00000000.00000003.305157842.0000000005E50000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comcec
Source: shipping documents approval.exe, 00000000.00000003.225572352.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comd;
Source: shipping documents approval.exe, 00000000.00000003.305157842.0000000005E50000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comf
Source: shipping documents approval.exe, 00000000.00000003.225572352.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comlic
Source: shipping documents approval.exe, 00000000.00000003.228681183.0000000005E68000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.commetX
Source: shipping documents approval.exe, 00000000.00000003.225572352.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comrsiv
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: shipping documents approval.exe, 00000000.00000003.221260521.0000000005E63000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: shipping documents approval.exe, 00000000.00000003.220898772.0000000005E60000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn.
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: shipping documents approval.exe, 00000000.00000003.220898772.0000000005E60000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnei
Source: shipping documents approval.exe, 00000000.00000003.221260521.0000000005E63000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnhe
Source: shipping documents approval.exe, 00000000.00000003.227067690.0000000005E61000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp, shipping documents approval.exe, 00000000.00000003.226376003.0000000005E60000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: shipping documents approval.exe, 00000000.00000003.226376003.0000000005E60000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmo
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: shipping documents approval.exe, 00000000.00000003.223451229.0000000005E64000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: shipping documents approval.exe, 00000000.00000003.223499181.0000000005E62000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: shipping documents approval.exe, 00000000.00000003.223451229.0000000005E64000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/G
Source: shipping documents approval.exe, 00000000.00000003.223537310.0000000005E55000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Q
Source: shipping documents approval.exe, 00000000.00000003.223537310.0000000005E55000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/c
Source: shipping documents approval.exe, 00000000.00000003.223881362.0000000005E5A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/j
Source: shipping documents approval.exe, 00000000.00000003.223537310.0000000005E55000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: shipping documents approval.exe, 00000000.00000003.223537310.0000000005E55000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/G
Source: shipping documents approval.exe, 00000000.00000003.223537310.0000000005E55000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/l
Source: shipping documents approval.exe, 00000000.00000003.223537310.0000000005E55000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/waX
Source: shipping documents approval.exe, 00000000.00000003.226152714.0000000005E61000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: shipping documents approval.exe, 00000000.00000003.221993345.0000000005E65000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnMi
Source: shipping documents approval.exe, 00000000.00000002.309550378.0000000004331000.00000004.00000001.sdmp, shipping documents approval.exe, 0000000E.00000002.478904402.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: shipping documents approval.exe, 0000000E.00000002.481715251.0000000002FC1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: shipping documents approval.exe

Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01992200	0_2_01992200
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01990472	0_2_01990472
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01990F88	0_2_01990F88
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_019930D8	0_2_019930D8
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01991241	0_2_01991241
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01991808	0_2_01991808
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01991C50	0_2_01991C50
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01994B08	0_2_01994B08
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01994AF8	0_2_01994AF8
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01992FE9	0_2_01992FE9
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01990F0E	0_2_01990F0E
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01995119	0_2_01995119
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01995128	0_2_01995128
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01995338	0_2_01995338
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01995348	0_2_01995348
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_019955D8	0_2_019955D8
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_019955C9	0_2_019955C9
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01995792	0_2_01995792
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01993FB1	0_2_01993FB1
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_01993FC0	0_2_01993FC0
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03313AC0	0_2_03313AC0
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03310040	0_2_03310040
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_033137E0	0_2_033137E0
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03313301	0_2_03313301
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03312350	0_2_03312350
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03312340	0_2_03312340
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03310A38	0_2_03310A38
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03310A29	0_2_03310A29
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03313AB0	0_2_03313AB0
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_033152A0	0_2_033152A0
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03312961	0_2_03312961
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03310026	0_2_03310026
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03311070	0_2_03311070
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03314E38	0_2_03314E38
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03314EB1	0_2_03314EB1
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_033116E0	0_2_033116E0
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03310560	0_2_03310560
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 14_2_054646A0	14_2_054646A0
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 14_2_0546D990	14_2_0546D990
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 14_2_05464610	14_2_05464610
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 14_2_05464630	14_2_05464630
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 14_2_062494F8	14_2_062494F8
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 14_2_06247540	14_2_06247540
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 14_2_06246928	14_2_06246928
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 14_2_06246C70	14_2_06246C70

Source: shipping documents approval.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: shipping documents approval.exe, 00000000.00000002.308268714.000000000360D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameResource_Meter.dll> vs shipping documents approval.exe
Source: shipping documents approval.exe, 00000000.00000002.305624416.0000000001033000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameMC6ig.exe2 vs shipping documents approval.exe
Source: shipping documents approval.exe, 00000000.00000002.309550378.0000000004331000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameflzpEtpUomJAtpFleNXDnXCeuuVrXkGkQW.exe4 vs shipping documents approval.exe
Source: shipping documents approval.exe, 00000000.00000002.309928230.00000000044DE000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs shipping documents approval.exe
Source: shipping documents approval.exe, 00000000.00000002.312677233.0000000005810000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs shipping documents approval.exe
Source: shipping documents approval.exe, 0000000D.00000000.303507780.00000000001F3000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameMC6ig.exe2 vs shipping documents approval.exe
Source: shipping documents approval.exe, 0000000E.00000002.479137828.0000000000438000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameflzpEtpUomJAtpFleNXDnXCeuuVrXkGkQW.exe4 vs shipping documents approval.exe
Source: shipping documents approval.exe, 0000000E.00000002.486549658.0000000006190000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewbemdisp.tlbj% vs shipping documents approval.exe
Source: shipping documents approval.exe, 0000000E.00000002.480886073.00000000013EA000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs shipping documents approval.exe
Source: shipping documents approval.exe, 0000000E.00000002.479532869.0000000000CF3000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameMC6ig.exe2 vs shipping documents approval.exe
Source: shipping documents approval.exe	Binary or memory string: OriginalFilenameMC6ig.exe2 vs shipping documents approval.exe

Source: shipping documents approval.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: shipping documents approval.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/1@0/0

Source: C:\Users\user\Desktop\shipping documents approval.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\shipping documents approval.exe.log

Jump to behavior

Source: shipping documents approval.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\shipping documents approval.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\shipping documents approval.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\shipping documents approval.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: shipping documents approval.exe	Virustotal: Detection: 28%
Source: shipping documents approval.exe	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\shipping documents approval.exe 'C:\Users\user\Desktop\shipping documents approval.exe'
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process created: C:\Users\user\Desktop\shipping documents approval.exe {path}
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process created: C:\Users\user\Desktop\shipping documents approval.exe {path}
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process created: C:\Users\user\Desktop\shipping documents approval.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process created: C:\Users\user\Desktop\shipping documents approval.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\shipping documents approval.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\shipping documents approval.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: shipping documents approval.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: shipping documents approval.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: shipping documents approval.exe, uNotepad/Form1.cs	.Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.shipping documents approval.exe.f50000.0.unpack, uNotepad/Form1.cs	.Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.shipping documents approval.exe.f50000.0.unpack, uNotepad/Form1.cs	.Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.2.shipping documents approval.exe.110000.0.unpack, uNotepad/Form1.cs	.Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.0.shipping documents approval.exe.110000.0.unpack, uNotepad/Form1.cs	.Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 14.0.shipping documents approval.exe.c10000.0.unpack, uNotepad/Form1.cs	.Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 14.2.shipping documents approval.exe.c10000.1.unpack, uNotepad/Form1.cs	.Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_00FB5C66 push eax; iretd	0_2_00FB5C67
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_03318DDD push FFFFFF8Bh; iretd	0_2_03318DDF
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 0_2_05C1C428 push eax; mov dword ptr [esp], ecx	0_2_05C1C43C
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 13_2_00175C66 push eax; iretd	13_2_00175C67
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 14_2_00C75C66 push eax; iretd	14_2_00C75C67
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 14_2_0546B792 push 6000065Eh; retf	14_2_0546B7B9
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 14_2_0624851A push es; ret	14_2_06248550
Source: C:\Users\user\Desktop\shipping documents approval.exe	Code function: 14_2_06248540 push es; ret	14_2_06248550

Source: initial sample

Static PE information: section name: .text entropy: 7.74217502455

Source: C:\Users\user\Desktop\shipping documents approval.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.306725374.0000000003398000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping documents approval.exe PID: 5640, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\shipping documents approval.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\shipping documents approval.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: shipping documents approval.exe, 00000000.00000002.306725374.0000000003398000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: shipping documents approval.exe, 00000000.00000002.306725374.0000000003398000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\shipping documents approval.exe

Code function: 0_2_03311070 rdtsc

0_2_03311070

Source: C:\Users\user\Desktop\shipping documents approval.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\shipping documents approval.exe	Window / User API: threadDelayed 994			Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Window / User API: threadDelayed 8838			Jump to behavior

Source: C:\Users\user\Desktop\shipping documents approval.exe TID: 3840	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe TID: 6056	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe TID: 5024	Thread sleep count: 994 > 30	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe TID: 5024	Thread sleep count: 8838 > 30	Jump to behavior

Source: C:\Users\user\Desktop\shipping documents approval.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\shipping documents approval.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: shipping documents approval.exe, 00000000.00000002.306725374.0000000003398000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: shipping documents approval.exe, 00000000.00000002.306725374.0000000003398000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: shipping documents approval.exe, 00000000.00000002.306725374.0000000003398000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: shipping documents approval.exe, 00000000.00000002.306725374.0000000003398000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: shipping documents approval.exe, 00000000.00000002.306725374.0000000003398000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: shipping documents approval.exe, 00000000.00000002.306725374.0000000003398000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: shipping documents approval.exe, 00000000.00000002.306725374.0000000003398000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: shipping documents approval.exe, 00000000.00000002.306725374.0000000003398000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: shipping documents approval.exe, 00000000.00000002.306725374.0000000003398000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\shipping documents approval.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Potentially malicious time measurement code found

Show sources

Source: C:\Users\user\Desktop\shipping documents approval.exe

Code function: 0_2_03311070 Start: 03311079 End: 0331107D

0_2_03311070

Source: C:\Users\user\Desktop\shipping documents approval.exe

Code function: 0_2_03311070 rdtsc

0_2_03311070

Source: C:\Users\user\Desktop\shipping documents approval.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\shipping documents approval.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\shipping documents approval.exe

Memory written: C:\Users\user\Desktop\shipping documents approval.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\shipping documents approval.exe	Process created: C:\Users\user\Desktop\shipping documents approval.exe {path}			Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Process created: C:\Users\user\Desktop\shipping documents approval.exe {path}			Jump to behavior

Source: shipping documents approval.exe, 0000000E.00000002.481549384.00000000019A0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: shipping documents approval.exe, 0000000E.00000002.481549384.00000000019A0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: shipping documents approval.exe, 0000000E.00000002.481549384.00000000019A0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: shipping documents approval.exe, 0000000E.00000002.481549384.00000000019A0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Users\user\Desktop\shipping documents approval.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Users\user\Desktop\shipping documents approval.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping documents approval.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\shipping documents approval.exe

Code function: 14_2_06245D44 GetUserNameW,

14_2_06245D44

Source: C:\Users\user\Desktop\shipping documents approval.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.shipping documents approval.exe.4428f88.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.shipping documents approval.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents approval.exe.4428f88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.478904402.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.309550378.0000000004331000.00000004.00000001.sdmp, type: MEMORY

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.shipping documents approval.exe.4428f88.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.shipping documents approval.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents approval.exe.4428f88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.478904402.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.309550378.0000000004331000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping documents approval.exe PID: 5640, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping documents approval.exe PID: 4280, type: MEMORY

Source: Yara match	File source: 0000000E.00000002.481715251.0000000002FC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping documents approval.exe PID: 4280, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.shipping documents approval.exe.4428f88.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.shipping documents approval.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents approval.exe.4428f88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.478904402.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.309550378.0000000004331000.00000004.00000001.sdmp, type: MEMORY

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.shipping documents approval.exe.4428f88.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.shipping documents approval.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping documents approval.exe.4428f88.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.478904402.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.309550378.0000000004331000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping documents approval.exe PID: 5640, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping documents approval.exe PID: 4280, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Security Software Discovery221	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information2	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing13	Cached Domain Credentials	Account Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Owner/User Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery113	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
shipping documents approval.exe	29%	Virustotal		Browse
shipping documents approval.exe	35%	ReversingLabs	ByteCode-MSIL.Infostealer.DarkStealer
shipping documents approval.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
14.2.shipping documents approval.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.comalsFj	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/G	0%	Avira URL Cloud	safe
http://www.fontbureau.comd;	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.comMi	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.carterandcone.como.q	0%	Avira URL Cloud	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/waX	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.comrsiv	0%	URL Reputation	safe
http://www.fontbureau.comrsiv	0%	URL Reputation	safe
http://www.fontbureau.comrsiv	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.founder.com.cn/cnei	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://EoZDnS.com	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.fontbureau.commetX	0%	Avira URL Cloud	safe
http://www.carterandcone.comd	0%	URL Reputation	safe
http://www.carterandcone.comd	0%	URL Reputation	safe
http://www.carterandcone.comd	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Q	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Q	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Q	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.founder.com.cn/cnhe	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/G	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/G	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/G	0%	URL Reputation	safe
http://www.zhongyicts.com.cnMi	0%	Avira URL Cloud	safe
http://www.fontbureau.comX	0%	Avira URL Cloud	safe
http://www.fontbureau.comlic	0%	URL Reputation	safe
http://www.fontbureau.comlic	0%	URL Reputation	safe
http://www.fontbureau.comlic	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htmo	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	shipping documents approval.exe, 0000000E.00000002.481715251.0000000002FC1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comalsFj	shipping documents approval.exe, 00000000.00000003.225572352.0000000005E62000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/G	shipping documents approval.exe, 00000000.00000003.223537310.0000000005E55000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comd;	shipping documents approval.exe, 00000000.00000003.225572352.0000000005E62000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.tiro.com	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com	shipping documents approval.exe, 00000000.00000003.222567942.0000000005E65000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comMi	shipping documents approval.exe, 00000000.00000003.222826336.0000000005E65000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.como.q	shipping documents approval.exe, 00000000.00000003.221993345.0000000005E65000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netD	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp, shipping documents approval.exe, 00000000.00000003.226376003.0000000005E60000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/waX	shipping documents approval.exe, 00000000.00000003.223537310.0000000005E55000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp//	shipping documents approval.exe, 00000000.00000003.223499181.0000000005E62000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comrsiv	shipping documents approval.exe, 00000000.00000003.225572352.0000000005E62000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.com	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cnei	shipping documents approval.exe, 00000000.00000003.220898772.0000000005E60000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	shipping documents approval.exe, 00000000.00000002.309550378.0000000004331000.00000004.00000001.sdmp, shipping documents approval.exe, 0000000E.00000002.478904402.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://EoZDnS.com	shipping documents approval.exe, 0000000E.00000002.481715251.0000000002FC1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/	shipping documents approval.exe, 00000000.00000003.227067690.0000000005E61000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://DynDns.comDynDNS	shipping documents approval.exe, 0000000E.00000002.481715251.0000000002FC1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.come	shipping documents approval.exe, 00000000.00000003.222567942.0000000005E65000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.commetX	shipping documents approval.exe, 00000000.00000003.228681183.0000000005E68000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comd	shipping documents approval.exe, 00000000.00000003.222567942.0000000005E65000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Q	shipping documents approval.exe, 00000000.00000003.223537310.0000000005E55000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	shipping documents approval.exe, 0000000E.00000002.481715251.0000000002FC1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cnhe	shipping documents approval.exe, 00000000.00000003.221260521.0000000005E63000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/G	shipping documents approval.exe, 00000000.00000003.223451229.0000000005E64000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cnMi	shipping documents approval.exe, 00000000.00000003.221993345.0000000005E65000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comX	shipping documents approval.exe, 00000000.00000003.226264644.0000000005E64000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comlic	shipping documents approval.exe, 00000000.00000003.225572352.0000000005E62000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htmo	shipping documents approval.exe, 00000000.00000003.226376003.0000000005E60000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	shipping documents approval.exe, 00000000.00000003.223537310.0000000005E55000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.coma	shipping documents approval.exe, 00000000.00000003.305157842.0000000005E50000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn.	shipping documents approval.exe, 00000000.00000003.220898772.0000000005E60000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	shipping documents approval.exe, 00000000.00000003.221260521.0000000005E63000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comf	shipping documents approval.exe, 00000000.00000003.305157842.0000000005E50000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.monotype.	shipping documents approval.exe, 00000000.00000003.226152714.0000000005E61000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comcec	shipping documents approval.exe, 00000000.00000003.305157842.0000000005E50000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	shipping documents approval.exe, 00000000.00000003.223451229.0000000005E64000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/l	shipping documents approval.exe, 00000000.00000003.223537310.0000000005E55000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	shipping documents approval.exe, 00000000.00000002.313954727.0000000006062000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/j	shipping documents approval.exe, 00000000.00000003.223881362.0000000005E5A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comals/	shipping documents approval.exe, 00000000.00000003.225572352.0000000005E62000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/c	shipping documents approval.exe, 00000000.00000003.223537310.0000000005E55000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	452548
Start date:	22.07.2021
Start time:	15:12:06
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	shipping documents approval.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/1@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 2.5% (good quality ratio 1.1%) Quality average: 26.6% Quality standard deviation: 35.3%
HCA Information:	Successful, ratio: 98% Number of executed functions: 124 Number of non-executed functions: 23
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:14:09	API Interceptor	412x Sleep call for process: shipping documents approval.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\shipping documents approval.exe.log Download File
Process:	C:\Users\user\Desktop\shipping documents approval.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.07773784763095
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	shipping documents approval.exe
File size:	922624
MD5:	2cc7d328527b05a048f9a8386102420c
SHA1:	e02b77a99a315dcb7b7f961a2a7adb285f96a58c
SHA256:	d9c12ca57571d19bea0f509e1f3b02b4a6022b5e82f8241756ab12909009542a
SHA512:	b2381091df640f0f0a2f824adac11b6b86ccf9f501e57b43f7ece88e3382061c6fbbc590bd0d74b09e705a0a26f0a48eb59b6a230fc3c2111274a88f84127376
SSDEEP:	12288:EvzK4aoug3yvut646NymjiyUEDRSgcDeKCXSMPQipP5a:Q3lQNNo3g8BipA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............0..,...........J... ...`....@.. ....................................@................................

File Icon


Icon Hash:	f0debeffdffeec70

Static PE Info

General
Entrypoint:	0x484abe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60F912FB [Thu Jul 22 06:40:59 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84a64	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x86000	0x5e320	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x82ac4	0x82c00	False	0.859671889938	data	7.74217502455	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x86000	0x5e320	0x5e400	False	0.167326342838	data	5.64058854685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe6000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x86220	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x86688	0x1128	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
RT_ICON	0x877b0	0x2668	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0x89e18	0x4428	dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON	0x8e240	0x11028	dBase III DBT, version number 0, next free block index 40
RT_ICON	0x9f268	0x44028	data
RT_GROUP_ICON	0xe3290	0x5a	data
RT_VERSION	0xe32ec	0x30c	data
RT_MANIFEST	0xe35f8	0xd25	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF, LF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2016
Assembly Version	1.0.0.0
InternalName	MC6ig.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	uNotepad
ProductVersion	1.0.0.0
FileDescription	uNotepad
OriginalFilename	MC6ig.exe

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: shipping documents approval.exe PID: 5640 Parent PID: 5780

General

Start time:	15:12:59
Start date:	22/07/2021
Path:	C:\Users\user\Desktop\shipping documents approval.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\shipping documents approval.exe'
Imagebase:	0xf50000
File size:	922624 bytes
MD5 hash:	2CC7D328527B05A048F9A8386102420C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.309550378.0000000004331000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.309550378.0000000004331000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.306725374.0000000003398000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: shipping documents approval.exe PID: 4276 Parent PID: 5640

General

Start time:	15:13:41
Start date:	22/07/2021
Path:	C:\Users\user\Desktop\shipping documents approval.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x110000
File size:	922624 bytes
MD5 hash:	2CC7D328527B05A048F9A8386102420C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: shipping documents approval.exe PID: 4280 Parent PID: 5640

General

Start time:	15:13:41
Start date:	22/07/2021
Path:	C:\Users\user\Desktop\shipping documents approval.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xc10000
File size:	922624 bytes
MD5 hash:	2CC7D328527B05A048F9A8386102420C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.478904402.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000E.00000002.478904402.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.481715251.0000000002FC1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: shipping documents approval.exe PID: 5640 Parent PID: 5780 shipping documents approval.exeCOMMON

Executed Functions

Function 01991C50, Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

$bjM, xrefs: 01991E8F
$bjM, xrefs: 01991E88
ry], xrefs: 01991CAE

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID: $bjM$$bjM$ry]
API String ID: 0-4291745457
Opcode ID: 06e4b6bd27ab03b6f019168d999ba6162354204ecb27f6a82fb2bc94bdb4cbd1
Instruction ID: f4a23b5e416499de871c3f74c1ff1ad07818145bc909d06867dc2c3194a7bdae
Opcode Fuzzy Hash: 06e4b6bd27ab03b6f019168d999ba6162354204ecb27f6a82fb2bc94bdb4cbd1
Instruction Fuzzy Hash: 99713774E1524ADFCF05CFA9D4809AEFBB2FB89320F149466D51AAB314D330A942CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01992200, Relevance: 2.6, Strings: 2, Instructions: 114COMMON

Download Yara Rule

Strings

a%(, xrefs: 019923B4
a%(, xrefs: 019923A3

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID: a%($a%(
API String ID: 0-2631209451
Opcode ID: 723a5f9424a5d31423dcaf446cff3252fdd333786763383c40d098ad360c8cbd
Instruction ID: 56efeb61475b0035dfcd59f455c1e7c094c49ceeeab702acdaee208806b7c8f9
Opcode Fuzzy Hash: 723a5f9424a5d31423dcaf446cff3252fdd333786763383c40d098ad360c8cbd
Instruction Fuzzy Hash: B8510B74D052589FCB58CFAAC9406DDBBF2FF89310F14C1AAD409AB218DB305A95CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01992FE9, Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389560e71d2172d1f8f7dd4229c68336f191366c843ef1de0fac7530d70b59f9
Instruction ID: 4066b9fe4dd1c2bcaeda85bdd14ce71bb48439553ddb523db1f6488e0ce3a887
Opcode Fuzzy Hash: 389560e71d2172d1f8f7dd4229c68336f191366c843ef1de0fac7530d70b59f9
Instruction Fuzzy Hash: 2CF160B4D0524ADFCB14CFB9C4858AEFBB2FF89310B14C459D515AB265D334AA42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 019930D8, Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d14fd3bddb0372ccb483fed420b9e24a406c0bf74070f83c065cbcb32bf108
Instruction ID: 865d34c050a76fd7699f0f654656d4457230d2b3ece41ce3fe95ea57ad15930b
Opcode Fuzzy Hash: 13d14fd3bddb0372ccb483fed420b9e24a406c0bf74070f83c065cbcb32bf108
Instruction Fuzzy Hash: 0CD13CB4D0520ADFCB14CFA9C5818AEFBB2FF88310F149955D51AAB325D734AA42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 03310026, Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f74bc2948666866522ad6ec9f5cef0a3e8257d2647314441681fa86753689e
Instruction ID: b3a16f55888bbe3658680a76e380a9b0b2f2c8215d8cc4b9dbb36096f1d33124
Opcode Fuzzy Hash: d2f74bc2948666866522ad6ec9f5cef0a3e8257d2647314441681fa86753689e
Instruction Fuzzy Hash: 2DB123B4E05209CFCB08CFA9C9819DEFBF6BF89300F14D46AD405BB254D73899828B64

Uniqueness

Uniqueness Score: -1.00%

Function 03310040, Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ca886ee8f65512bc599532fb5ccee329cedda0e3cc4204abdff9e62187c0a82
Instruction ID: 3bc4f322b77b5b653695a838f428a05356f8f68893eac77f1d089507dcb9a815
Opcode Fuzzy Hash: 7ca886ee8f65512bc599532fb5ccee329cedda0e3cc4204abdff9e62187c0a82
Instruction Fuzzy Hash: B4B113B4E05209CBCB08CFE9C9859DEFBF6BB88300F14D466D405BB354D73499928B64

Uniqueness

Uniqueness Score: -1.00%

Function 01991241, Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 756a7929ec19ae1eb7557e9822632b8142d1311c98264a2629fde5dc4662a4c9
Instruction ID: 7c18263b50036954e167983020a404bcab94191f63996dd1744d5c8425f6d0db
Opcode Fuzzy Hash: 756a7929ec19ae1eb7557e9822632b8142d1311c98264a2629fde5dc4662a4c9
Instruction Fuzzy Hash: 08B12774E1121A8FCB54DFA8D880A9EFBB2FF88310F118569D519AB354DB30AD46CF81

Uniqueness

Uniqueness Score: -1.00%

Function 01990F0E, Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3cfd77f1022b697dd35d4fa8875816e034a8026d77230860cc8369a2484d282
Instruction ID: 3545d353d5b2237d40cf9b0cb7c46a15cdded3e401a95d3d52302965354ab79d
Opcode Fuzzy Hash: f3cfd77f1022b697dd35d4fa8875816e034a8026d77230860cc8369a2484d282
Instruction Fuzzy Hash: 5BA11470E04249CFCB48CFA9C884AEEFBB2FF89310F14846AD519AB264D7359946CF55

Uniqueness

Uniqueness Score: -1.00%

Function 01990F88, Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7865d6fba550885e3eddd2d2fb8043d0be576123718ba1fe8bea1412189b0c7
Instruction ID: 71b27296172cd16f78f8a34911b61accf2d03827477632600d06a8d8e89e191e
Opcode Fuzzy Hash: c7865d6fba550885e3eddd2d2fb8043d0be576123718ba1fe8bea1412189b0c7
Instruction Fuzzy Hash: DB81D374E00219CFCB08CFE9D884AEEBBB2BF88310F10852AD51AAB254D7359945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 033137E0, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 349259eb425e9f1cd1cf8bf7a5ae56f109feb5069e91d534d36b727aa76ddac0
Instruction ID: 4bee59bdf5c1af71d712e56773c738a54d0f9d5b5f8396a3fa7f0bdd414bd8fa
Opcode Fuzzy Hash: 349259eb425e9f1cd1cf8bf7a5ae56f109feb5069e91d534d36b727aa76ddac0
Instruction Fuzzy Hash: 12717B78D16209DFCB08CFA9E5C06EDFBF6AF89321F10A02AE406B7658D37099558B14

Uniqueness

Uniqueness Score: -1.00%

Function 01990472, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9c649cb4a833aa5ca6be20b54d6b9ad12888023a320c60f4d5d0c34ce92d52
Instruction ID: dcf6c373fcd5f83aec1adbbf2e6c68ab706cbc7185f9f3c7f36493f47b96955c
Opcode Fuzzy Hash: 6c9c649cb4a833aa5ca6be20b54d6b9ad12888023a320c60f4d5d0c34ce92d52
Instruction Fuzzy Hash: 1C710674E00219CFDB54CFAAC844B9EFBB6BF89314F18C5AAD518AB215D73099818F52

Uniqueness

Uniqueness Score: -1.00%

Function 03313AC0, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60d0dcf98deebd85071c4a28a6abbbd6f9f6b5acf32ebb76e5e86c12d36c38e
Instruction ID: b0d65951ff15fe0b9aec9c537fe44a2f6abc12354508ba7aaeacaaff57c61f17
Opcode Fuzzy Hash: c60d0dcf98deebd85071c4a28a6abbbd6f9f6b5acf32ebb76e5e86c12d36c38e
Instruction Fuzzy Hash: E8712775E1422A8BCB28CF66CC84BD9BBB6FF98300F1081E6D509A7654EB705E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01991808, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcda4386d3d938386c991a5f6bb1b5030e3f2f7099455a3b6cba0f60cb0f3613
Instruction ID: f48fc41d7dfbbd3ebc926a02eb44d2d892edeb7f4aeb362d829062be1c99f10c
Opcode Fuzzy Hash: bcda4386d3d938386c991a5f6bb1b5030e3f2f7099455a3b6cba0f60cb0f3613
Instruction Fuzzy Hash: 60512874E0920A8FDB08CFAAC4406AEFBF2FF89310F14C46AD519AB255D7349A41CF65

Uniqueness

Uniqueness Score: -1.00%

Function 03313AB0, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac07e750d38534b39f8f5af90a3139773ccffe4bbccebba114a4ce558320cf38
Instruction ID: dda712d43b5780618e3c2bccb04206f34130f2e4cca6fe03ddaa5df1b48443de
Opcode Fuzzy Hash: ac07e750d38534b39f8f5af90a3139773ccffe4bbccebba114a4ce558320cf38
Instruction Fuzzy Hash: 10513C75E5122A8BDB28CF65CD84BD9BBB2FF88300F1486E6D509A7654EB705AC1CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C1185E, Relevance: 2.6, Strings: 2, Instructions: 57COMMON

Download Yara Rule

Strings

zvd, xrefs: 05C11953
o^[', xrefs: 05C11922

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID: o^['$zvd
API String ID: 0-2350971541
Opcode ID: 0ed1dcbd45713b5da6592d1d4de11f7ac05b7173633d5abe76a30c99fc06a7d1
Instruction ID: 95a159c9c48d092aa1924bb1592590f10ff11b4c562640d84db5aa87a58b587f
Opcode Fuzzy Hash: 0ed1dcbd45713b5da6592d1d4de11f7ac05b7173633d5abe76a30c99fc06a7d1
Instruction Fuzzy Hash: 6921ED74A01219CFDB24DF64C898AADB7B1FF89304F1085E9D949AB354DB319E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0331505D, Relevance: 1.6, APIs: 1, Instructions: 149processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 033151BB

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2e51b1a7c5295aa1e8ea214f76160a0903e8698ff7d242e1596c4b68fca191b5
Instruction ID: c6f5ef7d6e7bd9dbfb7481388a0fe5cf6008cf952302aad21d0db24e5758855c
Opcode Fuzzy Hash: 2e51b1a7c5295aa1e8ea214f76160a0903e8698ff7d242e1596c4b68fca191b5
Instruction Fuzzy Hash: E9512671901319DFEF64CF99C880BDDBBB6BF89314F1480AAE908A7210DB355A99CF51

Uniqueness

Uniqueness Score: -1.00%

Function 03315068, Relevance: 1.6, APIs: 1, Instructions: 143processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 033151BB

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 094c29b00817d875ccc186b4fd1ec07ea849967e2bc6c850294e74db328a9cfc
Instruction ID: ceedba0d47cd475889f0754db299d94d52cceca38890e0f01792b204c10cda2c
Opcode Fuzzy Hash: 094c29b00817d875ccc186b4fd1ec07ea849967e2bc6c850294e74db328a9cfc
Instruction Fuzzy Hash: 06511771901318DFDF64CF99C880BDDBBB5BF89304F1480AAE908A7210DB755A99CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01999FE8, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 0199B5C9

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6cb5b4031ceeb47d546840e2376c1144ee0707d8ecbd381adf5dcab2d0f00b3c
Instruction ID: a22b40927b90fa2b7fad2d650044d5abfb9f952478238afb369cefd8abdfbb4d
Opcode Fuzzy Hash: 6cb5b4031ceeb47d546840e2376c1144ee0707d8ecbd381adf5dcab2d0f00b3c
Instruction Fuzzy Hash: 7941EDB1C0061CCBDF24CFA9C884BCEBBB5BF88304F24806AD409AB251DB756946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0199B50D, Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 0199B5C9

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a9ac94b9e0c01429e191fb8a88f15a45039e070b2c5086838a926bfb51f4a104
Instruction ID: 6e41206581c03b9e6aa2b09cd521a11157967aa227d2216b3727ac81afccb72e
Opcode Fuzzy Hash: a9ac94b9e0c01429e191fb8a88f15a45039e070b2c5086838a926bfb51f4a104
Instruction Fuzzy Hash: AC41EEB1C00619CFDF24CFA9C884BCEBBB5BF88304F24856AD409AB251DB756946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 03315D50, Relevance: 1.6, APIs: 1, Instructions: 67injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 03315DE5

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c2c74bd8c55b79a65d7c4db5fb0206f7ee4db0ceb43b39f3b801cba8246915e6
Instruction ID: db42d1c791894a7479c93432abc4e08291791214b1c67745de8dbb4c8a8ab347
Opcode Fuzzy Hash: c2c74bd8c55b79a65d7c4db5fb0206f7ee4db0ceb43b39f3b801cba8246915e6
Instruction Fuzzy Hash: 9D2100B5900259DFDB04CF99D885BDEBBF4FB49320F00842AE918A7250D778A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03315D58, Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 03315DE5

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5247950407aaa229a8f35e3c38329b25cd51f8045b911089b14ce69321a25521
Instruction ID: aaefdcac084aec5e560145390de8800e0869e7f46356c8e88e1924dcb63c81b3
Opcode Fuzzy Hash: 5247950407aaa229a8f35e3c38329b25cd51f8045b911089b14ce69321a25521
Instruction Fuzzy Hash: C52100B19002499FDB14CF9AC884BDEBBF4FB89310F00842AE918A3250D778A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03315A01, Relevance: 1.6, APIs: 1, Instructions: 60threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 03315A7F

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: e628a068f332e28d7bb1cae73eea8121daff559958abc9f866ec46498f70e9c4
Instruction ID: eac4db305ddda0ad0b8b0cee7154223474d5ac2477590530208b2d097cd6b8ca
Opcode Fuzzy Hash: e628a068f332e28d7bb1cae73eea8121daff559958abc9f866ec46498f70e9c4
Instruction Fuzzy Hash: 852147B5D0021A9FDB04CF9AC985BEEFBF4FB49320F04812AD418A3640D778A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03315AC0, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 03315B47

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 9d1956dd22a454d4566cf8655020d1efa3d77f60b16792ffff3a27479d975edc
Instruction ID: 293d1247ba0d260c2305a9046bc118ca0353df1f08c89501a4b4b1a0bdc908c2
Opcode Fuzzy Hash: 9d1956dd22a454d4566cf8655020d1efa3d77f60b16792ffff3a27479d975edc
Instruction Fuzzy Hash: DA21F3B5900249DFDB10CF99D884BDEFBF4FB48310F00852AE518A7250D338A655CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03315AC8, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 03315B47

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: cd031b3f101defd14484f422e02ede3cabb6d3a17bab3ff6d60b5a0c74dc19b6
Instruction ID: 70480b90f4d7f55a14bfcf08cb4364c9481d5140d34938f423186b7f60587189
Opcode Fuzzy Hash: cd031b3f101defd14484f422e02ede3cabb6d3a17bab3ff6d60b5a0c74dc19b6
Instruction Fuzzy Hash: 4B21E2B5900249DFCB10CF9AD884BDEFBF4FB49320F10852AE918A7250D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03315A08, Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 03315A7F

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 44181575379f5c893acf299391fe68128d40d366084b7534381475f98cc782d0
Instruction ID: 1b3be41b59e6905cb49da1b58849558ad228139f18670ed67884f0e42289562d
Opcode Fuzzy Hash: 44181575379f5c893acf299391fe68128d40d366084b7534381475f98cc782d0
Instruction Fuzzy Hash: 652117B1D0061A9FDB04CF9AC885BDEFBF4FB49324F04812AD418A7240D778A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0199E948, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0199F889,00000800,00000000,00000000), ref: 0199FA9A

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2701792a2c5638e6436d19181fe96379c31778613f436f725722c8c5df40ff28
Instruction ID: 4bc0cfd1fb8454e386f771cb9f8f636a240d46d397da2a06f1a51308364735b7
Opcode Fuzzy Hash: 2701792a2c5638e6436d19181fe96379c31778613f436f725722c8c5df40ff28
Instruction Fuzzy Hash: 241114B69002098FDF14CF9AC444BDEFBF8EB89324F14842AD919A7210D379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 03315B91, Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 03315C03

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a3596da2a7ea27ae18d8b8ccdc3a426e3ba482952b0f7b667ecc2c5530ea7a42
Instruction ID: ccbc28109dbdd4055bbffc6fad1df71c5ed283b1e6e4d35d3069f049f33fd27e
Opcode Fuzzy Hash: a3596da2a7ea27ae18d8b8ccdc3a426e3ba482952b0f7b667ecc2c5530ea7a42
Instruction Fuzzy Hash: B411F5BA900249DFCB10CF99D984BDEFBF4FB49324F14841AE529A7650C335A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03315B98, Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 03315C03

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c85fb3c34e67622dfb647053ccde34ede25d84f1e2e16a598c1578a5b69bcad5
Instruction ID: 7a1a204f9679e5275cc608a11ed6e62df1b2bc0c08ae6e5e343afe5f9bab8784
Opcode Fuzzy Hash: c85fb3c34e67622dfb647053ccde34ede25d84f1e2e16a598c1578a5b69bcad5
Instruction Fuzzy Hash: A311FEB6900249DFCB10CF9AC884BDEFBF8FB89324F148419E529A7250C775A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0199F7A8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0199F80E

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a7448b204012196d319c7cbd6798b7d42ded0eb6546ce70527e8e5b37a60dfa4
Instruction ID: 6b5801c563bf55c437a3dc1d817e957e47f7a10d8de3144661df1e1f4a90de8d
Opcode Fuzzy Hash: a7448b204012196d319c7cbd6798b7d42ded0eb6546ce70527e8e5b37a60dfa4
Instruction Fuzzy Hash: 0E110FB5D002498FDB10CF9AC444ADEFBF8AB88324F10852AD819A7200C374A545CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 03315F08, Relevance: 1.5, APIs: 1, Instructions: 45threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 03315F6F

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2f8b3edbcce8fb7205bd0a20fe5407d764ebf6bb7147c1d5db198cfa18083198
Instruction ID: 4ea607ad2eb0a860230e67015b51beaf9641dc2a1813ad412de4b307ee578f13
Opcode Fuzzy Hash: 2f8b3edbcce8fb7205bd0a20fe5407d764ebf6bb7147c1d5db198cfa18083198
Instruction Fuzzy Hash: 781112B5900209CFCB10CF99D589BDEFBF4EF89324F10851AD519A7650C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03316228, Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0331628D

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d7f4d5737aefd1c94800130768e4f84b4d248d09195ae8166520778246055f60
Instruction ID: ac147c0b4152a981604a70618d4e7fe36522e774317ce0de99a41b9224ea4488
Opcode Fuzzy Hash: d7f4d5737aefd1c94800130768e4f84b4d248d09195ae8166520778246055f60
Instruction Fuzzy Hash: B91100B5800209CFCB10CF99D985BDEFBF8FB48324F10841AD959A7600C378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03316230, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0331628D

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a83cb952f27a42abf0fde83c32428d6df0087767b6882cd541517289295eb95c
Instruction ID: dd2599fe3413b4f2317aac12380f8b0c6ba5d2222b94e63c3e6368c4df9778e0
Opcode Fuzzy Hash: a83cb952f27a42abf0fde83c32428d6df0087767b6882cd541517289295eb95c
Instruction Fuzzy Hash: D911E2B58003499FDB10DF99D885BDEFBF8FB59324F14841AE914A7600C379A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03315F10, Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 03315F6F

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ac39e66a6c20a4358c94ecdb7741c6a15ed926a32c686ea2bd8f08d185395d10
Instruction ID: 9c1a81961d95be747ef13da2a6866d9b2dfc3fd2634a7d282ba8da2caacd9192
Opcode Fuzzy Hash: ac39e66a6c20a4358c94ecdb7741c6a15ed926a32c686ea2bd8f08d185395d10
Instruction Fuzzy Hash: 8C1120B5800249CFCB10CF9AC888BDEFBF8EB89324F10851AD518A7250C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05C11F76, Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

Y*%R, xrefs: 05C11F88

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID: Y*%R
API String ID: 0-3473783869
Opcode ID: 8da20d3a4f65566ca11991c56cdc49000a4b1efc281b7abb115629426d0c5c75
Instruction ID: a3a57df1450272f8d082ce6f2fe9e0bc6f4b9331822269610aff90cc34f70c88
Opcode Fuzzy Hash: 8da20d3a4f65566ca11991c56cdc49000a4b1efc281b7abb115629426d0c5c75
Instruction Fuzzy Hash: 09F0A574A04215CFCB54DF58C989A99BBF6EF49305F1445D9E40DAB325D734AE80CF00

Uniqueness

Uniqueness Score: -1.00%

Function 05C1AED8, Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6d9e41b7143f634e58ccf8e57f73b08a0d68639aaa8560f288b603a25a9473
Instruction ID: 62c566ea6527978d236ad6e7df076af2a68c2332b5b4ede34cd5712cc1a4525c
Opcode Fuzzy Hash: cb6d9e41b7143f634e58ccf8e57f73b08a0d68639aaa8560f288b603a25a9473
Instruction Fuzzy Hash: 4542E931E10619CBCB15DF69C8846EDB7B1FF8A304F118A99D859BB211EB30AE85DF44

Uniqueness

Uniqueness Score: -1.00%

Function 05C13B78, Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81d4bf9b99c93e462e005e4386923ef940e3defa93e39f34e1658a068be94e1
Instruction ID: 1af953471cd4de53700ca7bba6b0c55963412e1bca2b71dc83d098342f14a469
Opcode Fuzzy Hash: c81d4bf9b99c93e462e005e4386923ef940e3defa93e39f34e1658a068be94e1
Instruction Fuzzy Hash: 96917035B102018BDB04EF29D4987A9B7A2FFD9304F558978E80AAF355DF75AC84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C1FD70, Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f9d1c28d22fa380fa443dc4c01da6509ab9792d4be3d2b788d4a4e8a7052ce
Instruction ID: 32e1332b111412eba40f71af1e49628b0f603f225bded6fa7c402945259f8678
Opcode Fuzzy Hash: 47f9d1c28d22fa380fa443dc4c01da6509ab9792d4be3d2b788d4a4e8a7052ce
Instruction Fuzzy Hash: E6911A7591070ADFCB01DFA8C880999FBF5FF49310B14879AE819AB215EB70E985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05C1CBC0, Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc89d7ef0282a9e7e7a1fd7e88c964ffc0c6c690eba8cb0240447aa9e372e60
Instruction ID: 43561d68665e7d6a853fc4e4b539be676a95146835f697e2e6417af90afd233f
Opcode Fuzzy Hash: 6bc89d7ef0282a9e7e7a1fd7e88c964ffc0c6c690eba8cb0240447aa9e372e60
Instruction Fuzzy Hash: CE71ABB9700A008FC718DF29C59895ABBF2FF8960571589A9E54ACB372DB72EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05C1C5D0, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38ae5121f87aba4c85c3b758cd42f13fca8c7179bf45fd437573d387dfdc255
Instruction ID: 9487d9d147f82dde6da63bab868d5471e980c9a2d6de9b04f9361d73bd31047c
Opcode Fuzzy Hash: f38ae5121f87aba4c85c3b758cd42f13fca8c7179bf45fd437573d387dfdc255
Instruction Fuzzy Hash: 2671BEB4A042068FCB04CF69D580999FBF1BF4D314B498AA9E80ADB312D734ED85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05C154C8, Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58d87c1c9287e3f482d607a2928cbb4c77feda31ecc13930044da194b5e517f8
Instruction ID: de18751f3e2e4c71b6a089339df4e37b27c473cc02dc3da7e2e99820a680e299
Opcode Fuzzy Hash: 58d87c1c9287e3f482d607a2928cbb4c77feda31ecc13930044da194b5e517f8
Instruction Fuzzy Hash: 10519F31A042098FCB15EBA4D4946BEBBF6FFC6304F548929E406AB350DF749986DB81

Uniqueness

Uniqueness Score: -1.00%

Function 05C16AB1, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29cece41a8e124148d42c9056428858401725707f8c9c202fd8b69ebf1a6bc93
Instruction ID: 9acb9f8fbf5fb49ee63194ec8edab3f7680a3497a26b17ff778b9d4a2b69de0e
Opcode Fuzzy Hash: 29cece41a8e124148d42c9056428858401725707f8c9c202fd8b69ebf1a6bc93
Instruction Fuzzy Hash: E371AD78A01208AFCB14DF68D584DAEBBB2FF89314F114498F901AB761DB31ED81DB50

Uniqueness

Uniqueness Score: -1.00%

Function 05C176E8, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db6e729290d9959f125a1008be1d0caf160d0755e96a674862ef74ecde1771a5
Instruction ID: ab1b947ee514bdf0cd716e4ef9312fa2a024f1e7c2d4ce10d858082c0fdcef44
Opcode Fuzzy Hash: db6e729290d9959f125a1008be1d0caf160d0755e96a674862ef74ecde1771a5
Instruction Fuzzy Hash: 1A51C534B106098FCB04DF68C8989ADBBF5FF89704F1585A9E506AB371EB71AD45CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05C16F10, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7521229c8e59d275e32c0752dd0aec637fe219709e453291a47d6792e8f3119
Instruction ID: 7deead7420e75c1ff94bd49097c0bc899d66a5afd15bda6ef998c2b8668c8f3a
Opcode Fuzzy Hash: a7521229c8e59d275e32c0752dd0aec637fe219709e453291a47d6792e8f3119
Instruction Fuzzy Hash: AA415E34B142548FDB10DB6AC894EADBBF6FF8A740F1544A9E901EB3A1CA31ED40DB14

Uniqueness

Uniqueness Score: -1.00%

Function 05C15B20, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f052df5e3d66c07495cb3c79d99fb3f8d58c40cc07368571ad9e2b234780be
Instruction ID: 1dc7c9858e4047a77bd47fe6729f14f72f617c2c8b1e91bfff7481de0cecb974
Opcode Fuzzy Hash: 09f052df5e3d66c07495cb3c79d99fb3f8d58c40cc07368571ad9e2b234780be
Instruction Fuzzy Hash: F1510C75A02209AFDB14DF94D595BAEBBB2FF89310F208459E905AB350CB31AD40DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05C152A0, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f313a7b546dafdeeb5b2cb14fac0d4e376cac12e0f1ae6d65a2147e9f67395
Instruction ID: 3baa4bb4e76716709ee8fa1f3ac1aba291b3e047d72442c430ca64cf552d873a
Opcode Fuzzy Hash: 71f313a7b546dafdeeb5b2cb14fac0d4e376cac12e0f1ae6d65a2147e9f67395
Instruction Fuzzy Hash: 27410A34A042188FDB44DFA8D858B9DB7F1FF89305F114469E906AB3A1C779AD41CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05C15020, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a73fda18afc7745b37b67d56579a7323cd281df4bac6cf3ce7490ec0eb743341
Instruction ID: 07d637e236cc7073b91d5c08168cc4dd2d8d854606d00f34b5495058882b378d
Opcode Fuzzy Hash: a73fda18afc7745b37b67d56579a7323cd281df4bac6cf3ce7490ec0eb743341
Instruction Fuzzy Hash: 82414C34A00209CFCB65EF68C59499EB7F2FF89304F508869D50AAB360DB72AD40CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05C183E8, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83678bccf8a516323ffe94b8dff682daa0c00ac97d5fd4d3aba8930f985ef9da
Instruction ID: 07c37992701a7942d7e4d03d4c665ceee14671fdee7467efe3439cfc6887b762
Opcode Fuzzy Hash: 83678bccf8a516323ffe94b8dff682daa0c00ac97d5fd4d3aba8930f985ef9da
Instruction Fuzzy Hash: FA414830B04218DFCB15DBB9D8946ADBBF2FF4A304F104929E906E7350DB359A41DB98

Uniqueness

Uniqueness Score: -1.00%

Function 05C15F5C, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa3731517e17c65bad04c81e33bdc7ce539a59e92de35ea6979fd89e56a837c
Instruction ID: 01ec0f510f6af252f8c20f8f0ff3faea9c009201f4c93ecc2f300a8589c791b5
Opcode Fuzzy Hash: eaa3731517e17c65bad04c81e33bdc7ce539a59e92de35ea6979fd89e56a837c
Instruction Fuzzy Hash: 83412134A10709CFCB14EF78C494ADEBBB6FF89304F018959E5156B324EB71A946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05C1C5C0, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a648b25c9791d647143310b1bec78696061d3e933f1f0b393f7c6bb077d663
Instruction ID: 0bb47f9f8e6ebf1c1a069a419f71f59e15cbaac6ed0ed9b6017e92f1f5c7e273
Opcode Fuzzy Hash: 20a648b25c9791d647143310b1bec78696061d3e933f1f0b393f7c6bb077d663
Instruction Fuzzy Hash: 9D411774A44206CFC714CF29C584AA9FBF1FF4A314B198AAAE84ADB351D730ED45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 05C19770, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd42101a6aeaa28d40cd82791ad23a1f83da44ce9c96faabcd9d41dead70180b
Instruction ID: 1835a1ae7806390966524db33546666d6485a2b2be0e7db1d6a525206c9fae3f
Opcode Fuzzy Hash: bd42101a6aeaa28d40cd82791ad23a1f83da44ce9c96faabcd9d41dead70180b
Instruction Fuzzy Hash: C741E875A0020ADFCB40DFA9D88499EFBB5FF49314B14C699E918AB311E730E945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05C160AC, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21feefc25e662a44f0aca87ccbc2fff22b94d7f5649e618449a32ae365b52b3e
Instruction ID: c737351621f8690974d81f4876bd0659101c59d023c542332dbd5159758c930e
Opcode Fuzzy Hash: 21feefc25e662a44f0aca87ccbc2fff22b94d7f5649e618449a32ae365b52b3e
Instruction Fuzzy Hash: 1331D331A08305CBEB04EF69D4846657BB6FF99310F188A79EC0A6F205EF309880CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05C1BA68, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1187d61f4b02bf5fdb8263058c5af94d89865400eccf2712f1b80dd6c6fa429b
Instruction ID: 484bf44e48e95a569470803d5db3f3914c826ff5dd5a9465bfa534bd34f5bc99
Opcode Fuzzy Hash: 1187d61f4b02bf5fdb8263058c5af94d89865400eccf2712f1b80dd6c6fa429b
Instruction Fuzzy Hash: 83318B35B11218DFCF14EB64D8448DDF7B6FF89214B048669E90AAB320EB31AD46DBC4

Uniqueness

Uniqueness Score: -1.00%

Function 05C1839C, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095752ef88e4b3208a255f9c26beaa7ce80408d9c34fbe2de31565cf0a425fac
Instruction ID: bd686b5d948b8c2b192555ce267d55b7a65fe0990088c2c7f0300d4b9f5b3b3d
Opcode Fuzzy Hash: 095752ef88e4b3208a255f9c26beaa7ce80408d9c34fbe2de31565cf0a425fac
Instruction Fuzzy Hash: EC21A2323152018FD3589F2DDC846693792FF86221B19847AE41ACF3A2DA74DC118B94

Uniqueness

Uniqueness Score: -1.00%

Function 05C18030, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ff7a7f82a60ed8f1394cfca161a4821f9cc38813ceb459cfefef58f386ef0a2
Instruction ID: 08761146f2d584384599e76b2d2162c18614954d1268d2dd59d0bcb8a0b037c7
Opcode Fuzzy Hash: 5ff7a7f82a60ed8f1394cfca161a4821f9cc38813ceb459cfefef58f386ef0a2
Instruction Fuzzy Hash: 75216B3170B2259FC721A73888505BE7BE5FFC2A00705089BEC0B9B751CB289C11D7DA

Uniqueness

Uniqueness Score: -1.00%

Function 05C1CF10, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b1fd54077023ebe687f3bf919174abd34a37669d75ac65cbdcedcba94ee578
Instruction ID: a5e9067f57cfe63b1694e3a8546957714d42f9b1b8e8a2fdf8cdb62905b9d190
Opcode Fuzzy Hash: f4b1fd54077023ebe687f3bf919174abd34a37669d75ac65cbdcedcba94ee578
Instruction Fuzzy Hash: 91314B35A442198FCB11DFA8E454AEDBBF5FB8E309F104865E805F7240DB389E00DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 05C142D0, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5358490cb9edd90baa5a2846c1ae8a600240263cbf8f12a04766bf5f293932d8
Instruction ID: 0f0cca48d5d3150a6dca9ca101d5d7aff37e6c37693700491144e07f6a8622fa
Opcode Fuzzy Hash: 5358490cb9edd90baa5a2846c1ae8a600240263cbf8f12a04766bf5f293932d8
Instruction Fuzzy Hash: CA310532D10B0ADECB01EF68C854499FBB5FF95300B119B59E5596B121FB30E6D5CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0190D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306330590.000000000190D000.00000040.00000001.sdmp, Offset: 0190D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f64d1e594726f028706209dc5b0ead66212e2c1fdf29e9904dffbce24988d6
Instruction ID: a5f21774b81b9d3e8c53c4a9491c27b6a68dff3bd3e766ea390f80551b398745
Opcode Fuzzy Hash: 55f64d1e594726f028706209dc5b0ead66212e2c1fdf29e9904dffbce24988d6
Instruction Fuzzy Hash: AD21F571504300EFDB06DFD8D5C4F26BBA5FB84324F24C969E80D4B286C736D856CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0190D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306330590.000000000190D000.00000040.00000001.sdmp, Offset: 0190D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f98b3cb1c6f66167b1e6a3e93ceb748b47434aff52a4d0c68c0d199484529ef6
Instruction ID: d42cc5c7000dbeb0aa7dcfbbcaeea5419d83dc4df6de7b2f2c06c74b651b28dd
Opcode Fuzzy Hash: f98b3cb1c6f66167b1e6a3e93ceb748b47434aff52a4d0c68c0d199484529ef6
Instruction Fuzzy Hash: 0B21F571504240DFDB16DF98D9C4B16BBB9FB84364F24C969D80D4B286C737D847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 05C17CF8, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de461b2978e38bad5c5e9c8f55ffa6cfeb1b8ff73299368c3fb6ea0337551001
Instruction ID: ea4ec000b764fae16fcef507afd6cb6c568f40cb2f58de924ed20ec435035333
Opcode Fuzzy Hash: de461b2978e38bad5c5e9c8f55ffa6cfeb1b8ff73299368c3fb6ea0337551001
Instruction Fuzzy Hash: F12129303002048FCB58EB39C454A2A73E6FF86759B1188ADEA06CB7A0DF75DD42CB55

Uniqueness

Uniqueness Score: -1.00%

Function 05C17A20, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e7ebb18af4cdf16e0a4babd6f9e26717971b26f072670d92c2bcd0ede10510
Instruction ID: 355092b97fd382d7ac96c1ba647fea318f02da9f3c263807eb5d025ce0d00b87
Opcode Fuzzy Hash: 62e7ebb18af4cdf16e0a4babd6f9e26717971b26f072670d92c2bcd0ede10510
Instruction Fuzzy Hash: DE11D231F006168BCB20EAB9C4405BEB7F2EBCA610F14892AD906A7300DA389B4197C9

Uniqueness

Uniqueness Score: -1.00%

Function 05C1607C, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c1a53e6960f17c0c64a2f60ff3e86e7397b58a0805cbec654dd33a4caaf11b
Instruction ID: cce4c4a61daaa80bc5f9e0e5f591118b07face53ce6e048fdc81a6ab7cd4286c
Opcode Fuzzy Hash: b4c1a53e6960f17c0c64a2f60ff3e86e7397b58a0805cbec654dd33a4caaf11b
Instruction Fuzzy Hash: AA217F30604705CFCB24EB74C454BAAB7B3EFC6305F014CADD55A5B261DB31A942DB81

Uniqueness

Uniqueness Score: -1.00%

Function 05C17EA8, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72be3cc99b137e90d4331880513c00a45db016fc0753efd154d41c3a9d3b3318
Instruction ID: 5691c806e990f6b64a08ca292bd537c65f04a44fc19a763b46eb5915adbddc10
Opcode Fuzzy Hash: 72be3cc99b137e90d4331880513c00a45db016fc0753efd154d41c3a9d3b3318
Instruction Fuzzy Hash: 2A216D75A0430ACFCB25DF60C08489EBBB2FF453047108A69E9569BA51D735B946CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05C1D440, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caeec502eee7d7295f87061d149c31954345011e0c2198555cef377e18cd9b18
Instruction ID: 4eb6adb876af7e7a03b31d255b5eea3b6cfd75fcbec4e56891feacd27c6f0727
Opcode Fuzzy Hash: caeec502eee7d7295f87061d149c31954345011e0c2198555cef377e18cd9b18
Instruction Fuzzy Hash: B611BF74A002059FCB14EBA5D014BDEBBF2EF89309F504868D906AB280CB355D05DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0190D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306330590.000000000190D000.00000040.00000001.sdmp, Offset: 0190D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed38130cc456892f0caa2b8aedfe38c2b09f5093f4f2c6b79a667aa289cdca40
Instruction ID: 9cfecc83f1d0b719d541ea8264d18b2c06b7597442d9dd32738f4ce24b323c1c
Opcode Fuzzy Hash: ed38130cc456892f0caa2b8aedfe38c2b09f5093f4f2c6b79a667aa289cdca40
Instruction Fuzzy Hash: 99118E75504280DFDB12CF94D5C4B15BBB1FB44324F24C6AAD84D4B696C33AD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0190D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306330590.000000000190D000.00000040.00000001.sdmp, Offset: 0190D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed38130cc456892f0caa2b8aedfe38c2b09f5093f4f2c6b79a667aa289cdca40
Instruction ID: d71f582be1fe579b56a099835825b35166af596d088dab94dd7ad2d50626dc59
Opcode Fuzzy Hash: ed38130cc456892f0caa2b8aedfe38c2b09f5093f4f2c6b79a667aa289cdca40
Instruction Fuzzy Hash: 2611BB76504280DFDB02DF98C5C4B15BBA1FB84224F28C6AAD8494B696C33AD44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 05C1D430, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3815682ed90555ffa82eb2a3441dae2d3c99f610d5b51dee478901138cf75e9
Instruction ID: 41db1024417a347aba4a06067087f39f38f405cbddf44eb13d3219d5f5b999bc
Opcode Fuzzy Hash: c3815682ed90555ffa82eb2a3441dae2d3c99f610d5b51dee478901138cf75e9
Instruction Fuzzy Hash: A401D6746043059FDB14EBA5D419B9EBBF2EF89304F908828D907AB780DF355905CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 05C175A1, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c59375437120696c6ed61aaac601da009856cdefa973950adab20287b3c69d40
Instruction ID: 9270f2f90ce20292c2a3328b9127b35cb84888f67a27da87caaa2fc6a97e04d8
Opcode Fuzzy Hash: c59375437120696c6ed61aaac601da009856cdefa973950adab20287b3c69d40
Instruction Fuzzy Hash: D5014F327145158FC714DB3ED844D5AB7EAEFC9A2031580BAE50ACB772DA71DC028B94

Uniqueness

Uniqueness Score: -1.00%

Function 05C1CE58, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70cc9f2a550c977b77aceb09e1b32b41279a79724f8dc5c4a061aa8db39e5d19
Instruction ID: 5e7ea32f8c0a0e93e2da4326fde1e0887d6031535e177c2b4d3fdb6e8f17760d
Opcode Fuzzy Hash: 70cc9f2a550c977b77aceb09e1b32b41279a79724f8dc5c4a061aa8db39e5d19
Instruction Fuzzy Hash: E201D6326C82055EDB20EAA9A4007AB7BE9EF52165F40086BE909C6681EF319D44979D

Uniqueness

Uniqueness Score: -1.00%

Function 05C1DD30, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fca18d15865ea90400891c826ccb5bde720286b44d3a86ad76d41781e8a03a0
Instruction ID: cb07eba5e2430331bfcd407db652319b7d66c6642663ff3d541d72aa39bbdd9e
Opcode Fuzzy Hash: 5fca18d15865ea90400891c826ccb5bde720286b44d3a86ad76d41781e8a03a0
Instruction Fuzzy Hash: 4001B174A001599FDB049F68D808AAFBFBAFF8D305F108529E506AB384CF759C04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05C13240, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78465349a9bbb1754a94c0425fad8672f533ad6080cd9fe21b7ea3a5125872ec
Instruction ID: 9b8d851c0d0eed4d9dbe8f795970a8ceb9ce41383e03a176301ae11490fc5e7e
Opcode Fuzzy Hash: 78465349a9bbb1754a94c0425fad8672f533ad6080cd9fe21b7ea3a5125872ec
Instruction Fuzzy Hash: 2B21FC74A002598FCB65CF54C884BAAB7B6FF89304F0541E8EA0D6B364DB319E81CF21

Uniqueness

Uniqueness Score: -1.00%

Function 05C1BDA8, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e48537c3643408cc32a654b71cfab6d23177844daa65a6fa0a66ebcf01926625
Instruction ID: aa3c3659b6bf67bffcf32186fd9049b970cfaa9b689d7cb611fea6814aa26edb
Opcode Fuzzy Hash: e48537c3643408cc32a654b71cfab6d23177844daa65a6fa0a66ebcf01926625
Instruction Fuzzy Hash: B6014C30600B08CFC729EF39C45455A77F6BF86304B50C96ED9468B260EB30EA81EF84

Uniqueness

Uniqueness Score: -1.00%

Function 05C17981, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ec53ad1c2b702a8a9972b4a4a528e3b6875151a71ff48d445aeb4da1a9ab3a
Instruction ID: 4747e190bfffa03b68d71e43ab09745fbeb40a13a8e32a4cc650813c94a50c42
Opcode Fuzzy Hash: b4ec53ad1c2b702a8a9972b4a4a528e3b6875151a71ff48d445aeb4da1a9ab3a
Instruction Fuzzy Hash: F3018134714104CFD7049B29D898D297BFAEF8A625B2981BAE50ACB371DE60DC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05C1837C, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cc77f871841a85ca52b165ab4d7d84b493ff6cb8d92246ed8ad76dc6131c84
Instruction ID: a31ce07df4428f56d6ac29d7df367c23f4bd0042e0dba2aa3f5f614f6f6bef19
Opcode Fuzzy Hash: 97cc77f871841a85ca52b165ab4d7d84b493ff6cb8d92246ed8ad76dc6131c84
Instruction Fuzzy Hash: 59F0963030A2118B8614D52A9854B3A37DBAF8655178D1C29EC07C3690DE10DD41F6D9

Uniqueness

Uniqueness Score: -1.00%

Function 05C1A0C8, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78c593e992c7f8bc365c1b988ce083cf593994a2172505a752ade8d73d6e91f
Instruction ID: 8f70b90b13cd6a65c113e9e20ac83e41468028ea118d4ca6ca1122e67a35ec85
Opcode Fuzzy Hash: b78c593e992c7f8bc365c1b988ce083cf593994a2172505a752ade8d73d6e91f
Instruction Fuzzy Hash: 5DF0F63A3106108FC728DA39C84486A33A6FFCA711B2949EAE813CB365CA35DC41D784

Uniqueness

Uniqueness Score: -1.00%

Function 05C145B8, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1767de75a54f68bf92226558525af7d4a6db5d3f58d716010f40335efd2955e
Instruction ID: 291fc1448d646ac9753d5eddaa91cb2f894179b9f48e9e2333461bebad480b77
Opcode Fuzzy Hash: c1767de75a54f68bf92226558525af7d4a6db5d3f58d716010f40335efd2955e
Instruction Fuzzy Hash: A5F0F6327046149BCB166B28D4488BEBBAAFFC9312B04412EF90EC7310DF3589C1C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 05C13AF0, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ed99f8d623840fe193d1f6905ac92298e23b92e124a7acdbb31d5210bdeed7
Instruction ID: 2126765fb8e6b5f1868381659c12fa8b790a28469f8c79df1bbfc071e556e4ad
Opcode Fuzzy Hash: a3ed99f8d623840fe193d1f6905ac92298e23b92e124a7acdbb31d5210bdeed7
Instruction Fuzzy Hash: 36F096303507240BE758A6288469BBEB2966FC5F04F00841DE90B9B3D1CEA5AD41C3E8

Uniqueness

Uniqueness Score: -1.00%

Function 05C1C188, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50fb848f1044da61dd3fa66727c9d966465955e4a0dc7e9fa24dd60f96cd4655
Instruction ID: 64f3deabfcdd830d8fd758ad8fcbf96a66d27a3c0f79523ebf1adc4cb76bd374
Opcode Fuzzy Hash: 50fb848f1044da61dd3fa66727c9d966465955e4a0dc7e9fa24dd60f96cd4655
Instruction Fuzzy Hash: CFF068357007048BC7167674CC155AEB7B6EFC2211F144A5DDD4557240DF719641E6C9

Uniqueness

Uniqueness Score: -1.00%

Function 05C1C510, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 712111ec2f42b03279626d798d83be353a980853d327aa54dadd5baa0d3383ed
Instruction ID: 78e3621f79cb77c228886c4b042c4b9a87da8379ab3536f9999b77060197b11c
Opcode Fuzzy Hash: 712111ec2f42b03279626d798d83be353a980853d327aa54dadd5baa0d3383ed
Instruction Fuzzy Hash: DAF054723447154B8A149E6EF48485EBBEAFFD4225315493AE51EC7220CF71DC0A8794

Uniqueness

Uniqueness Score: -1.00%

Function 05C1A2D8, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c09d1da57b19ddfbf2a194f10f42fe3bf5d09849e923e2336cbdad7ec0f6796
Instruction ID: da0ca3fed1c8141c072bdd05abb3a0c02960a32c1f8784f5a4ea01cdeac08da4
Opcode Fuzzy Hash: 4c09d1da57b19ddfbf2a194f10f42fe3bf5d09849e923e2336cbdad7ec0f6796
Instruction Fuzzy Hash: 9AF082317085108B8B19663A941873D72A6AFCA911B985929DD06CB390DF24CA03B3DD

Uniqueness

Uniqueness Score: -1.00%

Function 05C13575, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 508914ff6469a8a9141dc10571ad03a9d027d609c6fa7b2a9f3eb27f5e5790b4
Instruction ID: ab6869876c31e37f464fcbeddbbb201cc55014bd5c01804079e076818d8f3b49
Opcode Fuzzy Hash: 508914ff6469a8a9141dc10571ad03a9d027d609c6fa7b2a9f3eb27f5e5790b4
Instruction Fuzzy Hash: 3C01D734A002598FCB25DF64C844BAAB7F2FB89308F4544E8E60D6B365CB359E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05C1C568, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81dc86abe551b17b1f377f71a35b925d55653432e1062ff778b475ef93ee86b
Instruction ID: 906ec48e4b04235ce6f0ea8bae03c81fe9503b85179b313912ce70019921a19c
Opcode Fuzzy Hash: a81dc86abe551b17b1f377f71a35b925d55653432e1062ff778b475ef93ee86b
Instruction Fuzzy Hash: 2BF0F435250610CFC704DB28C599E597BE5FF4AB15B1589A9F50ACB372CB72EC01CB84

Uniqueness

Uniqueness Score: -1.00%

Function 05C116A7, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82091127dbc56218a63c434b3de2937127b1808518cd7b1065e70d79cbce1b7
Instruction ID: d8d55c6019e6187849bd3520b1e1427df3db493bb8a8f4bffca651c8624244da
Opcode Fuzzy Hash: d82091127dbc56218a63c434b3de2937127b1808518cd7b1065e70d79cbce1b7
Instruction Fuzzy Hash: 1001D734A45219CFC758DF68C894AAAB7B5FB49300F5081E9E41DA7364D730AE80CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05C1C208, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e637cf0ea0e67eb2543312dad278659dd848548e89ea0ba5a61190079f332b5
Instruction ID: b8e243fe0d20904cd4d69d1e0b36679af6d7da8f63387397dd8ec02299bcf393
Opcode Fuzzy Hash: 7e637cf0ea0e67eb2543312dad278659dd848548e89ea0ba5a61190079f332b5
Instruction Fuzzy Hash: 17F05E313046109FC7349B5AD48492AB7AAFFD9625B14496DF50A87721CB35EC82CB94

Uniqueness

Uniqueness Score: -1.00%

Function 05C196D0, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415a98354f481804678503669b410b367e1382afbbb7bb76b5bfc71221c3715a
Instruction ID: b105c5b1868ae04cfa1ddd1b704dd66ce8f7e3962ddbf292189fdf1a2f6bd757
Opcode Fuzzy Hash: 415a98354f481804678503669b410b367e1382afbbb7bb76b5bfc71221c3715a
Instruction Fuzzy Hash: 4E01B675D10609DFCB40EFACC54489DBBF4FF49210B1185AAE859EB321E770AA44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C10292, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c9eea33fe567a051e40281ec06a97b388805d742118848fe61533e5aebcaec
Instruction ID: 3c71a5761b5483569ee39ca861df58b00545bb9edf85f1640bbaa73642f99f39
Opcode Fuzzy Hash: b1c9eea33fe567a051e40281ec06a97b388805d742118848fe61533e5aebcaec
Instruction Fuzzy Hash: AF01C430A1432A8BCBA5DF64CC806DDF7B9AF94308F5095D9821EA7219DB306F81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 05C107C6, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ac581f62fdb6aa5993a2480c88b0310dfe6ca0e718e2f39b15b3c52535d67a
Instruction ID: 5582edae8b6022c411b3349790921c40367196c596531f94affaec7157af7e9c
Opcode Fuzzy Hash: d2ac581f62fdb6aa5993a2480c88b0310dfe6ca0e718e2f39b15b3c52535d67a
Instruction Fuzzy Hash: 4C01E434A003188FDB54DBA4C884B9EBBB6FB89300F5081E9D90EA7354CB349E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05C175B0, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30c648de285c02011d656de62a9431cd9e143e387b582ec0e1aceff02efb085c
Instruction ID: 71a57e5a0d08b942cd39b79b51009197dec98cfd4b2a84c544f09e468790e9a1
Opcode Fuzzy Hash: 30c648de285c02011d656de62a9431cd9e143e387b582ec0e1aceff02efb085c
Instruction Fuzzy Hash: 88E06D72B006280B8758EB7AA40486BF6DBAEC8610354C47AC50E8B725ED30AD0186D4

Uniqueness

Uniqueness Score: -1.00%

Function 05C1C578, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6be28d61d655706a05f9307f2dc611d79e7757d598719b753b6ca7f09140a63
Instruction ID: b4996bcd7c31e2e75fb86052858621663b4f0a59540c93cdcb2d67f010d050be
Opcode Fuzzy Hash: e6be28d61d655706a05f9307f2dc611d79e7757d598719b753b6ca7f09140a63
Instruction Fuzzy Hash: C0F0BC302506108FC718DF28D588C597BE6BF4AB1931648A9E50ACB372CB72EC40CB84

Uniqueness

Uniqueness Score: -1.00%

Function 05C105E6, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b267ef5d9abd32cae296593a77e6ce826c9ccfe3b80add26ebf5ce0c5fb437
Instruction ID: 8b6367fbc7e227837f38e3dd16da36e590055febdd69646452b14d6f7c690aa5
Opcode Fuzzy Hash: c6b267ef5d9abd32cae296593a77e6ce826c9ccfe3b80add26ebf5ce0c5fb437
Instruction Fuzzy Hash: FFF06D30E146098FCB15DB70C8445ADFBB9FF8A300F4095E9D5886B251EB709B90DF41

Uniqueness

Uniqueness Score: -1.00%

Function 05C111FC, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e3ce9264606f533785fb6e7ed7376950d9d005fdcd68d2e5bdf534c0b47291
Instruction ID: 2cadfc133ddaf42658af5cf98467098dea170b39173b69b1f20756f6f4bd8f84
Opcode Fuzzy Hash: 62e3ce9264606f533785fb6e7ed7376950d9d005fdcd68d2e5bdf534c0b47291
Instruction Fuzzy Hash: 6DF0C974A102198BCB65DFA4D8806DEB7B6BF84308F008AF4D21DA7255D7706EC18F99

Uniqueness

Uniqueness Score: -1.00%

Function 05C11BBF, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d46a8059dc70eb2254e93eb0309a2f77cf5003ab54fa7d9c1b0ed3075011b1
Instruction ID: d7f5158666e4fe78d6f83646526a42bbffed872dca1474d3d64430cfdd8795f8
Opcode Fuzzy Hash: a2d46a8059dc70eb2254e93eb0309a2f77cf5003ab54fa7d9c1b0ed3075011b1
Instruction Fuzzy Hash: BCF0C934A1121A8BDB69DF94C880A9EF7BAFF85304F0099E4D50DAB224DB306F818F51

Uniqueness

Uniqueness Score: -1.00%

Function 05C11D73, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f433566560e2cf66681691748867f4a6e39dba335c9ed502b2fcd6bda4d6210
Instruction ID: 97b48a63c996fd8a75bef583e9f77fa4e002dbdb11f09f8e5e23b777129c7dde
Opcode Fuzzy Hash: 3f433566560e2cf66681691748867f4a6e39dba335c9ed502b2fcd6bda4d6210
Instruction Fuzzy Hash: CEF0E734A102548FC758CF68C884A9DB7B5FF89214F1085E5E60EAB325CB30AE80CF04

Uniqueness

Uniqueness Score: -1.00%

Function 05C10F01, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0af8e46ff96c8300ec4e7b56cf0c77da7d04a100a6c31f7b34e9d3f7e78eab7
Instruction ID: 86e3a871bfe505c1868f6dad9205166b95ac88801b217bf647b17944b99e9a77
Opcode Fuzzy Hash: e0af8e46ff96c8300ec4e7b56cf0c77da7d04a100a6c31f7b34e9d3f7e78eab7
Instruction Fuzzy Hash: BCF01730904A59CBCB24DB64C984ADDB7B5BF89301F0045A9D8596B350EB349BC5DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05C1ADD0, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b6dcb610145836b52b4b718eec21fdb61273f79554da024dee7f56cfb4e4ad
Instruction ID: 21fe58addc37b44f59902f7f80775120061c3d286b2bd94d2c54cb44203c7651
Opcode Fuzzy Hash: 72b6dcb610145836b52b4b718eec21fdb61273f79554da024dee7f56cfb4e4ad
Instruction Fuzzy Hash: 35E0863774865507D3419A2CE45128BF7D2EBD0184B44CE35C1558B324DB51AC0787D1

Uniqueness

Uniqueness Score: -1.00%

Function 05C130D6, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137c8273e5e3ae8b2f3c9d51f5023fa9ce66ffa06ed235a8c6454679a8c377ef
Instruction ID: 069e770d0b4d4d403fcdd8b2a48eed04a08e4735f3dbf13109efc606eec19511
Opcode Fuzzy Hash: 137c8273e5e3ae8b2f3c9d51f5023fa9ce66ffa06ed235a8c6454679a8c377ef
Instruction Fuzzy Hash: AFF01270A142198BCB64DF64C88069DF7B6BF85204F008AE8C21D6B254DB305E858F95

Uniqueness

Uniqueness Score: -1.00%

Function 05C13621, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b1142af63dbaf33cba07db20924a390e4b62f0fbbdc7e9fc6ea589c6ea3118
Instruction ID: 5c72d49151f4729cec34d7fad0f8087e12eb8b8a10b88c5c9643f808d79a86c3
Opcode Fuzzy Hash: e1b1142af63dbaf33cba07db20924a390e4b62f0fbbdc7e9fc6ea589c6ea3118
Instruction Fuzzy Hash: E8F03A30D2121A8FCB11DF64C8986A9B7B5FF85304F1056DAD408A7200EB78AB80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05C18060, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30556eae3b2cde30002c4d4cbd866dd69b6ce42e94f23b28f2f3efcb54041d7
Instruction ID: f747b5d3644f821d8b51828cf7b241f143ae841cff6436ce2dc2e38e5fe27710
Opcode Fuzzy Hash: e30556eae3b2cde30002c4d4cbd866dd69b6ce42e94f23b28f2f3efcb54041d7
Instruction Fuzzy Hash: F4E08C303296109F8718DA1CF88489A77EAEF492213518D6AF50EC7764CB61FC404688

Uniqueness

Uniqueness Score: -1.00%

Function 05C12209, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659810a45e85a1f66ef4250ef8b8a411b709c15330da21a83b65f748eaf0d3e7
Instruction ID: 09b1e62f726ece0337abfb5d0321ced9103c13461a24929b0fcfd1d972367d16
Opcode Fuzzy Hash: 659810a45e85a1f66ef4250ef8b8a411b709c15330da21a83b65f748eaf0d3e7
Instruction Fuzzy Hash: 22F05830E213298FCB15DB64C8406A9B3BAFF95304F514AEAE5487B250E7B0BBC0CE00

Uniqueness

Uniqueness Score: -1.00%

Function 05C1D50C, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d5cdc8727a10a2f90912a060b1713877a31b070c2c3230796d57d1c9bf2943
Instruction ID: 5ff062fd5a823e2fd712e5cd09bc6342f7305615f22701ee49238650a0d091dc
Opcode Fuzzy Hash: 16d5cdc8727a10a2f90912a060b1713877a31b070c2c3230796d57d1c9bf2943
Instruction Fuzzy Hash: 0BF0C976A00209CFCF15DFA4E5455ECBBB1FB8E316F6408A9D806B3240DB365E45EB29

Uniqueness

Uniqueness Score: -1.00%

Function 05C12BDF, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fddb83fff8a8870a571eceac06548e96bcdfed43f5255f797e4d6f5150e7bd
Instruction ID: 85913052ba5a9253e5071351e1dfeaa50675e3992042580f54488674417637a8
Opcode Fuzzy Hash: 72fddb83fff8a8870a571eceac06548e96bcdfed43f5255f797e4d6f5150e7bd
Instruction Fuzzy Hash: D9F09B35A142499FCB00CB95C948A98BBB2FF49241F09C895E20AAB275D7759A90DF11

Uniqueness

Uniqueness Score: -1.00%

Function 05C12193, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a74b3ce87cc892050c5a64738a49b42caf5f580084c7fcee571377d3223c30
Instruction ID: e21b9178906f258169c361fd54cac348464964dcc98fabe21055268ad89511be
Opcode Fuzzy Hash: f9a74b3ce87cc892050c5a64738a49b42caf5f580084c7fcee571377d3223c30
Instruction Fuzzy Hash: DCE0DF20E2860ACBC704EB798C045AEFFB2BF86200B40896CC846B7120E3744A859B54

Uniqueness

Uniqueness Score: -1.00%

Function 05C12921, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8af8a24a48bdaeb1181a8d31d512458126b24428a6627a6efebf8e8745aab30
Instruction ID: c63f5dea04484dfde32370a9fdeceb27c3f75d5e93f0410d154fc144220a9255
Opcode Fuzzy Hash: c8af8a24a48bdaeb1181a8d31d512458126b24428a6627a6efebf8e8745aab30
Instruction Fuzzy Hash: 75E0C2B4A042188BCB54CF65D548A9EBBB6AB88200F1095E9DA0DA7354D7349A81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 05C124D1, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a9b08eaf3ac97394a5e5c0b2618ee2c4d21c91569e924bc0e7e47734b9c6ca
Instruction ID: be9796bc5d09475c24a02c7271da3e1b0d69a7833875f3981816c3a2072f47bc
Opcode Fuzzy Hash: 25a9b08eaf3ac97394a5e5c0b2618ee2c4d21c91569e924bc0e7e47734b9c6ca
Instruction Fuzzy Hash: F3F0A534A145188FDB54CF64C489A99BBB2FB48201F1441D9D81DD7324D7309A818F40

Uniqueness

Uniqueness Score: -1.00%

Function 05C1133A, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c05361691376c53ee85234f7c797487a2a61743af00d54b191dfb122f2285d83
Instruction ID: 6c8beb9d108e3896dfbd762f8c2b76ed49edbfd8ffbd6f5d5807dc85d0035489
Opcode Fuzzy Hash: c05361691376c53ee85234f7c797487a2a61743af00d54b191dfb122f2285d83
Instruction Fuzzy Hash: 2AE0E574A00214DFC768CF69C584AA9B7B6FF49310F1085E8E649AB325DB31EE82CF15

Uniqueness

Uniqueness Score: -1.00%

Function 05C1067D, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deb891efb011a3db6fefef755b3a28b5273d6a57ffec777b082abc490fc9355
Instruction ID: b6d7cdda8e45df44e35da5fe2681ab5282bf5ecb931da1199d353d35e1614879
Opcode Fuzzy Hash: 5deb891efb011a3db6fefef755b3a28b5273d6a57ffec777b082abc490fc9355
Instruction Fuzzy Hash: D2E0E530A012288FCB64DB74D89469DBBB2FF89710F5084E9E449A7365DB309E91CF41

Uniqueness

Uniqueness Score: -1.00%

Function 05C1DE38, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aea3e15011c6162fe5e7b2ac9b1579ce0f2362d8b98fe80e2873f45ff3c502c0
Instruction ID: 7d304332d275eabe15061445c6ca7ef5c9025a2d44d3d769faefe4c6678682f8
Opcode Fuzzy Hash: aea3e15011c6162fe5e7b2ac9b1579ce0f2362d8b98fe80e2873f45ff3c502c0
Instruction Fuzzy Hash: 70D05E36A0011C9F8B11BB94F4458DF7FAAFFD9760B408021EA0A8F268DF259915DBD5

Uniqueness

Uniqueness Score: -1.00%

Function 05C17DD0, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0234526c832a55e979aeea422b9b06254a65f32f7b494f800f9b2c928f5003d
Instruction ID: 70b8e42bf76b9cea004312659410227a59cf39c4f20eb2713afd4f154d910d8e
Opcode Fuzzy Hash: e0234526c832a55e979aeea422b9b06254a65f32f7b494f800f9b2c928f5003d
Instruction Fuzzy Hash: FBD0C9363141249F87059B68E508CA97FEDEB5D6613118066F90AC7321CE71DC149BD5

Uniqueness

Uniqueness Score: -1.00%

Function 05C13743, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b39602ad7ef50d1ee1bb62728ddbf131ea2c356a61ddc4ea90f557e6b510b0
Instruction ID: ea1993448b44558074b61540fad5cde8a8a4c3a8308279f9d6bc8de833077bbd
Opcode Fuzzy Hash: 31b39602ad7ef50d1ee1bb62728ddbf131ea2c356a61ddc4ea90f557e6b510b0
Instruction Fuzzy Hash: BFE0E670A1011A8BDB54DFA5C8405DEFBB6FF85344F005AD88619BF154E7305E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 05C11663, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777bea30e32630bdba7eb500e10f638ad4e905f20075ed865350c7c4021cfcf1
Instruction ID: 877339002491a1399b2d75ea9f3ae9c2773741c738c2f205cb6a560423180cad
Opcode Fuzzy Hash: 777bea30e32630bdba7eb500e10f638ad4e905f20075ed865350c7c4021cfcf1
Instruction Fuzzy Hash: 10E0EC70A1021A8BCB64CFA5C8846DDF7B5EB94204F00CDE58109A7225EB306E95CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05C1A1A0, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ff52a53c245135a2a4287e201f27456a5d441361f085e167b80d0125a05f03
Instruction ID: 52729ff38483693af3cba868a9f36c0be2575fb619ec89316544bf307675b199
Opcode Fuzzy Hash: 70ff52a53c245135a2a4287e201f27456a5d441361f085e167b80d0125a05f03
Instruction Fuzzy Hash: DCD09E31414B0DCFC700FF68D444855B7B8FF95310B01869AE5495B232EB70E590DB81

Uniqueness

Uniqueness Score: -1.00%

Function 05C10F6A, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec13f66d957fdfaa901314032e4303904883d67e02325baae88c3bf3b24f3ef6
Instruction ID: 89a0cf78a35360bace76763a8f557ff7fa83d9d4dc61840e90b29e05c90f6b2c
Opcode Fuzzy Hash: ec13f66d957fdfaa901314032e4303904883d67e02325baae88c3bf3b24f3ef6
Instruction Fuzzy Hash: 52E01734A023088FC759CF60C8449AAB3B2BF85200F1589E8D508AB318DB34EB41CF04

Uniqueness

Uniqueness Score: -1.00%

Function 05C15AF0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f412df58b1162d58c239ccc362c7d1db1b5979eef2ebe541bda376bc1fe5ec41
Instruction ID: ce0e19a3d32d16bd03677d3bb2f906ec3caef425ca8f7169544ec8c961c0f2f3
Opcode Fuzzy Hash: f412df58b1162d58c239ccc362c7d1db1b5979eef2ebe541bda376bc1fe5ec41
Instruction Fuzzy Hash: ACD0C93610010CEFCB01CF95D944D9A3BBAFF48710F008054FA084B232C332E820EB61

Uniqueness

Uniqueness Score: -1.00%

Function 05C11E55, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080d09c3be27849eb310293df20cc04577d00acb4685869e9c63c3a2ce2a6249
Instruction ID: 990ff5ed0756d00fbea330440fe4730545fbe7ead4a2ced73892362113a4c30f
Opcode Fuzzy Hash: 080d09c3be27849eb310293df20cc04577d00acb4685869e9c63c3a2ce2a6249
Instruction Fuzzy Hash: E7D0C930A1560DCBC705DFA2844405AFB63EF86141B98CE19852266214D739A911CA59

Uniqueness

Uniqueness Score: -1.00%

Function 05C10C3D, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313423913.0000000005C10000.00000040.00000001.sdmp, Offset: 05C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 674aba2f43868cd3c4e5fc4d23e3f3667b0e2a5c498dfbdd5d314bd26370d562
Instruction ID: 3b82da37e35ba24ab7c7ec9dbc598c56bfcfbc5c3cc2e23ef9385d963be6614e
Opcode Fuzzy Hash: 674aba2f43868cd3c4e5fc4d23e3f3667b0e2a5c498dfbdd5d314bd26370d562
Instruction Fuzzy Hash: BAD0C770A05215DFC709CB76C84456AB7B2BFC5340F45C9B8D4159B154DB35E641DF14

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03310560, Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98398cb71dfe8a87e888a3b32e4e8514c8169115d19d5fc0b4b41397eefe18d4
Instruction ID: 1298eb1b379b5a24c42d2ce5fbfaac018ead22c23d323f1c7f7cb0a38d9ae1fb
Opcode Fuzzy Hash: 98398cb71dfe8a87e888a3b32e4e8514c8169115d19d5fc0b4b41397eefe18d4
Instruction Fuzzy Hash: B5C1AB71E1021A8FCB0CDFA9C9956EEBBF6EF88314F248869D415E7344DB7099918B90

Uniqueness

Uniqueness Score: -1.00%

Function 01993FC0, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6052ebb63141bcc0a20d53442ada7adda005ac16e246d839c516ef503d23e57d
Instruction ID: 088b1d97428ad86939dc13cac809dd49c67f4a2f5ce32c5d03332798b8822db5
Opcode Fuzzy Hash: 6052ebb63141bcc0a20d53442ada7adda005ac16e246d839c516ef503d23e57d
Instruction Fuzzy Hash: 5281E074E15219CFCB04CF99CA8499EFBF2FF88310F149559D419AB225D330AA42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01993FB1, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a883ac3575f58b02fd3c4fce0a07840befb498e4ff2f6896b5ea5dbaf452511
Instruction ID: 58ecb7286c0a6054bbf27253fa2b6c124165ca3f3b089cfc45cb843da7dcd93d
Opcode Fuzzy Hash: 9a883ac3575f58b02fd3c4fce0a07840befb498e4ff2f6896b5ea5dbaf452511
Instruction Fuzzy Hash: 2381E174A15219CFCB05CFA9C98499EFBF2FF89350F14856AE419AB325D330AA42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01995338, Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a605f18ea18c63a8cdbbc26223f920e2004296fb439382ae5a1af4770ea2edd
Instruction ID: 47123d50a20f02200ab13dc8ee96322e13e8daf6ca800733c4470896627ab7a7
Opcode Fuzzy Hash: 0a605f18ea18c63a8cdbbc26223f920e2004296fb439382ae5a1af4770ea2edd
Instruction Fuzzy Hash: 78710770E15209CFDF09CFAAC6819DEFBF2FF89210F24946AD419B7214D3759A418B64

Uniqueness

Uniqueness Score: -1.00%

Function 01995348, Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a73400a7e16472580fa71fd850676dde39f85e71302d45d5d1806c2c3fc63e0d
Instruction ID: a34f55f12f8393f666cbef603b9dfad509f4bcb697162a2889d9c88afddd82ec
Opcode Fuzzy Hash: a73400a7e16472580fa71fd850676dde39f85e71302d45d5d1806c2c3fc63e0d
Instruction Fuzzy Hash: DD71F470E15209CFDF09CFAAC6819DEFBF6FF88210F24942AD419B7214D7759A428B64

Uniqueness

Uniqueness Score: -1.00%

Function 01994B08, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038e9dfd3d0568a80fb6568c153b873d8f054a43dff21eaba5da2f250cc804b7
Instruction ID: 9509819541d5d3272b25ea69a862add679d8fefe9631a6d34071e64ddae4f088
Opcode Fuzzy Hash: 038e9dfd3d0568a80fb6568c153b873d8f054a43dff21eaba5da2f250cc804b7
Instruction Fuzzy Hash: 8161D474E0521ADFCB05CF99CA809DEFBF2FB88310F158959D509AB254D730AA42CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01994AF8, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad446944d2c5e925a6352795caebce367b8909c605fcb25030077f8c0d7d4192
Instruction ID: 78e589df41756848628783b5a99d69b60e7515a81338d29a9f56300e661124e9
Opcode Fuzzy Hash: ad446944d2c5e925a6352795caebce367b8909c605fcb25030077f8c0d7d4192
Instruction Fuzzy Hash: F861F874E0525ACFCB05CFA9C6809DEFBF2FF88310F14855AD509AB255D730AA42CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 03313301, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a924f76c37f6cce3adf582d924f8f0a80b5f89410a456f0b6b897883a196af9b
Instruction ID: c858389a18fc26ccbcf5b9f06dc29c59422150006cedd165452e71d0a7b672b2
Opcode Fuzzy Hash: a924f76c37f6cce3adf582d924f8f0a80b5f89410a456f0b6b897883a196af9b
Instruction Fuzzy Hash: 4F518F354082A18FCB2ACF78C8852967FF1EF0B318B5945E9D452CF26AE3766551CB42

Uniqueness

Uniqueness Score: -1.00%

Function 01995119, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16e9c4522636cfc896e59562976e080bf51b41bce8f948ae25bb5c0c651c6f72
Instruction ID: 181aa5d13e40f7c9a7fd86a984da6b0b42162c21b0ed179d562b5a26ab2b22f7
Opcode Fuzzy Hash: 16e9c4522636cfc896e59562976e080bf51b41bce8f948ae25bb5c0c651c6f72
Instruction Fuzzy Hash: B94106B4E0460A8FDF45CFAAC5805AEFBF2BF89300F24C56AD419A7264D7349A41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01995128, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 013e0dee8db334f48c5505aab8f1730848a7648f56794347a0efba26a09f6afe
Instruction ID: 4b506894e63db7631d7d6cce606ce1bceb2e3d6e85a2b8805772313ed3385e2a
Opcode Fuzzy Hash: 013e0dee8db334f48c5505aab8f1730848a7648f56794347a0efba26a09f6afe
Instruction Fuzzy Hash: 0941F6B4E0420A9BDF44CFAAC5805AEFBF6BB88300F24C46AD519B7264D7349A41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 019955C9, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f8a7270c1843f9d88804190c4d8d905cc6eddf6660002a2872041d46d5a34b
Instruction ID: da7162fd15fd57abcd062b53cb8966967b4605c894b69f02b79ac51bd9b802b6
Opcode Fuzzy Hash: c5f8a7270c1843f9d88804190c4d8d905cc6eddf6660002a2872041d46d5a34b
Instruction Fuzzy Hash: D24117B0E0560ADFDB05CFA9D5815AEFBF2FF88310F64C56AC419A7214E7349A418BA4

Uniqueness

Uniqueness Score: -1.00%

Function 033152A0, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c23ab8d16cec4064b821c853d87e7640914a31f7c7545a8b8007c2b09186e24
Instruction ID: 759df3bbf8fce36bbe043610ceec187061fa31749898dbfba6a37fa9b122170d
Opcode Fuzzy Hash: 6c23ab8d16cec4064b821c853d87e7640914a31f7c7545a8b8007c2b09186e24
Instruction Fuzzy Hash: D9412B75E15218DFDB58CFA9D981BDEFBB6FF89200F1080AAD408A7224DB709A51CF51

Uniqueness

Uniqueness Score: -1.00%

Function 019955D8, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2dcb20a2ebbafa04278da98da2ff7e9e7e6df6c717ef96cf2b69f6a699f20b6
Instruction ID: 3bd98093a51f4c1a1ceb45ee9d98009ec301ef47731ccf825b9f45fef59b1773
Opcode Fuzzy Hash: e2dcb20a2ebbafa04278da98da2ff7e9e7e6df6c717ef96cf2b69f6a699f20b6
Instruction Fuzzy Hash: D541F3B0E0520ADFDB04CFA9D5805AEFBF2FB88310F64C56AC419B7254D7349A418BA4

Uniqueness

Uniqueness Score: -1.00%

Function 03310A38, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94bb06ba0d3e02ef0332f8dae494c892421dcb6e06fb1f21fef0f9b3b9a7586
Instruction ID: 06e87f100844b7b848d2dd739c77b913f61deb009552db6e0ec69b6b848663af
Opcode Fuzzy Hash: f94bb06ba0d3e02ef0332f8dae494c892421dcb6e06fb1f21fef0f9b3b9a7586
Instruction Fuzzy Hash: A0317C70E11619CFDF2CCFAADD8069EFBB6BB88200F14C4AAD508E7254DB305A958F51

Uniqueness

Uniqueness Score: -1.00%

Function 03310A29, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76fea2fa71f2cca079a29a0a28ad53d0a00d517ce9f4563b84c292cc415956e4
Instruction ID: f9c2d9ce437ffa3a1452e84de1f72bf6604bcaa156c89f3fb4dc4d9507615417
Opcode Fuzzy Hash: 76fea2fa71f2cca079a29a0a28ad53d0a00d517ce9f4563b84c292cc415956e4
Instruction Fuzzy Hash: 4E31A270E116599BDB1CCF6ADD806AEBBB7BFC8200F14C4AAD548E7354DB300A858B51

Uniqueness

Uniqueness Score: -1.00%

Function 03311070, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef35dcbd9e972d32c8338c1943183b3c656758663df11ba47d3f4f772285f54
Instruction ID: 873fc375f30cabe55bcec3f9d5f3319cef297cace7eaab35ed13692542325201
Opcode Fuzzy Hash: 8ef35dcbd9e972d32c8338c1943183b3c656758663df11ba47d3f4f772285f54
Instruction Fuzzy Hash: 8131AE70D1A3648FDB5ACF76D88269ABFF2AF86300F18C4AAC444EB265D7341905CF52

Uniqueness

Uniqueness Score: -1.00%

Function 03312350, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6033c9fc844b48c41abb3946080aca9577922f1b3eea995afe0edbf78fb5f0
Instruction ID: 6bab887d796130175130ca04cbb08e1bd37496d225b0b521f9f700c8566176c6
Opcode Fuzzy Hash: 8a6033c9fc844b48c41abb3946080aca9577922f1b3eea995afe0edbf78fb5f0
Instruction Fuzzy Hash: 00313C71E11619DBDB18CFAAD98169EFBBBFBC8200F14C86AD508E7214DB705A518F60

Uniqueness

Uniqueness Score: -1.00%

Function 03312340, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46888628b65761a14a958414f8f5e435677e3e3103ae085506e2d75eab66f5f
Instruction ID: e0b8f20964ea21adc339c6e5244a1c54d47d000bf3a67fc4f0a69148dbb8eeb2
Opcode Fuzzy Hash: d46888628b65761a14a958414f8f5e435677e3e3103ae085506e2d75eab66f5f
Instruction Fuzzy Hash: 95314B70E116199BDB1CCFAAC9806AFFAF7BFC8200F14C86AD508E7254DB305A558F61

Uniqueness

Uniqueness Score: -1.00%

Function 03312961, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be2f75f05b75c4beff865cbd1350c6f38438023586fbafafd240050341b8e8b
Instruction ID: 11fb2fbaf7e01fa4fbe706ef999400bc34ca2954272449ac69828ae4a39b74fe
Opcode Fuzzy Hash: 2be2f75f05b75c4beff865cbd1350c6f38438023586fbafafd240050341b8e8b
Instruction Fuzzy Hash: E63189718053588FDB06CF75D8953CEBFB2EF8A304F1884AAD404AB2A5D7791599CF82

Uniqueness

Uniqueness Score: -1.00%

Function 01995792, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306421062.0000000001990000.00000040.00000001.sdmp, Offset: 01990000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1362fd78949fb8f4b99ac0f21c5cd73dd1c44eaec428d11a1da2f3e899d87bf2
Instruction ID: 9f55830cfd03a3e7bf4f9086db54c428757c253d95e3d43f1157bba4c5d36ca6
Opcode Fuzzy Hash: 1362fd78949fb8f4b99ac0f21c5cd73dd1c44eaec428d11a1da2f3e899d87bf2
Instruction Fuzzy Hash: 12210E71E056188FEB19CF6B98406DEFBF7AFC9200F04C5BAC508A6218DB3405468F51

Uniqueness

Uniqueness Score: -1.00%

Function 03314E38, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d0c9378a7029773f257e47709c69f5466580dacfdfd90af68632a36fad17e5
Instruction ID: 5c05636c704ace111a67ecf74845e28f64997d5bd4267aa6a1cf311a962a3d09
Opcode Fuzzy Hash: 79d0c9378a7029773f257e47709c69f5466580dacfdfd90af68632a36fad17e5
Instruction Fuzzy Hash: D011E231044662DFCB6ACF30C8833563BF2FF0631434486A9C4A3CE2AAE6355122CB82

Uniqueness

Uniqueness Score: -1.00%

Function 033116E0, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 350ba99b67772fcc9630f01c046bfc13b5dac2b331fbd0e302fe583ab761cc3e
Instruction ID: 0d2f72d7a45392360d82193c5d0f2188cf6d977e58e93bcd5e99bec72b783ee1
Opcode Fuzzy Hash: 350ba99b67772fcc9630f01c046bfc13b5dac2b331fbd0e302fe583ab761cc3e
Instruction Fuzzy Hash: 9D213B314093A5CFCB6B9F74C88169ABFF1AF1B314B4845E9D482CB2AAE7351446CF02

Uniqueness

Uniqueness Score: -1.00%

Function 03314EB1, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306582521.0000000003310000.00000040.00000001.sdmp, Offset: 03310000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c42637cb14b6a47024e44f740fabc02cc1089321563d7a64260211a9687cc6c7
Instruction ID: c760ac8fde14414d2a1ba2934a036e1fdb6ca8977c5cdd560e27a7c16c94918a
Opcode Fuzzy Hash: c42637cb14b6a47024e44f740fabc02cc1089321563d7a64260211a9687cc6c7
Instruction Fuzzy Hash: 2B11BC324886228FCB6ECF75C4C23567BF6FB0631534691A5C457CE5AAEB305052CB86

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: shipping documents approval.exe PID: 4280 Parent PID: 5640 shipping documents approval.exeCOMMON

Executed Functions

Function 06245D44, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 0624B633

Memory Dump Source

Source File: 0000000E.00000002.486709810.0000000006240000.00000040.00000001.sdmp, Offset: 06240000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 16ee518f12799b33bcf35a6b720d11e9a7a0b2a76e0cbbf86f0c1664e60ebb59
Instruction ID: 2c26774846e08ab6631f35fd3c63eb8b160ec49c76c7f0882271214be10633db
Opcode Fuzzy Hash: 16ee518f12799b33bcf35a6b720d11e9a7a0b2a76e0cbbf86f0c1664e60ebb59
Instruction Fuzzy Hash: 425120B0E102198FDB58DFA9C888B9DFBB5BF48315F148529E815BB390DB74A844CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0624B4EC, Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 0624B633

Memory Dump Source

Source File: 0000000E.00000002.486709810.0000000006240000.00000040.00000001.sdmp, Offset: 06240000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1f6e6bfe20f6f959a4fee5bc98829c6fe7c271448083c7ced7521ae427640b06
Instruction ID: e41e31ebac5c48415cc017a173c6788676b2249d61e5075421e42b0df77791cf
Opcode Fuzzy Hash: 1f6e6bfe20f6f959a4fee5bc98829c6fe7c271448083c7ced7521ae427640b06
Instruction Fuzzy Hash: 4F5110B0D102198FDB18DFA9C884BDDBBB5BF48314F148529E815BB391D774A844CF91

Uniqueness

Uniqueness Score: -1.00%

Function 062491EC, Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 0624B633

Memory Dump Source

Source File: 0000000E.00000002.486709810.0000000006240000.00000040.00000001.sdmp, Offset: 06240000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: e2f05b9910e9e7ca9f05e53301763eb10d27751b9e6153604c0647a9c6a02531
Instruction ID: fa18704b096adb8ad5e72624391ebe9dfa71ae778d5f6fd834e39d8a16d04efa
Opcode Fuzzy Hash: e2f05b9910e9e7ca9f05e53301763eb10d27751b9e6153604c0647a9c6a02531
Instruction Fuzzy Hash: F25120B0E202198FDB58DFA9C888B9DFBB5BF48315F148529E815BB390D774A844CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0546354C, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 054651A2

Memory Dump Source

Source File: 0000000E.00000002.484730673.0000000005460000.00000040.00000001.sdmp, Offset: 05460000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 18589ca8a6db25deaa0663aab3b8d1bd15fe0e7b93c6323affbfabdedcb04e22
Instruction ID: 3e19da21ae5de6bac668056a2af4a6ece1f61f193c375cc572714042da4bfa84
Opcode Fuzzy Hash: 18589ca8a6db25deaa0663aab3b8d1bd15fe0e7b93c6323affbfabdedcb04e22
Instruction Fuzzy Hash: 2151CFB1D003099FDF14CFA9C984ADEBBF5BF48314F64852AE819AB210D7759845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05465084, Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 054651A2

Memory Dump Source

Source File: 0000000E.00000002.484730673.0000000005460000.00000040.00000001.sdmp, Offset: 05460000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cfaff6a76fcbe22ae8e213cbfdb5a3d3e50e0c0972c191c4b49b2bd10089c1c5
Instruction ID: 42c185b19c6c445be24656591f83e7c1f574bec67f0762a63d18237fd70727e5
Opcode Fuzzy Hash: cfaff6a76fcbe22ae8e213cbfdb5a3d3e50e0c0972c191c4b49b2bd10089c1c5
Instruction Fuzzy Hash: 0351CDB1D003099FDF14CFA9C984ADEBBF5BF48314F64852AE819AB210DB759885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05467780, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05467F09

Memory Dump Source

Source File: 0000000E.00000002.484730673.0000000005460000.00000040.00000001.sdmp, Offset: 05460000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 68a827f333556588b9e7b16d96314cb82c8cebf0b8118594347f5b70bf36a13c
Instruction ID: 50c9ba328035088c9933401af7d710d170186d7f5f84c7cd4aeebd563f4043e3
Opcode Fuzzy Hash: 68a827f333556588b9e7b16d96314cb82c8cebf0b8118594347f5b70bf36a13c
Instruction Fuzzy Hash: 5E411BB5A002058FCB14CF99C488BEABBF5FF88318F15C45AE519AB321D734A845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0546C109, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0546C192

Memory Dump Source

Source File: 0000000E.00000002.484730673.0000000005460000.00000040.00000001.sdmp, Offset: 05460000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 2e092e61ffbcff894ca89cb45ccfbeb08483ab56abc0277a4622a17b3fc0c032
Instruction ID: 7882f3e9ad506a22df3702f16366d631e254f534f0eb27975a97cb79be8302eb
Opcode Fuzzy Hash: 2e092e61ffbcff894ca89cb45ccfbeb08483ab56abc0277a4622a17b3fc0c032
Instruction Fuzzy Hash: C831BAB19082888FDB10DFA9D9897DABFF4FB06318F14805AE489E7742C77958048F62

Uniqueness

Uniqueness Score: -1.00%

Function 054664F8, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05466B2E,?,?,?,?,?), ref: 05466BEF

Memory Dump Source

Source File: 0000000E.00000002.484730673.0000000005460000.00000040.00000001.sdmp, Offset: 05460000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 935a173d7230ea59681ad59e76658d32a16fa4376f5b14847ae066ffb1c22f77
Instruction ID: 37f1f0e0acad29f5de73adde892ddcf877be92b34728656a05c60fffb8b7c0e9
Opcode Fuzzy Hash: 935a173d7230ea59681ad59e76658d32a16fa4376f5b14847ae066ffb1c22f77
Instruction Fuzzy Hash: F621E0B5900248AFDB10CFA9D984AEEBBF8EB48324F15845AE915A7310D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05466B62, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05466B2E,?,?,?,?,?), ref: 05466BEF

Memory Dump Source

Source File: 0000000E.00000002.484730673.0000000005460000.00000040.00000001.sdmp, Offset: 05460000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6ca2dfe8c86876ca8fb4b13c44021c381635bc61920f9bad9d91b35f2d8d556a
Instruction ID: df21321bc134cebf0933424e8008b990e54e4f17b284479f7390e1eaa371d381
Opcode Fuzzy Hash: 6ca2dfe8c86876ca8fb4b13c44021c381635bc61920f9bad9d91b35f2d8d556a
Instruction Fuzzy Hash: BB21E2B5900248AFDB10CFA9D984BDEBFF8FB48324F15841AE914A7310D775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0546C118, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0546C192

Memory Dump Source

Source File: 0000000E.00000002.484730673.0000000005460000.00000040.00000001.sdmp, Offset: 05460000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: b664fcc90083a6fa400ff64b907ed518b0f6b03e9ab9303f23e0ff2b3d4e4a24
Instruction ID: 20de6b19bfae99b57c3e962052be8c5552fd220d9d1fe968e114c2763d1942f0
Opcode Fuzzy Hash: b664fcc90083a6fa400ff64b907ed518b0f6b03e9ab9303f23e0ff2b3d4e4a24
Instruction Fuzzy Hash: EC1156B19043098FDB20EFAAC5897DEBBF4FB44714F20846AD449A7741CB3969048FA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report shipping documents approval.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: shipping documents approval.exe PID: 5640 Parent PID: 5780

General

Chronological Activities